Notifications
Clear all

HikVision DVR

19 Posts
9 Users
0 Likes
6,976 Views
passcodeunlock
(@passcodeunlock)
Posts: 792
Prominent Member
 

Make an image of it, analyze with different solutions and report back what gave you the best results.

 
Posted : 26/04/2018 6:01 pm
tito
 tito
(@tito)
Posts: 24
Eminent Member
 

I need to recover data from a Hik Vision DVR (Model DS-7216HGHI-SH).

Data is from April 4th, 2018. Apparently system was set to start overwriting after ten days. We were not able to copy the hard drive until 4/18/18.

What is the possibility of getting any usable video from the HD from that time frame? We have run a trial copy of DVR Examiner on it. It only shows 5 clips but they say they are 00 minutes long and we can’t see what they are or which camera they are from. The local forensic tech we used to copy the drive said he would not have any ability to go beyond what DVR examiner shows. The drive is 2 TB in size.

Any suggestions for this? I tried downloading HX-Recovery but my anti-vurus software flagged it and wouldn't let me download.

According to DVR Examiner, the rest of the info is

Filesystem Name HIK_264
Filesystem Version 2018.01.22
DVR Examiner Version 2.2.0
Database Version 3/20/2018

Type SegmentedRaw
Bytes Per Sector 512
Sector Count 3907029168
Total Size 1863 GB

Maybe specialists from 512Byte Company will help you. Here are their contacts http//soft.512byte.ua/products/hikvrecovery.html

 
Posted : 27/04/2018 6:29 am
jaclaz
(@jaclaz)
Posts: 5133
Illustrious Member
 

Maybe specialists from 512Byte Company will help you. Here are their contacts http//soft.512byte.ua/products/hikvrecovery.html

A specialist from 512Byte Company has already posted/intervened before you

Write to your personal mail. We wrote the software, you can check what dates you can reсovery.

jaclaz

 
Posted : 27/04/2018 7:48 am
JaredDM
(@jareddm)
Posts: 118
Estimable Member
 

Data is from April 4th, 2018. Apparently system was set to start overwriting after ten days. We were not able to copy the hard drive until 4/18/18.

What is the possibility of getting any usable video from the HD from that time frame?

So that's approximately 4 days of overwriting then. I'd say the odds of recovery for that time frame are pretty low. I'm sure my DVR guy could recover video from the HDD, but no one can recover overwritten data…no one!

 
Posted : 27/04/2018 9:02 pm
passcodeunlock
(@passcodeunlock)
Posts: 792
Prominent Member
 

The overwriting process isn't linear considering the timeline, there are big chances that the needed data or parts of it are still available!

@JaredDM nobody can recover overwritten data, but since here we talk about video content data, if overwriting wasn't 100%, there are chances to recover dirty frames, still having parts of the original data

 
Posted : 28/04/2018 7:07 am
jaclaz
(@jaclaz)
Posts: 5133
Illustrious Member
 

The overwriting process isn't linear considering the timeline, there are big chances that the needed data or parts of it are still available!

@JaredDM nobody can recover overwritten data, but since here we talk about video content data, if overwriting wasn't 100%, there are chances to recover dirty frames, still having parts of the original data

Define "dirty frame", please.

It is pretty much binary, at disk level a given sector has either been overwritten or it hasn't.

Assuming, only because of the time passed and on the features of the unknown and undocumented overwriting mechanism that something has been overwritten is as arbitrary as assuming that it has not.

As a matter of fact, if the presented data is correct

Data is from April 4th, 2018. Apparently system was set to start overwriting after ten days. We were not able to copy the hard drive until 4/18/18.

Everything is possible. 😯

We don't know WHEN the 10 days overwriting loop starts, nor how much data 10 days of recording use of the disk space, we don't even know if the recording was "motion controlled" or "continuous" and - in the case of the latter - how much compression is affected (or not affected) by a "static" scene.

Let's say that the 10 days was set because - roughly - 10 days of recording equates maximum to 1.5 TB (or 3/4 of the drive capacity), i.e. for each day there is at most 150 GB recorded, while an eventless day is more like 100 GB.

On days 1-10 the first 1.5 Tb or less are written.

What happens on day 11-20?

1) the recorder continues linearly to record past the 1.5Tb until it gets to 2 Tb, then wraps around.
2) the recorder re-starts from sector 0 (the last 500 GB of the drive are NEVER written)
3) the recorder re-starts from a *random* sector.

if #1 on day 15 (i.e. 18/04 if day 1 is 04/04) anything between 0 and 500 GB from previous recordings may have been NOT overwritten
if #2 the data is overwritten and lost
if #3 who knows?

jaclaz

 
Posted : 28/04/2018 11:28 am
(@ares99)
Posts: 5
Active Member
Topic starter
 

I ran the HikV Recovery demo software. The demo provided a text file with a long list of dates and times including the following from the time period I am looking for

2018-04-04 11-01-23 - 11-12-35.264
2018-04-04 11-12-35 - 12-08-32.264
2018-04-04 11-15-56 - 11-27-45.264
2018-04-04 11-20-40 - 11-47-50.264
2018-04-04 11-21-53 - 12-09-42.264
2018-04-04 11-27-45 - 11-28-26.264
2018-04-04 11-28-18 - 11-48-26.264
2018-04-04 11-28-26 - 11-36-29.264
2018-04-04 11-36-29 - 12-23-05.264
2018-04-04 11-47-50 - 12-55-00.264
2018-04-04 11-48-26 - 12-35-27.264
2018-04-04 12-08-32 - 12-11-13.264
2018-04-04 12-09-42 - 12-29-02.264
2018-04-04 12-11-13 - 12-23-15.264
2018-04-04 12-23-05 - 13-30-14.264
2018-04-04 12-23-15 - 12-49-12.264

I presume these are the video clips that are recoverable? Can anyone verify that this software works to extract the clips? If so, well worth the cost but trying to do my due diligence before spending $1000 of my bosses money.

 
Posted : 30/04/2018 10:03 pm
passcodeunlock
(@passcodeunlock)
Posts: 792
Prominent Member
 

@ares99 Pretty big money for unsure results…

@jaclaz your theory is right, in practice for this Hikvision recorder your assumed #3 applies (if #3 who knows?)

 
Posted : 01/05/2018 4:49 pm
Vesalius
(@vesalius)
Posts: 66
Estimable Member
 

I recently had a DVR recovery case infront of me and after a lot of trying using all different tools and softwares I failed, only to find out the files had been corrupted.

I did more research and stumbled across this software which saved the case and the innocent people were saved.

check this out, best thing about it is that you can test it to see if you can recover the files, when you recover it, email the owner and tell him you see some files, he will then send you a temporary reg key so you can see if you can view the files or not, if it works, you can go ahead and purchase the tool to your requirement, this really helped me and I hope it can help you.

http//hxdvr.com/

 
Posted : 27/07/2018 9:38 pm
Page 2 / 2
Share: