Hi all,

I would like to ask for your help and advice

I have a DVR manufactured by ITX security and I'm trying to extract recordings from its HDD.

What I've managed to do already was to connect a 2TB HDD to the DVR, format it via said device - record video on it for a few minutes, power off the device and reconnect the HDD to a PC. The HDD is recognized properly in Win7 (however without displaying its size and used space, merely displaying its name [IFS1600000Disk] and 0/0Bytes information). Running DMDE uncovered extra bit of information, i.e. DMDE informed me that the filesystem is FAT32 (not surprised here, as it was properly detected under Win) - and displayed complete filesystem of the DVR. Hooray

Here's where the riddle starts:

Said HDD is full of 128-MB hidden files named MB00000.IFS,MB00001 etc. etc. - in a consecutive manner.

My guess is:

- that these are archive files and were created in the moment of HDD format. As I said, the HDD contains ~20 mins of recording, so these can't merely be recordings - the filesystem rather reserves all available space for them.
- that there have to be appropriate video file headers inside the files (if not, what would be the reason of having >150 deparate multi-MB files?)

My problem is:

I don't know where to go further with it. I guess I should search for known file headers inside the file, the problem is - I do not know details.
What I do know, is that the DVR encodes in H264 format - and it most probably uses IMM5 or IMM6 codec (as it returns this codec as required when trying to connect to it via RTSP stream).
here's the Dropbox link https://www.dropbox.com/s/5peofg8q3lxsic5/MB00000.IFS that contains one of the recovered files.
Viewing in WinHex displays "BMNI" ASCII information right at the file's beginning.

Thank you in advance for your help and suggestions.

Well, you can try a few things before start actually thinking, like move forward to what you might identify as the main data stream or streams, and copying it or them onto a working video file with H264 encoding, with known headers (replacing your target video file data streams). Then try to open it with Videolan or similar. You might be surprised at that point!

What is the usual way this is acheived, and why cant you use that?

Really weird situation

"The file you're looking for has been deleted or moved."

_________________
A backup a day keeps DR away.

Hello! This is my first post on the forum. I got the same problem medix08 has. I am trying to retrieve video from a Lorex L23WD800 DVR and it has the same file arrangement (starting with MB00000.IFS), it finally ends with a SPARE.IFS file. Specs show it records using the h.264 format, but got no luck trying to convert the MBXXXXX.IFS files.

Here is my situation: the Lorex DVR cannot access the 500 GB HDD due to a power failure (it shows cross-link errors) but anyway I recovered the IFS files before trying to mess up with the HDD data. I erased the partitions on another 1TB HDD and connected it to the DVR, first thing the DVR does is formatting the HDD properly. Then I turned the DVR off and connected the HDD to my PC right away. MiniTool Partition Wizard can see the same file structure - 128 MB (134,217,728 bytes) IFS files and again the SPARE.IFS file (24.3 MB - 25,526,272 bytes), all of them on FAT32 (it can fit more 128 MB IFS files on 1TB as expected).

This is my idea to get the files back to the HDD and make it work into the DVR: delete the partitions on the original 500 GB HDD and connect it to the Lorex DVR, let it format the HDD, turn the DVR off, connect the HDD back to my PC, and use the DMDE disk editor to overwrite the same files that are located on the partition from my backup. This is all theory because I have never used DMDE, but read about its features (sounds like a powerful tool). Any ideas or suggestions before attempting this move? Thank you for your patience.

Here are two files... They were really easy to compress (128+MB to 153KB? )
http://www.putlocker.com/file/5F7390DBD55E8A92

Both files are full of zeros. The 128MB file has a "BMNI" header. I wonder if this could be "MBIN" in 16-bit little endian format.

_________________
A backup a day keeps DR away.

Full of zeros means no data?

File full of zeros = file with entropy close to 0; entropy 0 = no data at all.

So the videos stored by the DVR are still there?

Hi all,

I'm going to re-upload the file - in the course of last days I had spent a few hours tinkering with the file - there's something inside that looks like timestamps - and after that there's something that might be the video data. As for h.264 - it has no header of any kind, it is not a file after all - so it might be a difficult task to figure out which byte is the exact beginning of the video stream. There are NAL units, which define the h264 - these have the 24 bit code 0x000001 preceding them for the purpose of synchronization - but said values are prettty common in such a large file.

Tried to use file-carving tools from Backtrack, searching for anything of use in these files, but ultimately it produced no results. Going to give a try with cutting and pasting the stream - if I manage tho figure out where does it start.

CarloMario - we seem to have DVRs from the same manufacturer, ITX - at least the file structure seems to be identical.

Hi, there was a similar thread about dvr recovery. A guy in Australia was contacted and he was able to write a tool to carve files from a system. I cant remember specifics right now, but a search of my posts should find where it was discussed. Maybe contact that guy/company? Might save you some time and headache

Here's the file:

https://www.dropbox.com/s/a0tycw1d6jlu7fn/MB00003.IFS

also attaching the screenshot showing its very beginning.

"71 52" seems to be a delimiter of sorts, because it appears constantly throughout the whole "timestamps" section.

There seems to be some data present, starting from 0xA100 - again bytes separated by delimiters.

The interesting things start from 0x10801B. First, we have the plain-text "Flags" - and then, a lot of data which seems not to be confined between delimiters. Could this be the video stream?

Thanks for your help, guys! Here goes a small update:

I've managed to find h264 data, can be identified by 0x000001 67 - NAL sequence delimiter. FFmpeg plays the streams, the problem is - they're all mixed up. If I carve the h264 part from the .IFS file and try to play the stream - the ffmpeg will decode frames, but the 8 video channels will alternate consecutively - apparently the DVR simply dumps all the video inputs into one .IFS file, fills it, then moves on to the next IFS etc.. Considering that a 2TB HDD keeps ~16000 of these, manual search for a particular stream seems an arduous task.

Is there anything that could help in identifying the timestamps/channels and/or could automate the h264 extraction process?

HaQue, I managed to find your post about the Australian guy, am I right? You provided his webpage IIRC. Will try to contact him as you suggested.

Without regard to any known structures, these are the patterns that appear to be present throughout the file.

_________________
A backup a day keeps DR away.

medix08 - Sounds like good news! If there is an automated process to extract video data it would be great. Yes, they look like the same manufacturer with a different brand name (mine is Lorex from Canada).

Hi all,
I have been having the same problem. Ive been attempting to read the file system .ifs on a DVR disk. I have combed the internet, approached the vendor and still nothing. I have been able to view the streaming files though, natively through Ubunutu's media player. That said the files are all jumbled up, and it looks like the files are striped across all of the files (14869 files - 2TB). It doesnt however show any date or time and is very grainy. If anyone has found a way to view the files natively, and retain the date/time I would appreciate the heads-up.
THanks
Marty

HaQue,
Hi HaQue,
Do you have that guy in OZ contact? I am experiencing the same problem with DVR.
I have approached the vendor directly, but they dont seem to have a tool which can read the filesystem outside of the device.
Any help would be appreciated.
Thanks
Marty

Hi Marty,
The post I made about it is here:
http://forum.hddguru.com/viewtopic.php?f=1&t=27220&hilit=+dvr

the link goes to this post on another forum:
http://www.cctvforum.com/viewtopic.php?f=3&t=13335&start=15

I don't personally know him, but I have heard that the company is very good. The guys name is Eric from http://www.datarecovery.com.au

another relevant bit is :


cheers