Editor’s note: With the continuous development of data recovery and digital forensics technology, techniques for forensic data recovery from the logic layer of hard drives are constantly improving. Yet there remains a great challenge: how to recover fragmented video data? Through the following article, forensic experts from SalvationDATA will explain in this issue how to forensically sound recover fragmented (overwritten) video data from CCTV DVR system.
So what is fragmented video data?
Generally when a video clip is overwritten from the DVR system, sometimes some small fragmented data will still remain. We have a kind of special technology to recover and reassemble such video data, and we call it fragmented video data.
Now let’s take a 10 channels DVR system with 1TB capacity for example. If it records 10GB video data for each channel, and it will be 100GB every day. So obviously after 10 days, the DVR reaches maximum capacity. And starts from the 11th day, it overwrites old video files and this is when fragmented video data emerges.
What if you want to recover video data recorded 15 days ago, which is obviously overwritten already in this example. The video data may still be on the drive, but they have become small video fragments, that requires a professional DVR recovery tool to extract.
So why are we able to recover the overwritten video data, let’s see an example. Because video data is stored in the unit of blocks and the size of a data block is fixed. Just as the below picture shows, when a new video file overwrites an old video, the data of the old video is not necessarily completely overwritten. With our patented technology, we can recover what’s left of the overwritten video files.
The fragmented video data is not able to be directly accessed by operating systems, exists in the storage device as fragmented video files, with short time if played. It is recovered by analyzing the file allocation table, find the occupied data blocks, read and analyze if there is valid data in the unoccupied sectors of these data blocks. If so, extract those data according to the corresponding video data structure.
This patented technology was also awarded from USPTO, and of course, already integrated into VIP as the “Fragments Scan” function to help retrieve video evidence easily and rapidly. You can also watch the video demo on our YouTube channel. And you can download the software from our resources page of the website to have a free trial.
SalvationDATA Blog 