Switch to full style
Anything related to computer forensics (new section!)
Post a reply

DHFS DVR Video recovery

August 23rd, 2019, 13:40

Hi,

I have 2 TB Drive with DHFS partition from FLIR DVR system. I removed drive from DVR on July 28th to stop more overwrites. I need to recover video from May 20th to June 7th. All videos prior to July 20th were removed from system.

Will the video be there for May 20th to Jun 7th and recovery is possible ?

What are the chances and cost associated?

Thank You,

Re: DHFS DVR Video recovery

August 23rd, 2019, 18:23

Do you know how much data has been written to that drive since that date ? Obviously, the more has been written, the lower the odds of recovery are... If 2TB or more have been written, the odds are virtually nihil.
I don't know anything about that DHFS system, and don't know any software that supports it, but using the freeware Photorec, assuming that the video files are in a common format among those recognized by Photorec, you can scan the whole drive and extract every such file that is found. Problem is, fragmented files (as most of them are likely to be on such a system) won't be extracted correctly. It has an option to scan only free space, although for that to work it has to recognize the partition type.
But if only 8 days worth of recordings are stored, it would imply that by June 15th all the recordings made prior to June 7th had been wiped already, so it might not even be worth the trouble.

Re: DHFS DVR Video recovery

August 24th, 2019, 6:23

agreed, am afraid required data is already gone...
sorry.

Re: DHFS DVR Video recovery

August 24th, 2019, 9:35

Hello,
Software that may support DHFS: https://www.sysdevlabs.com/product.php?id=mcctv

abolibibelot wrote:I don't know anything about that DHFS system, and don't know any software that supports it, but using the freeware Photorec, assuming that the video files are in a common format among those recognized by Photorec, you can scan the whole drive and extract every such file that is found. Problem is, fragmented files (as most of them are likely to be on such a system) won't be extracted correctly. It has an option to scan only free space, although for that to work it has to recognize the partition type.
But if only 8 days worth of recordings are stored, it would imply that by June 15th all the recordings made prior to June 7th had been wiped already, so it might not even be worth the trouble.

DHFS is simple system, nothing special. Most off all that DVR used H264 stream. Because stream mixed with vendor specific metadata RAW recovery would not help.


nutsonnet wrote:Hi,
I have 2 TB Drive with DHFS partition from FLIR DVR system. I removed drive from DVR on July 28th to stop more overwrites. I need to recover video from May 20th to June 7th. All videos prior to July 20th were removed from system.
Will the video be there for May 20th to Jun 7th and recovery is possible ?
What are the chances and cost associated?
Thank You,


Please check how much days stored on DVR right now. It may be 2-3 weeks. May be more - depend on video quality and number of cameras.
MindMergepk wrote:agreed, am afraid required data is already gone...
sorry.

Yes, most of all data overwritten.

Re: DHFS DVR Video recovery

August 24th, 2019, 13:00

DHFS is simple system, nothing special. Most off all that DVR used H264 stream. Because stream mixed with vendor specific metadata RAW recovery would not help.

Alright then. But in such a case it's still possible to do a raw scan with a custom file signature, isn't it ? (Provided that the vendor specific header has a specific enough pattern.) Both R-Studio and Photorec have that ability, don't know about others.
Of course a software that can understand the file system is much better, but $200 is a quite hefty fee for a one-time job, it has to be really worth it. The trial mode apparently allows to display the list of files detected during the scan, but only allows to extract files with a size below 768KB, which doesn't seem very useful. If it shows the list of files' clusters somewhere perhaps some trick can be used...

Re: DHFS DVR Video recovery

August 24th, 2019, 15:02

With some DVR systems, I've been able to pull raw data with R-Studio, but depending on the system (my experience is almost entirely with Dahua), you may find you get a bunch of randomly named files. If you're lucky, those files are actually video that can be viewed in VLC, or a player that supports DAV format. However, it would be a long process as you'd have to simply go file by file looking for the video you want, and hope it's even there.
I've had to recover data from robberies, and spend 8 hours just randomly opening files that were recovered. It's not fun, but I have had it pay off.

Re: DHFS DVR Video recovery

August 24th, 2019, 16:22

I forgot to mention that at least some manufacturers have tools to read video from their drives. In the case of Dahua, they have DiskManager. This lets Windows access the drive with just a SATA adapter, so if the data has not been overwritten you can view it. Of course, once it's overwritten, I can only wish you luck.

Re: DHFS DVR Video recovery

September 3rd, 2019, 14:25

Hello All,

Thank you for replies I did not realize so many people responded as I did not receive any email sorry.
I have also reached out to lot of sources and forgot about this forum.

HDD I scanned it with HX recovery and it list lot of files prior to I removed from DVR on 28th. It list files from April most of files are 2-4 mb each and when I try to play it play small portion from previous date and switch to June 27 in between. So I think files are there only the HX recovery is not able to put the data in correct order. Not sure not an expert. Please advise. What should I do?

Thanks

Re: DHFS DVR Video recovery

September 3rd, 2019, 14:40

wyrrmzr wrote:I forgot to mention that at least some manufacturers have tools to read video from their drives. In the case of Dahua, they have DiskManager. This lets Windows access the drive with just a SATA adapter, so if the data has not been overwritten you can view it. Of course, once it's overwritten, I can only wish you luck.
Hi,

Sorry for late reply I completely forgot about this post and did not expect people will reply. I ran the hx recovery tool and scan result shows file from April even and each file is 2-4 Mb. When I play any file itstart initial bit with older file and than date changes on video to July27. Support from hx recovery dont know how to fix this issue. I think video are there just need to run different scan or something. Please advise this is critical for me.

Thank You all for responses.

Re: DHFS DVR Video recovery

September 5th, 2019, 15:11

Did you try this tool that was suggested (and developed I believe) bi iUrii: Software that may support DHFS: https://www.sysdevlabs.com/product.php?id=mcctv

Re: DHFS DVR Video recovery

September 7th, 2019, 3:16

nutsonnet wrote:
wyrrmzr wrote:I forgot to mention that at least some manufacturers have tools to read video from their drives. In the case of Dahua, they have DiskManager. This lets Windows access the drive with just a SATA adapter, so if the data has not been overwritten you can view it. Of course, once it's overwritten, I can only wish you luck.
Hi,

Sorry for late reply I completely forgot about this post and did not expect people will reply. I ran the hx recovery tool and scan result shows file from April even and each file is 2-4 Mb. When I play any file itstart initial bit with older file and than date changes on video to July27. Support from hx recovery dont know how to fix this issue. I think video are there just need to run different scan or something. Please advise this is critical for me.

Thank You all for responses.


Data Overwritten, chances are too low (almost below Zero)
Post a reply