Get recordings from the HDD of my DVR

[rotkraut]

Hello!

I want to copy the recordings from the HDD[0] of my digital video recorder[1] to my PC. The DVR has an USB interface but it is deactived at this firmware so I cannot use it. So I removed the HDD from the DVR and connected it to my PC. The filesystem is unknown so I cannot search for the recordings on the HDD. Does somebody has a glue how I can determine the filesystem or better: how I can copy the recordings from this HDD?

Thank you!

Richard

[0] Wester Digital WS3200AAJS WD Daviar SE
[1] Cisco HD DVR 8485DVB

[Cleanroom]

99% sure that the DVR handles all the file system information on your drive. All that is stored on the drive is raw video. You could do a RAW scan of the drive and see what it finds.

Is it possible to network the DVR so you can save of the files from it over to a network drive?

[rotkraut]

Yeah I am also sure that the DVR handles the file system information. How can I make a RAW scan? Which tool/scan configuration shall I use? I made a mountable AFF-image with OSForensics of the HDD to make further analysis.

Also a question is: Are the recordings encrypted? But as it is a MPEG-4-DVR, I hope not so.

The DVR has a network interface but unfortunately it is also deactivated from the firmware, as USB is.

[networks]

Most DVR's are proprietary systems. Maybe we can help if we knew make and model of what we are dealing with to see what info can be gleaned from that. Their has to be a way to get the video off the DVR otherwise what is the point ? Most have DVD burner or working USB or working Ethernet but you suggest your model has none of these.

[Vulcan]

@networks,

Maybe we can help if we knew make and model of what we are dealing with

FYI the OP has already given that info:

Cisco HD DVR 8485DVB

[networks]

Vulcan sorry I missed it just had been reading the replies. Since the device is made specifically for Western European Markets and specifically for the Cable Television market that narrows the pool of individuals that may have already attempted to "hack" it for other purposes. I am certain its proprietary. I would suggest the OP start looking at the drive in hex to see what he can glean from that info on the drive and start looking at the Cisco Patents on the product to see what he can find there. I think a bit of reverse engineering is going to occur to crack this open.

[quasimodo]

Yeah Also a question is: Are the recordings encrypted? But as it is a MPEG-4-DVR, I hope not so.

The drive should not be encrypted.

Does somebody has a glue how I can determine the filesystem or better: how I can copy the recordings from this HDD?

Like the colleagues have already mentioned, there are a few things that you can try, but it's a proprietary format and more than likely you will not find much documentation or further help, other than the good info and tips provided. At this point it will depend on your skill and comfort level as well as the importans of the video data. If it's not absolutely necessary, than don't move the videos to your pc. If it is necessary you could:

a) ask cisco for support, if you don't have a partner account with support plan they will bill you, but nevertheless might be able to help.
b) try to figure out the format and share your findings.
c) send it to a data recovery firm that knows how to extract the data for you.

[fzabkar]

Yeah I am also sure that the DVR handles the file system information. How can I make a RAW scan? Which tool/scan configuration shall I use? I made a mountable AFF-image with OSForensics of the HDD to make further analysis.

Could you upload the first and last 1MB of this image? Maybe someone will recognise the format. BTW, I have a DVD recorder with a proprietary file system that starts at the end of the drive and works toward LBA 0.

[rotkraut]

Could you upload the first and last 1MB of this image?

Thanks for the replies! Sure. Anybody has a tool/script for getting the first and last MB of a really big file?

[networks]

WinHex will do the job nicely

[rotkraut]

Great! Here are the first and the last MB of the raw image. I hope somebody can tell me more about how I can get those recordings.

Thanks!

Attachments

DVR-HDD-raw.img.lastMB.zip

last MB of raw img file

(1019.87 KiB) Downloaded 1625 times

DVR-HDD-raw.img.firstMB.zip

first MB of raw img file

(20.4 KiB) Downloaded 1275 times

[fzabkar]

LBA 0 (offsets 0x00 - 0x1FF) has no MBR code and no partition table. However, it has the 0x55 0xAA signature ID which would normally identify the sector as a valid MBR. The remaining non-zero bytes are the Disk Signature which may have been written by Windows. LBA 0 is not encrypted.

The following page explains the structure of a Windows MBR:

Windows 2000 & Windows XP Master Boot Record:
http://thestarman.pcministry.com/asm/mbr/Win2kmbr.htm

Thereafter ISTM that your DVR is using a 64-bit encryption system of some sort. I'm guessing that the following 8-byte sequence may be a repeating pattern of encrypted zeros:

4C B7 A0 98 5A A4 04 E9

I suspect that the beginning of the drive has a directory structure with one entry per sector.

The directory information appears to be stored at the following offsets:

0x400
0x600
0x7E0
0x9E0
0xBE0
...
0x35FE0
0x361E0

I suspect that this corresponds to 432 entries. Does that sound reasonable? This number may include deleted entries as well.

If you have a spare HDD, perhaps you could zero-fill it, install it in your DVR, and then examine the changes that the DVR makes to it.

[rotkraut]

I don't understand. If you say it is encrypted, don't we have no chance to get the recordings?

[BlackST]

I would ask Cisco or - if the DVR was branded by a TV carrier, them .

Things are made uneasy because of copyright protection, but "* MAYBE *" you can get something good

I can't tell you nothing more, unfortunately.

[fzabkar]

I don't understand. If you say it is encrypted, don't we have no chance to get the recordings?

Not by any known computationally feasible means.

I don't know which algorithm is used by your DVR, but AES is a popular open standard:
http://en.wikipedia.org/wiki/Advanced_E ... n_Standard

BTW, I suggest you make one additional recording and then re-examine the HDD image. I expect that there will be an additional directory entry at offset 0x363E0.

[rotkraut]

Haha if AES is used really, we of course can dismis this project.

Neither Cisco nor my TV provider gave me information about that - I asked them.

Well I bought a 20GB HDD at ebay to put it into the DVR and make a short recording and will then analyse it again. I hope this will be worth the 15 eggs

[xanh]

Isn't it easier to just connect the video output to your pc and record it from the video output?
Many DVR systems seem to have the same way of saving the video data. Maybe you can get one that has a working usb output and put the drive in there ( though this would just be a guess )

[rotkraut]

Recording the output with my TV card via Composite is no problem, but the (HD)quality of course gets very, very poor.
Getting a box with working USB output unfortunatelly is not possible, because my tv provider does not want me to save the provided, digital content 1:1.
If we wont make it to "hack" the filesystem of the HDD, the only chance left is to buy a TV card with HDMI input, which is able to record Full HD via HDMI input. Unfortunatelly, such cards are very exepensive. But I really hope we can make the recordings on the HDD visible!

[fzabkar]

Which decoder chip does your PVR use?

Just curious ...

[rotkraut]

How can I find out?