Main » Forums home » Conventional hard drives

All times are UTC - 5 hours [ DST ]



Post new topic Reply to topic  Page 2 of 2
  [ 28 posts ]  Go to page Previous  1, 2
  Previous topic | Next topic 
Author Message
fzabkar
 Post subject: Re: DVR Header ID
PostPosted: September 21st, 2019, 16:16 
Offline
User avatar

Joined: September 8th, 2009, 18:21
Posts: 15538
Location: Australia
einstein9 wrote:
fzabkar wrote:
einstein9 wrote:
I think it might be easier to fix the unit (if possible)

Tell your client to buy a replacement unit on eBay (approx US$100).


If we keep telling them HOW to solve their problems then better we shutdown our Biz.

If you can't find a point-and-click solution, then what can you possibly do other than the obvious? And then what happens if the file system is corrupt, as it would appear (see below)? AISI, the job of deobfuscating the file system is relatively simple, but you don't appear to be able to do it, otherwise you would have already extracted a test file.

This is sector 0x33:

Code:
00006600  20 20 20 2E 20 20 20 20 10 20 20 20 00 00 A1 00     .    .   ..¡.
00006610  01 28 01 28 00 00 00 00 03 00 01 28 00 00 00 00  .(.(.......(....
00006620  20 20 2E 2E 20 20 20 20 10 20 20 20 00 00 A1 00    ..    .   ..¡.
00006630  01 28 01 28 00 00 00 00 00 00 01 28 00 00 00 00  .(.(.......(....
00006640  00 61 00 42 FF 00 00 74 0F FF FF FF FF FF 77 00  .a.Bÿ..t.ÿÿÿÿÿw.
00006650  FF FF FF FF FF FF FF FF 00 00 FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿ..ÿÿÿÿÿÿ
00006660  00 69 00 01 00 65 00 72 0F 61 00 6D 69 00 77 00  .i...e.r.a.mi.w.
00006670  62 00 6C 00 78 00 6F 00 00 00 39 00 64 00 2E 00  b.l.x.o...9.d...
00006680  6D 65 72 69 31 31 7E 61 20 74 61 64 00 00 00 00  meri11~a tad....
00006690  20 D9 00 00 00 00 00 00 15 00 70 57 28 01 00 00   Ù........pW(...
000066A0  00 61 00 42 FF 00 00 74 0F FF FF FF FF FF 43 00  .a.Bÿ..t.ÿÿÿÿÿC.
000066B0  FF FF FF FF FF FF FF FF 00 00 FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿ..ÿÿÿÿÿÿ
000066C0  00 69 00 01 00 65 00 72 0F 61 00 6D 69 00 43 00  .i...e.r.a.mi.C.
000066D0  69 00 6C 00 66 00 6E 00 00 00 6F 00 64 00 2E 00  i.l.f.n...o.d...
000066E0  6D 65 72 69 31 7E 69 61 20 74 61 64 00 00 00 00  meri1~ia tad....
000066F0  C0 DB 00 00 00 00 00 00 0B 00 20 E0 0C 00 00 00  ÀÛ........ à....
00006700  00 61 00 42 FF 00 00 74 0F FF FF FF FF FF AC 00  .a.Bÿ..t.ÿÿÿÿÿ¬.
00006710  FF FF FF FF FF FF FF FF 00 00 FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿ..ÿÿÿÿÿÿ
00006720  00 69 00 01 00 65 00 72 0F 74 00 73 6F 00 AC 00  .i...e.r.t.so.¬.
00006730  65 00 72 00 66 00 63 00 00 00 67 00 64 00 2E 00  e.r.f.c...g.d...
00006740  73 65 72 69 31 7E 6F 74 20 74 61 64 00 00 00 00  seri1~ot tad....
00006750  C0 DB 00 00 00 00 00 00 16 00 70 57 E0 06 00 00  ÀÛ........pWà...
00006760  00 61 00 41 00 74 00 6E 0F 6E 00 49 66 00 74 00  .a.A.t.n.n.If.t.
00006770  2E 00 6F 00 61 00 64 00 00 00 74 00 FF FF 00 00  ..o.a.d...t.ÿÿ..
00006780  49 74 6E 61 31 7E 66 6E 20 74 61 64 00 00 00 00  Itna1~fn tad....
00006790  20 D9 00 00 00 00 00 00 07 00 20 D9 02 04 00 00   Ù........ Ù....
000067A0  00 49 00 41 00 43 00 2D 0F 52 00 4F 44 00 60 00  .I.A.C.-.R.OD.`.
000067B0  49 00 2E 00 49 00 4E 00 00 00 00 00 FF FF FF FF  I...I.N.....ÿÿÿÿ
000067C0  4F 43 2D 49 20 31 7E 52 20 49 4E 49 00 00 00 00  OC-I 1~R INI....
000067D0  20 E0 00 00 00 00 00 00 08 00 20 E0 5C 5D 07 00   à........ à\]..
000067E0  00 70 00 42 00 64 00 2E 0F 74 00 61 00 00 FA 00  .p.B.d...t.a..ú.
000067F0  FF FF FF FF FF FF FF FF 00 00 FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿ..ÿÿÿÿÿÿ


This is the same sector when reversed:

Code:
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

00006600  2E 20 20 20 20 20 20 20 20 20 20 10 00 A1 00 00  .          ..¡..
00006610  28 01 28 01 00 00 00 00 28 01 00 03 00 00 00 00  (.(.....(.......
00006620  2E 2E 20 20 20 20 20 20 20 20 20 10 00 A1 00 00  ..         ..¡..
00006630  28 01 28 01 00 00 00 00 28 01 00 00 00 00 00 00  (.(.....(.......
00006640  42 00 61 00 74 00 00 FF FF FF FF 0F 00 77 FF FF  B.a.t..ÿÿÿÿ..wÿÿ
00006650  FF FF FF FF FF FF FF FF FF FF 00 00 FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿ..ÿÿÿÿ
00006660  01 00 69 00 72 00 65 00 6D 00 61 0F 00 77 00 69  ..i.r.e.m.a..w.i
00006670  00 6C 00 62 00 6F 00 78 00 39 00 00 00 2E 00 64  .l.b.o.x.9.....d
00006680  69 72 65 6D 61 7E 31 31 64 61 74 20 00 00 00 00  irema~11dat ....
00006690  00 00 D9 20 00 00 00 00 57 70 00 15 00 00 01 28  ..Ù ....Wp.....(
000066A0  42 00 61 00 74 00 00 FF FF FF FF 0F 00 43 FF FF  B.a.t..ÿÿÿÿ..Cÿÿ
000066B0  FF FF FF FF FF FF FF FF FF FF 00 00 FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿ..ÿÿÿÿ
000066C0  01 00 69 00 72 00 65 00 6D 00 61 0F 00 43 00 69  ..i.r.e.m.a..C.i
000066D0  00 6C 00 69 00 6E 00 66 00 6F 00 00 00 2E 00 64  .l.i.n.f.o.....d
000066E0  69 72 65 6D 61 69 7E 31 64 61 74 20 00 00 00 00  iremai~1dat ....
000066F0  00 00 DB C0 00 00 00 00 E0 20 00 0B 00 00 00 0C  ..ÛÀ....à ......
00006700  42 00 61 00 74 00 00 FF FF FF FF 0F 00 AC FF FF  B.a.t..ÿÿÿÿ..¬ÿÿ
00006710  FF FF FF FF FF FF FF FF FF FF 00 00 FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿ..ÿÿÿÿ
00006720  01 00 69 00 72 00 65 00 73 00 74 0F 00 AC 00 6F  ..i.r.e.s.t..¬.o
00006730  00 72 00 65 00 63 00 66 00 67 00 00 00 2E 00 64  .r.e.c.f.g.....d
00006740  69 72 65 73 74 6F 7E 31 64 61 74 20 00 00 00 00  iresto~1dat ....
00006750  00 00 DB C0 00 00 00 00 57 70 00 16 00 00 06 E0  ..ÛÀ....Wp.....à
00006760  41 00 61 00 6E 00 74 00 49 00 6E 0F 00 74 00 66  A.a.n.t.I.n..t.f
00006770  00 6F 00 2E 00 64 00 61 00 74 00 00 00 00 FF FF  .o...d.a.t....ÿÿ
00006780  61 6E 74 49 6E 66 7E 31 64 61 74 20 00 00 00 00  antInf~1dat ....
00006790  00 00 D9 20 00 00 00 00 D9 20 00 07 00 00 04 02  ..Ù ....Ù ......
000067A0  41 00 49 00 2D 00 43 00 4F 00 52 0F 00 60 00 44  A.I.-.C.O.R..`.D
000067B0  00 2E 00 49 00 4E 00 49 00 00 00 00 FF FF FF FF  ...I.N.I....ÿÿÿÿ
000067C0  49 2D 43 4F 52 7E 31 20 49 4E 49 20 00 00 00 00  I-COR~1 INI ....
000067D0  00 00 E0 20 00 00 00 00 E0 20 00 08 00 07 5D 5C  ..à ....à ....]\
000067E0  42 00 70 00 2E 00 64 00 61 00 74 0F 00 FA 00 00  B.p...d.a.t..ú..
000067F0  FF FF FF FF FF FF FF FF FF FF 00 00 FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿ..ÿÿÿÿ

The data look like a FAT directory, but the endianness requires further deobfuscation.

The filenames would suggest that this misplaced sector is part of an OS volume.

    iremailbox9.dat
    iremailinfo.dat
    irestorecfg.dat
    antInfo.dat
    I-CORD.INI

_________________
A backup a day keeps DR away.
Top
 Profile  
 
einstein9
 Post subject: Re: DVR Header ID
PostPosted: September 22nd, 2019, 3:43 
Offline
User avatar

Joined: May 13th, 2010, 11:17
Posts: 2798
Location: Kuwait
@fzabkar

If you can't find a point-and-click solution, then what can you possibly do other than the obvious? And then what happens if the file system is corrupt, as it would appear (see below)? AISI, the job of deobfuscating the file system is relatively simple, but you don't appear to be able to do it, otherwise you would have already extracted a test file.

I usually don`t pay attention or respond to arguments like that (you should know this by now)
Next time when i post about anything TRY to look the other side

_________________
Kuwait Data Recovery - UNIX GTC
The only reason for time is so that everything doesn't happen at once. By: Albert Einstein
Top
 Profile  
 
einstein9
 Post subject: Re: DVR Header ID
PostPosted: September 22nd, 2019, 7:24 
Offline
User avatar

Joined: May 13th, 2010, 11:17
Posts: 2798
Location: Kuwait
Hard Working vs Smart: https://www.youtube.com/watch?v=-7WCuNSNZCU try to learn from those
It seems you are not the only one who fixes things

case closed..


Attachments:
IMG_0305A.jpg
IMG_0305A.jpg [ 42.98 KiB | Viewed 6164 times ]
IMG_0306B.jpg
IMG_0306B.jpg [ 72.93 KiB | Viewed 6164 times ]
IMG_0309C.jpg
IMG_0309C.jpg [ 42.2 KiB | Viewed 6164 times ]

_________________
Kuwait Data Recovery - UNIX GTC
The only reason for time is so that everything doesn't happen at once. By: Albert Einstein
Top
 Profile  
 
HaQue
 Post subject: Re: DVR Header ID
PostPosted: September 22nd, 2019, 7:37 
Offline
User avatar

Joined: December 4th, 2012, 1:35
Posts: 3844
Location: Adelaide, Australia
Glad you fixed it and got a good result. Got to say I did learn something from Francs posts..
Top
 Profile  
 
einstein9
 Post subject: Re: DVR Header ID
PostPosted: September 22nd, 2019, 7:43 
Offline
User avatar

Joined: May 13th, 2010, 11:17
Posts: 2798
Location: Kuwait
HaQue wrote:
Glad you fixed it and got a good result. Got to say I did learn something from Francs posts..


me too, but as usual, he always knows beter

_________________
Kuwait Data Recovery - UNIX GTC
The only reason for time is so that everything doesn't happen at once. By: Albert Einstein
Top
 Profile  
 
fzabkar
 Post subject: Re: DVR Header ID
PostPosted: September 22nd, 2019, 16:20 
Offline
User avatar

Joined: September 8th, 2009, 18:21
Posts: 15538
Location: Australia
My first thought was to congratulate you, but all I see is some irrelevant cycling video and the installation of a Humax PVR mass storage driver. I see no evidence that you actually recovered anything. My reading of the manual would suggest that there is no way to retrieve the PVR's content via this route. Is the manual wrong, or did I miss something?

As I saw it, there were two possibilities, both of which had obvious solutions:

1/ If the owner's Humax DVR was electronically faulty, then you would transfer the patient HDD into a donor PVR. That's something the owner could do. No need for a data recovery.

2/ If the OS volume was indeed corrupt, then you would clone the OS volume from a donor PVR, or you could try to reinitialise the OS volume via a firmware update, assuming the box had sufficient sanity to allow this.

In any case I would have extracted at least one file from both volumes, if only to learn more about this DVR, and to prepare for similar jobs in the future.

_________________
A backup a day keeps DR away.
Top
 Profile  
 
fzabkar
 Post subject: Re: DVR Header ID
PostPosted: September 23rd, 2019, 15:08 
Offline
User avatar

Joined: September 8th, 2009, 18:21
Posts: 15538
Location: Australia
I found this interesting thread where a user from the UAE, who bought the same PVR, was unable to transfer any video content from the PVR to his PC. However, other content such as MP3s and images could be transferred in either direction. He stated that his local Humax distributor told him that this was an anti-piracy restriction.

https://forums.digitalspy.com/discussion/563489/humax-icord-irci-pvr-problems

Thankam wrote:
Last week I purchased Humax iCORD IRCI PVR Model from Local distributor - in UAE.

Its having 160 GB inbuilt hard disc and we can use one card slot and Cam slot also. It can record upto 04 channels together.

Now my problem is - I want to shift my video files to PC - its not supporting anything. we can do MP#03 and Images file transfer not video.

Thankam wrote:
Hi Son, I was fighting 02 days with this unit. It can copy only MP3 & Images both ways ( PC to Receiver HD or Visa Versa ) - It can't take any Video files from Receiver HD - Its totally invisible. Today again I called the Manufacture Humax - Middle east. As per their technical staff - its not possible to copy Video files from Receiver HD to PC. Its totally protected .

So its failure as user/customer side & for me its waste of purchase and no alternate solution so far. I will return back and get what I need.

Thankam wrote:
Catbed wrote:
Sounds like Middle East units have the HD to PC video transfer disabled as an anti-piracy 'feature'.

No brother - Only this model have this problems. Also as per market this is the latest model!! :mad:

_________________
A backup a day keeps DR away.
Top
 Profile  
 
fzabkar
 Post subject: Re: DVR Header ID
PostPosted: September 23rd, 2019, 18:12 
Offline
User avatar

Joined: September 8th, 2009, 18:21
Posts: 15538
Location: Australia
Let's assume that the protected video files have an MTS extension. I wonder what would happen if one were to locate all the FAT directory sectors and change each instance of "MTS" to "BMP", say. Would this trick the Humax PVR into serving up these "BMP" files via USB?

_________________
A backup a day keeps DR away.
Top
 Profile  
 
Display posts from previous:  Sort by  
Post new topic Reply to topic  Page 2 of 2
  [ 28 posts ]  Go to page Previous  1, 2

Main » Forums home » Conventional hard drives

All times are UTC - 5 hours [ DST ]

Who is online

Users browsing this forum: No registered users and 164 guests

You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
Switch to mobile style
Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group