Editor’s note: With the continuous development of data recovery and digital forensics technology, techniques for forensic data recovery from the logic layer of hard drives are constantly improving. Yet there remains a great challenge: Are the overwritten video clips can be recovered? Through the following case study, forensic experts from SalvationDATA will explain in this issue how to forensically sound recover fragmented (overwritten) video data from CCTV DVR system.
So what is fragmented video data?
Generally when a video clip is overwritten from the DVR system, sometimes some small fragmented data will still remain. We have a kind of special technology to recover and reassemble such as video data, and we call it fragmented video data.
Now let’s take a 10 channels DVR system with 1TB capacity for example. If it records 10GB video data for each channel, and it will be 100GB every day. So obviously after 10 days, the DVR reaches maximum capacity. And starts from the 11th day, it overwrites old video files and this is when fragmented video data emerges.
What if you want to recover video data recorded 15 days ago, which is obviously overwritten already in this example. The video data may still be on the drive, but they have become small video fragments, that requires a professional DVR recovery tool to extract.
So why are we able to recover the overwritten video data, let’s see an example. Because video data is stored in the unit of blocks and the size of a data block is fixed. Just as the below picture shows, when a new video file overwrites an old video, the data of the old video is not necessarily completely overwritten. With our patented technology, we can recover what’s left of the overwritten video clips.
The fragmented video data is not able to be directly accessed by operating systems, exists in the storage device as fragmented video files, with short time if played. It is recovered by analyzing the file allocation table, find the occupied data blocks, read and analyze if there is valid data in the unoccupied sectors of these data blocks. If so, extract those data according to the corresponding video data structure.
Using VIP 2.0, you would be able to get easy access to both normal and inaccessible video data from CCTV DVR/NVR systems. Now let’s see how to extract overwritten video clips with the help of VIP 2.0.
Step 1.
Remove the hard drive from the DVR, and connect to a PC with a write-blocker.
Step 2.
Run VIP 2.0, and click ‘Disk Extraction’ on the home page.
Step 3.
Select the target hard drive from the device list, and choose from one of the three strategies to begin scanning the hard drive.
Quick Scan: the only scan for file directories, finishes in a few seconds and theoretically can detect both normal and deleted video files.
Expert Mode:
Deep Scan: Scan the hard drive block by block. It takes more time than a quick scan but can detect lost video files and part of the fragmented video files.
Fragments Scan: Scan the hard drive sector by sector. It recovers the largest number of inaccessible video files including overwritten video clips but takes a long time to finish.
Step 4.
Wait for the scanning process to complete, and then navigate the scanning result to find the important video footage. You can also click ‘Filter’ to set time and channel filters to quickly locate the target video footage.
Step 5.
You can also click the play icon to preview the video before downloading it to local storage.
Step 6.
Now you can choose to export the spotted video clips of interest, and generate a forensic report at the end of the process.
Conclusion
DVR forensics can be a real headache and time-consuming job without the help of a professional forensic system like VIP 2.0, a whole new version of VIP 2.0, bringing even more additional wonderful features to save you from the expensive and time-consuming process and give you a smarter video Investigation with lower cost.
This patented technology was also awarded from USPTO, and integrated into VIP 2.0 as the “Fragments Scan” function to help retrieve video evidence quickly, easily and securely. You can also watch the video demo on our YouTube channel. And you can download the software from our resources page of the website to have a free trial.
SalvationDATA Blog 