Chinese DVR Data Access/Recovery

[shahij]

The HDD was working fine with DVR, the client hooked into windows 8 and it was asking for initialization then the client/user did initialization. Now the drive is neither accessible under windows nor on DVR anymore.

Used UFS Explorer and got 44 MPG but none is working.
WinHex produced 44 MPG files found but nothing saved.

Only option I see is doing things manually.
Do you have any direction on this one please?

[fzabkar]

The HDD was working fine with DVR, the client hooked into windows 8 and it was asking for initialization then the client/user did initialization. Now the drive is neither accessible under windows nor on DVR anymore.

Used UFS Explorer and got 44 MPG but none is working.
WinHex produced 44 MPG files found but nothing saved.

It could be that the DVR encrypts the data. That's possibly why Windows couldn't recognise the partition information in sector 0.

Alternatively it could be that the DVR may be using a Linux OS.

Could we see the first few sectors?

[Doomer]

Many DVRs use proprietary file systems. Yours could be one of them

[shahij]

Do you need the files or do you just need to re-use the drive ?
To re-use the drive you might be able to erase it with mhdd and should initialize again on the DVR.
To recover the files you will need a tool that supports the same file system as the DVR.
My guess is that windows messed up the first sectors of the drive and now the partition table and file alocation table is gone ...

Definitely Data is required. HDD is 100% ok.

The HDD was working fine with DVR, the client hooked into windows 8 and it was asking for initialization then the client/user did initialization. Now the drive is neither accessible under windows nor on DVR anymore.

Used UFS Explorer and got 44 MPG but none is working.
WinHex produced 44 MPG files found but nothing saved.

It could be that the DVR encrypts the data. That's possibly why Windows couldn't recognise the partition information in sector 0.

Alternatively it could be that the DVR may be using a Linux OS.

Could we see the first few sectors?

Yes, Ill update it here.

Many DVRs use proprietary file systems. Yours could be one of them

SEEMS . overall my understanding is like fzabkar, bcos of initialization some sectors info is changed.

By the way, do you know Which & how many sectors gets changed after initialization under Windows 8?
I planned to hookup a same capacity (2TB) HDD to the DVR and initialize then take it back to windows to check the sectors.

[HaQue]

You said

Now the drive is neither accessible under windows nor on DVR anymore

So you cant be sure the drive is 100%.

I would grab a bootable clonezilla disk, or another imaging solution, and take an image of the drive if you can. Then you can work with the disk image and not risk killing that one or destroying the data.

maybe post the exact make and model of the DVR and see if someone has dealt with it before.

[shahij]

You said

Now the drive is neither accessible under windows nor on DVR anymore

So you cant be sure the drive is 100%.

I would grab a bootable clonezilla disk, or another imaging solution, and take an image of the drive if you can. Then you can work with the disk image and not risk killing that one or destroying the data.

maybe post the exact make and model of the DVR and see if someone has dealt with it before.

I meant "VOLUME" as "Drive" inaccessible, not the drive (HDD) itself.
I am talking/dealing from the CLONE, not the original. I have the know-how about precautions.
The matter of fact is that It's non-brand (CHINESE) 32 Channel DVR.

While opening the Disk on WinHex, following message appears...

Untitled.png (28.49 KiB) Viewed 7507 times

Also attached first few sectors data here.

WinHex.zip

(28.99 KiB) Downloaded 326 times

[Doomer]

By the way, do you know Which & how many sectors gets changed after initialization under Windows 8?

I checked the binary dump
The drive has been initialized with GPT partition schema
That means first and last 16KB of data on the drive is modified
If some partitions were formatted than it's even more altered/modified/erased data

[shahij]

By the way, do you know Which & how many sectors gets changed after initialization under Windows 8?

I checked the binary dump
The drive has been initialized with GPT partition schema
That means first and last 16KB of data on the drive is modified
If some partitions were formatted than it's even more altered/modified/erased data

NO, it was not formatted. Only INITIALIZATION was made.

Do you mean 16KB (First 32 Sectors) + 16KB (Last 32 Sectors)?