[Case Study] DVR Forensics: Recovering Inaccessible Surveillance Video Data from DVR or NVRs

Editor’s note: As one of the best DVR forensic solution provider, SalvationDATA will soon announce the release of a whole new version VIP (Video Investigation Portable). VIP is a forensically sound system for video extraction, recovery, and analysis from CCTV DVRs and NVRs. VIP helps to clarify the visual evidence and grant easy access to surveillance data stored in DVR/NVR devices.

Now before the release of our new version VIP, let’s have a review of VIP’s powerful features, and see how it can help to make your DVR forensic work easy and smooth.

What is DVR forensics?

DVR forensics is a sub-branch of digital forensics. It is special because most embedded DVR/NVR surveillance systems use a proprietary file system to store and manage the video data. As a result, investigators are not able to directly access the video files if they connect the DVR hard drive to a computer for analysis. And it is even harder to acquire inaccessible surveillance video data. Imagine what if important video clips are deleted by a suspect, or maybe the hard drive is accidentally formatted and all video clips become inaccessible.

In this blog post, we’ll see how VIP recovers inaccessible surveillance video data from DVR or NVRs.

Different Video Data Status

First of all, let’s have a quick look at the different video data status. Normally we divide the video data into 4 categories according to its status: normal, deleted, lost and overwritten.

1. Normal Video. Normal videos can be directly accessed by DVR OS. This kind of video data can be extracted according to the file system’s directory.
2. Deleted Video. After a video file is deleted, we cannot access it with the DVR OS. However, in most file systems the raw data of a deleted video is still remaining at the same location, and usually, its file record is just given a special mark to let the system know the file is deleted. This kind of video data is also easy to recover.
3. Lost Video. When a DVR hard drive is formatted or initialized, all its original video file records will be lost. And this kind of video data only exists in raw data status. We call this kind of data lost video data.
4. Fragmented Video. Fragmented video data is produced when overwrite happens. When a video file is overwritten, there will always be some fragmented video data left, ranging from a few seconds to minutes of video footage.

Recover inaccessible video data with VIP

Once the video data become deleted, lost or fragmented, it will be no longer accessible in traditional ways. Of course, if you are a professional data analyzer, you may be able to manually analyze the file system structure of the DVR system and extract video data. But this time is extremely time-consuming and requires technics that are not likely to be friendly to forensic investigators.

With VIP, you would be able to get easy access to both normal and inaccessible video data from CCTV DVR/NVR systems. Now let’s see how to extract inaccessible video data with the help of VIP.

Step 1.

Remove the hard drive from the DVR, and connect to a PC with a write-blocker.

Step 2.

Run VIP, and click ‘Disk Extraction’ in the home page.

Step 3.

Select the target hard drive from the device list, and choose from one of the three strategies to begin scanning the hard drive.

Quick Scan: the Only scan for file directories, finishes in a few seconds and theoretically can detect both normal and deleted video files.

Deep Scan: Scan the hard drive block by block. It takes more time than a quick scan but can detect lost video files and part of the fragmented video files.

Fragments Scan: Scan the hard drive sector by sector. It recovers the largest number of inaccessible video files but takes a long time to finish.

Step 4.

Wait for the scanning process to complete, and then navigate the scanning result to find the important video footage. You can also click ‘Filter’ to set time and channel filters to quickly locate the target video footage.

Step 5.

You can also click the play icon to preview the video before downloading it to local storage.

Step 6.

Now you can choose to export the spotted video clips of interest, and generate a forensic report at the end of the process.

Conclusion

DVR forensics can be a real headache and time-consuming job without the help of a professional forensic system like VIP. We are releasing a whole new version of VIP soon, bringing even more additional wonderful features to help with your DVR forensic works.

Keep following our updates on our website and blog to learn more news, you can also go to our resource page and enjoy your trial for free!