All times are UTC - 5 hours [ DST ]




Post new topic Reply to topic  [ 14 posts ] 
Author Message
 Post subject: DVR Hard Drive
PostPosted: November 12th, 2014, 14:17 
Offline

Joined: November 6th, 2014, 15:29
Posts: 8
Location: montana, usa
We work regularly with DVR failed drives and recovering the data on these drives. In this particular case all we had to do is a PCB swap with a rom swap, due to a completely fried PCB.

Normally the only way we can test these files is to obtain the original DVR or similar model and re-enter the imaged drive, or reverse engineer the saving structure into a working file. In this particular case we have a very small Linux partition which contains log files, and the rest is proprietary to the DVR it came out of.

With a raw recovery we have four separate video files that fill 470GB of the 500GB HD. However there are also the obvious 150 other files that the DVR combines with its proprietary system to view these videos.

Is there any trick, or software to configure these files to be tested on a Windows or Linux machine? I know we can try to reverse engineer the structure into a working file type, but as we have lots of jobs and little time I am looking for a better avenue. Any help or suggestion is appreciated.


Top
 Profile  
 
 Post subject: Re: DVR Hard Drive
PostPosted: November 12th, 2014, 16:24 
Offline
User avatar

Joined: September 8th, 2009, 18:21
Posts: 15463
Location: Australia
VideoLAN (VLC) can often play files recorded on DVR/PVR devices, unless they are encrypted. Sometimes you just need to rename the file extension.

_________________
A backup a day keeps DR away.


Top
 Profile  
 
 Post subject: Re: DVR Hard Drive
PostPosted: November 12th, 2014, 17:49 
Offline
User avatar

Joined: June 8th, 2006, 19:44
Posts: 3144
Location: Atlanta, GA
Fzabkar: I have some .dvr files that won't play with VLC. What extension do you recommend?

Thank you

Jon

_________________
http://www.datasaversllc.com


Top
 Profile  
 
 Post subject: Re: DVR Hard Drive
PostPosted: November 12th, 2014, 18:01 
Offline
User avatar

Joined: September 8th, 2009, 18:21
Posts: 15463
Location: Australia
I have an STB that generates files with an SQTS extension. I need to rename then as *.MTS (MPEG transport stream), then they play OK.

http://www.edaboard.co.uk/thompson-usb- ... 22721.html

_________________
A backup a day keeps DR away.


Top
 Profile  
 
 Post subject: Re: DVR Hard Drive
PostPosted: November 12th, 2014, 18:08 
Offline
User avatar

Joined: June 8th, 2006, 19:44
Posts: 3144
Location: Atlanta, GA
More info: The original drive is PATA, and the partitions are Linux/Ext3, so it probably predates MP4 encoding, for example.

_________________
http://www.datasaversllc.com


Top
 Profile  
 
 Post subject: DVR hard drive recovery
PostPosted: November 12th, 2014, 18:22 
Offline

Joined: February 8th, 2014, 8:08
Posts: 456
Location: Eastern Europe /recovering worldwide/
westerndatarecovery wrote:
Normally the only way we can test these files is to obtain the original DVR or similar model and re-enter the imaged drive, or reverse engineer the saving structure into a working file. In this particular case we have a very small Linux partition which contains log files, and the rest is proprietary to the DVR it came out of.

With a raw recovery we have four separate video files that fill 470GB of the 500GB HD. However there are also the obvious 150 other files that the DVR combines with its proprietary system to view these videos.

This made me curious: the first paragraph perfectly describes what we see recovering data from failed DVRs. And that's the primary problem with surveillance systems.

But the second one is contradictory - do you mean that working with DVR, which uses its own format, you have extracted some files, which are perfectly playable and at the same time you're unable to extract some of the recordings?


westerndatarecovery wrote:
I know we can try to reverse engineer the structure into a working file type

This is the only way to recover the video if it isn't accessible through the recorder for some reason.
Nearly always we analyze DVR drive from the scratch and develop recovery software for the particular job.

_________________
• Remote RAID, NAS, SAN, VMware, DVR (CCTV), flash and tape recovery. Data recovery support.


Top
 Profile  
 
 Post subject: DVR video recovery
PostPosted: November 12th, 2014, 18:27 
Offline

Joined: February 8th, 2014, 8:08
Posts: 456
Location: Eastern Europe /recovering worldwide/
jono-ats wrote:
More info: The original drive is PATA, and the partitions are Linux/Ext3, so it probably predates MP4 encoding, for example.

This is a kind of fortunetelling, but depending on the size and contents of remaining drive space, the partition(-s) can be a system one, where the DVR internal software and/or recordings metadata is stored.

_________________
• Remote RAID, NAS, SAN, VMware, DVR (CCTV), flash and tape recovery. Data recovery support.


Top
 Profile  
 
 Post subject: Re: DVR Hard Drive
PostPosted: November 12th, 2014, 19:23 
Offline
User avatar

Joined: June 8th, 2006, 19:44
Posts: 3144
Location: Atlanta, GA
Thanks, Fzabkar. I'll try that.

Postscript: That, and a few other extensions I tried didn't work.

Apparently, it's a moot point --- the file creation dates are out of the range of interest.

_________________
http://www.datasaversllc.com


Top
 Profile  
 
 Post subject: Re: DVR Hard Drive
PostPosted: November 12th, 2014, 19:52 
Offline
User avatar

Joined: September 8th, 2009, 18:21
Posts: 15463
Location: Australia
westerndatarecovery wrote:
With a raw recovery we have four separate video files that fill 470GB of the 500GB HD.

Doesn't a successful raw recovery imply that the DR software either understands the file system or recognises the file type? If so, and if the file system is proprietary (ie unknown), wouldn't this imply that the file types are known formats?

_________________
A backup a day keeps DR away.


Top
 Profile  
 
 Post subject: Re: DVR Hard Drive
PostPosted: November 14th, 2014, 17:02 
Offline

Joined: November 6th, 2014, 15:29
Posts: 8
Location: montana, usa
fzabkar wrote:
westerndatarecovery wrote:
With a raw recovery we have four separate video files that fill 470GB of the 500GB HD.

Doesn't a successful raw recovery imply that the DR software either understands the file system or recognises the file type? If so, and if the file system is proprietary (ie unknown), wouldn't this imply that the file types are known formats?


Yes the file types are known and recovered, but without the DVR to assemble all the appropriate files you can not view them. The way this process works either has to be reverse engineered or viewed with the DVR. We did receive the DVR and have tested the drive with the DVR. It seems like we have an underlying problem with the drive we recovered, and are now looking further into it.


Top
 Profile  
 
 Post subject: Re: DVR Hard Drive
PostPosted: November 16th, 2014, 11:54 
Offline
User avatar

Joined: June 11th, 2013, 17:01
Posts: 1710
Location: Phoenix, AZ USA
I have had couple of surveillance systems in recently. Both were H.264 files with a separate log file partition. I did a lot of research and only found one instance where someone was able to partially re-assemble a portion of the videos. This was for a murder case, so resources were pretty much unlimited, but they still only had partial files with lots of corruption (enough to convict however). I also know a software engineer who wrote a popular data recovery program and he couldn't do anything with them. Like westerndatarecovery, then only way to play them was through the original DVR.

_________________
HDD, SSD, Flash and RAID Data Recovery
Founder of The Data Recovery Professionals Group


Top
 Profile  
 
 Post subject: Re: DVR Hard Drive
PostPosted: November 17th, 2014, 11:06 
Offline

Joined: November 6th, 2014, 15:29
Posts: 8
Location: montana, usa
Thanks for sharing your experience ddrecovery. The partial files with corruption that you obtained, was that through a raw recovery then, or from trying to re-assemble the files? It seems like there is always something new to learn in the business! In my experience with this particular drive I started off with a raw recovery of the drive. There is a separate log file partition as well, simply with log files of restarting times, so I know I have a non-corrupt hard drive. I have 4 raw video files that take up the full size of the DVR HDD, yet are not viewable by any means. The DVR now will not recognize the HDD, but will recognize and format a new drive in its place. I am in the process of further diagnosing this drive, but it seems as if no errors of any kind are arising thus far. Any ideas?


Top
 Profile  
 
 Post subject: Surveillance system video recovery
PostPosted: November 17th, 2014, 17:43 
Offline

Joined: February 8th, 2014, 8:08
Posts: 456
Location: Eastern Europe /recovering worldwide/
ddrecovery wrote:
I have had couple of surveillance systems in recently ...
I did a lot of research and only found one instance where someone was able to partially re-assemble a portion of the videos ...
but they still only had partial files with lots of corruption (enough to convict however). I also know a software engineer who wrote a popular data recovery program and he couldn't do anything with them.

Recovery software engineer you talked with is right. Format diversity among DVR vendors is extensive and there's no way to handle DVR videos the same way as regular files during raw recovery.

But we can handle this problem. We analyze drive contents manually and develop custom recovery software for each job.
With this approach all the videos from surveillance system are perfectly playable and the quality is the same as it was saved by DVR, without any reduction.

Should you need any assistance with a similar system in the future, we'll be glad to help remotely.

_________________
• Remote RAID, NAS, SAN, VMware, DVR (CCTV), flash and tape recovery. Data recovery support.


Top
 Profile  
 
 Post subject: DVR recordings recovery
PostPosted: November 17th, 2014, 17:51 
Offline

Joined: February 8th, 2014, 8:08
Posts: 456
Location: Eastern Europe /recovering worldwide/
westerndatarecovery wrote:
I have 4 raw video files that take up the full size of the DVR HDD, yet are not viewable by any means. The DVR now will not recognize the HDD, but will recognize and format a new drive in its place. I am in the process of further diagnosing this drive, but it seems as if no errors of any kind are arising thus far. Any ideas?

Nothing is wrong, everything should be this way, that's why I wondered and asked you earlier about the playable / non-extractable recordings at the same time.

DVR uses proprietary "file system" to store video stream, so now, when you have a physically working hard drive, which isn't recognized by DVR, next and only step is to reverse engineer the format and recover the recordings.

If you stuck with that at some point, I'll be glad to look into this job remotely.

_________________
• Remote RAID, NAS, SAN, VMware, DVR (CCTV), flash and tape recovery. Data recovery support.


Top
 Profile  
 
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 14 posts ] 

All times are UTC - 5 hours [ DST ]


Who is online

Users browsing this forum: Google [Bot] and 73 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group