All times are UTC - 5 hours [ DST ]




Post new topic Reply to topic  [ 28 posts ]  Go to page 1, 2  Next
Author Message
 Post subject: DVR Header ID
PostPosted: September 17th, 2019, 4:42 
Offline
User avatar

Joined: May 13th, 2010, 11:17
Posts: 2726
Location: Kuwait
Hello guys,

I got another drive here which looks Encrypted (maybe), and the device as the client said is not working
this is the exact dump (1st. 2000 sectors) which looks new to me here..

Not re-init. not connected to PC (drive was not working before and we made a clone)

Any ideas`s here??

attached is the file compressed.

Thank you

btw the last 8% of the drive is filled with Zero`s (no data at all)


Attachments:
Header.rar [1.09 KiB]
Downloaded 375 times

_________________
Kuwait Data Recovery - UNIX GTC
The only reason for time is so that everything doesn't happen at once. By: Albert Einstein
Top
 Profile  
 
 Post subject: Re: DVR Header ID
PostPosted: September 17th, 2019, 8:33 
Offline

Joined: March 4th, 2019, 8:33
Posts: 71
looks to me a shift on the beginning + bad sectors
did u made the clone with R-studio ?


Top
 Profile  
 
 Post subject: Re: DVR Header ID
PostPosted: September 17th, 2019, 10:27 
Offline
User avatar

Joined: May 13th, 2010, 11:17
Posts: 2726
Location: Kuwait
HaspHL wrote:
looks to me a shift on the beginning + bad sectors
did u made the clone with R-studio ?


100% clone with ZERO bads

_________________
Kuwait Data Recovery - UNIX GTC
The only reason for time is so that everything doesn't happen at once. By: Albert Einstein


Top
 Profile  
 
 Post subject: Re: DVR Header ID
PostPosted: September 17th, 2019, 11:17 
Offline

Joined: March 4th, 2019, 8:33
Posts: 71
you didn't answer my question
HaspHL wrote:
did u made the clone with R-studio ?

if so then the following statement:
einstein9 wrote:
100% clone with ZERO bads

is not true

because R-studio uses (by default) "E5" as a bad sector pattern

Attachment:
Rstudio BS pattern.png
Rstudio BS pattern.png [ 9.66 KiB | Viewed 9336 times ]


Top
 Profile  
 
 Post subject: Re: DVR Header ID
PostPosted: September 18th, 2019, 2:54 
Offline
User avatar

Joined: May 13th, 2010, 11:17
Posts: 2726
Location: Kuwait
@ HaspHL

We NEVER USED r-studio for clone , have other tools for it
as i said drive was NOT WORKING we fixed it then Cloned it... so this E5 here is not related to the case.

you are making a good point here but its not related to the case.

Thank you

_________________
Kuwait Data Recovery - UNIX GTC
The only reason for time is so that everything doesn't happen at once. By: Albert Einstein


Top
 Profile  
 
 Post subject: Re: DVR Header ID
PostPosted: September 18th, 2019, 3:18 
Offline

Joined: March 4th, 2019, 8:33
Posts: 71
K then

the start of the clone is shifted
(as mentioned above)
and it has a FAT32 structure


Top
 Profile  
 
 Post subject: Re: DVR Header ID
PostPosted: September 18th, 2019, 3:28 
Offline
User avatar

Joined: May 13th, 2010, 11:17
Posts: 2726
Location: Kuwait
HaspHL wrote:
K then

the start of the clone is shifted
(as mentioned above)
and it has a FAT32 structure


How about if i tell you i scanned it with R-Studio and found NOTHING at alll? not even a single working 1k image

_________________
Kuwait Data Recovery - UNIX GTC
The only reason for time is so that everything doesn't happen at once. By: Albert Einstein


Top
 Profile  
 
 Post subject: Re: DVR Header ID
PostPosted: September 18th, 2019, 3:38 
Offline

Joined: March 4th, 2019, 8:33
Posts: 71
i can only judge what's in front of me


Top
 Profile  
 
 Post subject: Re: DVR Header ID
PostPosted: September 18th, 2019, 17:12 
Offline

Joined: May 13th, 2019, 7:50
Posts: 404
Location: Nederland
How do we know that's the only thing that shifted/flipped. If I look at offset 11776 (decimal) I see what appears to be a shifted FSInfo sector signature and again bytes are flipped (0x41 0x61 0x52 0x52 instead of 0x52 0x52 0x61 0x41, normally at offset 0 in sector, right?).

Edit: Oh dammit, my mentioned offsets are off because I inserted 2 bytes at start of file. And also if you do that FAT shifts too while it doesn't need to.

Quote:
How about if i tell you i scanned it with R-Studio and found NOTHING at alll? not even a single working 1k image


Carved? Then with HxD or similar search for 0x45 0x78 0x69 0x66 and then check if preceding 0xFF 0xD8 is properly sector aligned? Assuming some JPEGs present.

_________________
www.disktuna.com - photo repair service


Top
 Profile  
 
 Post subject: Re: DVR Header ID
PostPosted: September 18th, 2019, 17:54 
Offline

Joined: May 13th, 2019, 7:50
Posts: 404
Location: Nederland
Is it a Humax?

_________________
www.disktuna.com - photo repair service


Top
 Profile  
 
 Post subject: Re: DVR Header ID
PostPosted: September 18th, 2019, 20:44 
Offline
User avatar

Joined: September 8th, 2009, 18:21
Posts: 13501
Location: Australia
Sector 0 looks like an MBR when it is dword-reversed. However, it does not follow the MS standard.

Code:
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

000001C0  00 00 0C 00 00 00 00 00 00 10 00 20 00 00 00 00
                ^^          ^^^^^^^^^^^ -----------
000001D0  00 00 0C 00 00 00 00 20 00 10 12 81 9E A0 00 00
                ^^          ^^^^^^^^^^^ -----------
000001E0  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
000001F0  00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 AA

There appear to be two FAT32 partitions (ID = 0x0C).

The first begins at sector 0x10 and has a size of 0x200000 sectors.

The second begins at sector 0x200010 and has a size of 0x12819EA0 sectors.

The total size is 0x200010 + 0x12819EA0 sectors = 160.04 GB

Similarly, sector 0x10 looks like a FAT32 boot sector when it is reversed, but once again it does not totally follow the MS standard (eg the FSINFO sector pointer is 0x100 instead of 1).

The text strings are little-endian dwords. FAT64 = exFAT.

    HUMAX 0.1
    HUMAXI-CORDFAT64<3 spaces>

The signature is "FAT64", but the sector doesn't look like an exFAT boot sector:

https://www.ntfs.com/exfat-boot-sector.htm

original

Code:
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

00002000  48 00 00 E9 58 41 4D 55 02 31 2E 30 84 00 08 00  H..éXAMU.1.0„...
00002010  00 00 00 01 00 00 F8 00 02 00 20 00 00 00 20 00  ......ø... ... .
00002020  00 00 20 00 FF 07 00 00 00 00 00 00 02 00 00 00  .. .ÿ...........
00002030  06 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
00002040  00 29 00 00 48 00 00 00 58 41 4D 55 4F 43 2D 49  .)..H...XAMUOC-I
00002050  41 46 44 52 20 34 36 54 00 00 20 20 00 00 00 00  AFDR 46T..  ....


reversed

Code:
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

00002000  E9 00 00 48 55 4D 41 58 30 2E 31 02 00 08 00 84  é..HUMAX0.1....„
                                                       ^^
00002010  01 00 00 00 00 F8 00 00 00 20 00 02 00 20 00 00
          ^^
00002020  00 20 00 00 00 00 07 FF 00 00 00 00 00 00 00 02
                      ^^^^^^^^^^^
00002030  00 01 00 06 00 00 00 00 00 00 00 00 00 00 00 00
                ^^^^^
00002040  00 00 29 00 00 00 00 48 55 4D 41 58 49 2D 43 4F  ..)....HUMAXI-CO
00002050  52 44 46 41 54 36 34 20 20 20 00 00 00 00 00 00  RDFAT64   ......
........
000021F0  00 00 00 00 00 00 00 00 00 00 00 00 00 00 AA 55  ..............ªU

There appears to be only 1 copy of the FAT.

Logical sector 6 appears to be a copy of the boot sector.

The 32-bit FAT is located at logical sector 0x84, ie physical sector 148 (= 0x84 + 0x10).

The number of sectors per FAT appears to be 0x7FF.

First sector of FAT (not reversed)

Code:
Offset(h) 00       04       08       0C

00012800  F8FFFF0F FFFFFF0F FFFFFF0F FFFFFF0F
00012810  FFFFFF0F FFFFFF0F FFFFFF0F FFFFFF0F
00012820  09000000 0A000000 DD2E0000 FFFFFF0F
00012830  FFFFFF0F FFFFFF0F FFFFFF0F FFFFFF0F
00012840  FFFFFF0F FFFFFF0F FFFFFF0F FFFFFF0F
00012850  FFFFFF0F FFFFFF0F FFFFFF0F FFFFFF0F
00012860  FFFFFF0F FFFFFF0F 1B000000 1C000000
00012870  1D000000 1E000000 1F000000 20000000
00012880  21000000 22000000 23000000 24000000
00012890  25000000 26000000 27000000 28000000
000128A0  29000000 FFFFFF0F 2B000000 2C000000
000128B0  2D000000 2E000000 2F000000 30000000
........

It would appear that Humax uses a hybrid FAT32 system and deviates from the MS standard by mixing up the endianness of the various file system components.

There is an unusal structure at physical sector 0x30.

Code:
Offset(h) 00       04       08       0C

00006000  00100000 00000000 00000000 5E000000
00006010  00000000 8B080000 01000000 00000000
00006020  00000000 01000000 01000000 01000000
00006030  00000000 07000000 01000000 02000000
........
000065F0  03020100 07060504 0B0A0908 0F0E0D0C


Sector 0x33 has a directory segment which looks out of place. :?

Normally one would expect to find the root directory just after the last FAT. In the case of the first volume I would expect to find it at sector 2195 (= 148 + 0x7FF).

That said, the user's data would probably be located at sector 0x200010. It could very well be that the data are dword reversed, in which case one would need to reverse the entire 160GB user area before performing a raw scan.

_________________
A backup a day keeps DR away.


Top
 Profile  
 
 Post subject: Re: DVR Header ID
PostPosted: September 19th, 2019, 3:10 
Offline
User avatar

Joined: May 13th, 2010, 11:17
Posts: 2726
Location: Kuwait
@ fzabkar & Arch Stanton

The one who brought this drive to us said its from DVR but seems you have a point here really, i was looking maybe to the wrong direction...
i found some traces of Channel Names (probably a receiver with hdd inside) we asked him to send us the defected device just to verify

looking into this now...

Thank you again

_________________
Kuwait Data Recovery - UNIX GTC
The only reason for time is so that everything doesn't happen at once. By: Albert Einstein


Top
 Profile  
 
 Post subject: Re: DVR Header ID
PostPosted: September 19th, 2019, 3:13 
Offline

Joined: May 13th, 2019, 7:50
Posts: 404
Location: Nederland
OMG fzakbar, superior bitfockery! I was kinda hoping you'd chime in.

_________________
www.disktuna.com - photo repair service


Top
 Profile  
 
 Post subject: Re: DVR Header ID
PostPosted: September 19th, 2019, 3:38 
Offline
User avatar

Joined: September 8th, 2009, 18:21
Posts: 13501
Location: Australia
The DVR appears to be a Humax I-Cord 160GB.

I believe that I could probably write a program to de-obfuscate the "mixed endianness" of Humax's FAT32 file system, so a professional programmer should make easy work of it, assuming that the available tools don't already handle this peculiar format.

That said, it may turn out to be a pointless exercise if the data are encrypted. One would need to inspect sector 0x200010 (the boot sector of the second FAT32 volume) and then locate its FAT and root directory. It would also help to see sector 2195 (dec) in the first volume.

As a test case we could possibly extract one file manually by locating its directory entry. This would tell us the file's size and starting cluster, and we could then walk through the FAT to locate the file's remaining clusters.

_________________
A backup a day keeps DR away.


Top
 Profile  
 
 Post subject: Re: DVR Header ID
PostPosted: September 19th, 2019, 4:19 
Offline
User avatar

Joined: September 8th, 2009, 18:21
Posts: 13501
Location: Australia
I'm guessing that most of the content would be scrambled.

http://web.archive.org/web/20080312075351/http://www.humaxdigital.com/global/products/IRCI-PVR.asp

http://web.archive.org/web/20071114064935/http://www.humaxdigital.com/GLOBAL/products/new_leaflet/iCORDIRCI-PVR_leaflet.pdf

http://web.archive.org/web/20071114064626/http://www.humaxdigital.com/GLOBAL/products/new_manual/IRCI-PVR_M.pdf

_________________
A backup a day keeps DR away.


Top
 Profile  
 
 Post subject: Re: DVR Header ID
PostPosted: September 19th, 2019, 6:52 
Offline
User avatar

Joined: May 13th, 2010, 11:17
Posts: 2726
Location: Kuwait
fzabkar wrote:



probably, some time ago i got a 500gb from DVD Recorder (has hdd inside to convert VHS2DVD) the only way i found was by fixing the unit
and connect the drive and export everything otherwise no header of any KNOWN type, like RAW recording and the UNIT itself can decode/read it.

Thnx for the update here :beer:

_________________
Kuwait Data Recovery - UNIX GTC
The only reason for time is so that everything doesn't happen at once. By: Albert Einstein


Top
 Profile  
 
 Post subject: Re: DVR Header ID
PostPosted: September 19th, 2019, 7:24 
Offline
User avatar

Joined: December 4th, 2012, 1:35
Posts: 3747
Location: Adelaide, Australia
isn't there a software or guy that is the bomb-diggity on DVR stuff? I cant remember the name but it may support this


Top
 Profile  
 
 Post subject: Re: DVR Header ID
PostPosted: September 19th, 2019, 8:21 
Offline
User avatar

Joined: May 13th, 2010, 11:17
Posts: 2726
Location: Kuwait
HaQue wrote:
isn't there a software or guy that is the bomb-diggity on DVR stuff? I cant remember the name but it may support this


I think it might be easier to fix the unit (if possible) rather than going through the headache and waste more time

the problem is always Will the Client pay @the end?? hehehe <--- sometimes doesn`t matter for me... its all about knowing only..

_________________
Kuwait Data Recovery - UNIX GTC
The only reason for time is so that everything doesn't happen at once. By: Albert Einstein


Top
 Profile  
 
 Post subject: Re: DVR Header ID
PostPosted: September 19th, 2019, 15:56 
Offline
User avatar

Joined: September 8th, 2009, 18:21
Posts: 13501
Location: Australia
einstein9 wrote:
I think it might be easier to fix the unit (if possible)

Tell your client to buy a replacement unit on eBay (approx US$100).

In any case the user manual talks about downloading your own media files to the unit via USB, but there appears to be no facility for uploading recorded data from the unit to a USB host. ISTM that the only way to copy the data would be via a capture card attached to the AV output, but then you may need to contend with Macrovision.

At the very least you should examine one data file to determine whether it is indeed scrambled. That shouldn't take very long. I've already shown you where to find it.

_________________
A backup a day keeps DR away.


Top
 Profile  
 
 Post subject: Re: DVR Header ID
PostPosted: September 21st, 2019, 3:05 
Offline
User avatar

Joined: May 13th, 2010, 11:17
Posts: 2726
Location: Kuwait
fzabkar wrote:
einstein9 wrote:
I think it might be easier to fix the unit (if possible)

Tell your client to buy a replacement unit on eBay (approx US$100).

In any case the user manual talks about downloading your own media files to the unit via USB, but there appears to be no facility for uploading recorded data from the unit to a USB host. ISTM that the only way to copy the data would be via a capture card attached to the AV output, but then you may need to contend with Macrovision.

At the very least you should examine one data file to determine whether it is indeed scrambled. That shouldn't take very long. I've already shown you where to find it.


If we keep telling them HOW to solve their problems then better we shutdown our Biz.

Thank you

_________________
Kuwait Data Recovery - UNIX GTC
The only reason for time is so that everything doesn't happen at once. By: Albert Einstein


Top
 Profile  
 
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 28 posts ]  Go to page 1, 2  Next

All times are UTC - 5 hours [ DST ]


Who is online

Users browsing this forum: Google [Bot] and 52 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group