Recovering Deleted DVR Video with DVR Examiner

DVR Examiner - recover deleted video from a CCTV DVRMany DVR users believe that by deleting video through the DVR interface, they are rendering video unrecoverable. Fortunately for forensic investigators, this is not the case. In most instances, when video is deleted through the DVR interface, only the index (or accessibility) to that video is being deleted. Assuming the video itself has not been overwritten, DVR Examiner may be able to recover it.

DVR Examiner can recover deleted DVR video by using the “inaccessible recovery” feature in DVR Examiner. What does “inaccessible” mean? In short, it refers to video that the DVR no longer knows how to find. A less precise term for this would be “deleted”, but there are several ways a video can become inaccessible other than deliberate deletion by the user. The most common way would be that the DVR was operating normally and simply needed more space for newer video.

When you initially scan a HDD, one of the first screens that comes up is the Supported System Identified screen. This screen displays all the features that DVR Examiner supports for this particular filesystem. If inaccessible recovery is supported, the “Inaccessible” icon (on the far left) will be highlighted in orange.

DVR Examiner - Inaccessible video recovery

DVR Examiner supports two inaccessible recovery types. The first type, simply called “Inaccessible”, refers to the ability of DVR Examiner to locate large segments of deleted video that the DVR no longer recognizes. For example, when a disk is reformatted or deleted, if no additional video is recorded, all the original video is largely intact but simply missing index entries. The second type, “Frame Level Inaccessible” refers to the ability of DVR Examiner to recover very small segments of video which may have been partially overwritten by newer video. This is a much more complex and complete recovery type – we’re often able to recover some video from weeks or months in the past that was never actually overwritten. Keep in mind that either recovery type will typically result in a slower scan process.

DME Forensics hope to be able to add inaccessible recovery to as many filesystems as possible. If you would like to request inaccessible recovery be added for a specific filesystem, you can do so by sending them an email at support@dmeforensics.com. Please include the name of the filesystem in your email.

Due to limitations within specific filesystems, inaccessible recovery will not always be able to be implemented within DVR Examiner. However, this typically does not prevent their Advanced Technical Services (ATS) team from being able to recover the data manually. If you have a specific case where inaccessible recovery is crucial, please contact DME Forensics to discuss potential options.

If you are involved in the recovery of video from CCTV DVRs and you are not yet a user of DVR Examiner you can obtain a free trial here and discover how much easier it is with a tool specifically built for the task.

Free 30 Day Trial

 

This post was originally posted on the DME Forensics blog.

 

DVR Examiner Version 2.2.0 released

DVR Examiner V2.2 CCTV DVR hard disk recoveryDVR Examiner Version 2.2.0

Released 2017-01-24

It’s the feature you have been hearing about for months, DVR Examiner 2.2 has arrived, bringing continuous filesystem updates straight to your computer.

We are very excited to release this version of DVR Examiner to our users, as it enables us to continue bringing you more DVR filesystems, faster than ever. But that’s not the only change we’ve made to this version. We are introducing a new DVR Examiner logo and a new “Updater” application to help you manage your filesystem library. Read on to learn more about how we are working to make DVR data recovery easier and faster with the new features and performance improvements in DVR Examiner 2.2.

Some of the additions and improvements we are introducing with this update include:

  • Filesystem Database Updates (FDUs)- These packages will allow users to continuously update DVR Examiner as we add support for additional DVRs and resolve issues with existing filesystems.
  • DVR Examiner Updater- This small utility is included with the DVR Examiner 2.2 download, and allows the user to manage their FDU library.
  • Redesigned save/load functionality- Saved cases from versions prior to DVR Examiner 2.2 are not compatible with this update. Going forward, we will attempt to maintain compatibility as much as possible and users will be notified if there are changes that may impact compatibility.
  • Continued improvements and bug fixes to increase performance and stability.

We also resolved issues with the profiler and added debugging tools to provide more technical support to our users.

Filesystem Updates

DVR Examiner 2.2 supports three new filesystems:

  • REC_264_E found in Night Owl and other common DVRs
  • PROD2_264 found in Q-See and other common DVRs
  • IXDVRDISK_NP found in Ganz, GVI, Digimerge and other common DVRs

Going forward, new filesystem updates and improvements will come in the form of updated Filesystem Database Updates. We are hoping to have our first FDU available in the next 2-3 weeks!

Keep in mind, in order to use DVR Examiner 2.2, you must have an active subscription! Expired users will still be able to load saved cases as long as they were saved in 2.2 while their subscription was active.

If you have a current subscription you can download this version from the support portal here

If you are involved in the recovery of video from CCTV DVRs and you are not yet a user of DVR Examiner you can obtain a free trial here and discover how much easier it is with a tool specifically built for the task.

Free 30 Day Trial

 

This post was originally posted on the DME Forensics blog.

DVR Examiner Version 2.1.1 released

DVR Examiner Version 2.1.1
Released 2017-12-22
– Added support for the Prod2_264 filesystem
– Resolved scan issues with the ICATCH_264 FilesystemDVR

If you have a current subscription please download this version from the support portal here

If you are involved in the recovery of video from CCTV DVRs and you are not yet a user of DVR Examiner you can obtain a free trial here and discover how much easier it is with a tool specifically built for the task.

Free 30 Day Trial

 

Salient Sciences Video FOCUS release V7.x

VideoFOCUS version 7

With this latest release, Salient Sciences are introducing new features and updates to assist examiners to work efficiently with their AUDIO and VIDEO evidence.

If you have a current support contract please download the latest version from here

If you would like to know more and request a trial version of the software please visit this page.

 Reporting

VideoFOCUS 7.0 can now generate pdf report documents describing video and image items in a project.

A report can be created by selecting the desired media items and choosing the ‘view report’ item in the view menu. Alternatively individual image or video items can be reported on by using the ‘view report’ menu action from the session or still list popup menus. A report can also be created by selecting the option in the export media dialog. In this situation a report will be created that includes sections for each media item that is being exported.

VideoFOCUS will automatically generate a full ‘steps to reproduce’ section for each item in the report and will provide a basic summary of the properties of each item that is being reported. In addition to the automatically generated sections the user can also add item specific notes to each media item using the session or still property dialog and these notes will be included in the report. The VideoFOCUS cases now offer properties than can be set, including agency and examiner names, case number and title and an overall notes section and these properties will also be used in the composition of the report.

Macros (VFPro only)

VideoFOCUS now supports the concept of macros. Macros are a way to apply a set of actions taken on one piece of media to other similar media, without having to repeat the actions in the user interface. Typically this might be used to apply similar processing to related videos that are determined to require the same sequence of modifications,filtering etc in every case.

There is no specific process to define the steps in a macro. All that is required is to select an item that is the product of processing and use the right click menu ‘copy macro starting at’. When this is menu option is selected VideoFOCUS will offer the various points in the processing history of the item as starting point for the macro action. The macro processing include all steps between that point and an the final step producing the selected media item

Once copied the macro can be applied to other items by simply selecting them and using the ‘apply macro’ popup action. When applied the macro application will produce a new item that are the macro steps applied to that item. It is also possible to apply a macro to a set of selected items as a single action. In his case a result will be created for each selected item.

Macro actions are full described in the report in terms of the original actions that compose the steps of the macro and then application of the macro. Macros of macros are also supported.

Under certain circumstances the application of a macro can lead to invalid output. Most commonly this will be when references are made to times or views that do not exist in the target media. VideoFOCUS is designed to detect such situations and will advise the user that the macro cannot be applied.

Unified Export

VideoFOCUS now has a single export dialog that supports the simultaneous export of images, video and audio. The items that are export depends on which export menu is used and what is selected. When the export is invoked from the session list popup the export is restricted to selected items in that list. Similarly when the export is invoked from the stills area popup the export is limited to selected items in that list.

If however the export is invoked from the main file menu the export will included all selected items in both the session and stills areas. When combined with the report option, this allows for a production of a single report including all items that a user may wish to export from VideoFOCUS. When there is a mixed set of media types in the export dialog the video, images and audio tabs provide for control over any configurable aspects of each specific type.

Other Changes

Item Labeling and Tooltips

VideoFOCUS has been updated to provide a more consistent methodology for the labeling of media items created by filters, modification, edits etc. There is now also a tooltip associated with each media item offering a short description of the process step that was used to create the item. The tooltip includes the label name of the item’s source to aid in locating the source item

Project Time Zone

Projects can now use timezone that is distinct from the system or default VideoFOCUS time zone. The time zone choice is available via the File menu item ‘project properties’. The timezone choice controls the presentation of times in both the interface and in and reports associated with items in the project.

UPDATE THE SOFTWARE

If you have a current support contract please download the latest version from here

If you would like to know more and request a trial version of the software please visit this page.

DVR Examiner Version 2.1.0 released

Latest release from DME Forensics, imaging is back!

The Forensic imaging capability has been improved and restored, grab your Write Blocker and get imaging.

DVR Examiner forensic image hard drive

 

Other highlights include;

– Added support for inaccessible recovery from the HIK_264 filesystem.
– Implemented clip “Tags” (small notes for each clip).
– Implemented a per-channel motion sensitivity configuration.
– Added an “Audit Log” report to see what has been done with a given clip or clips.
– Added the ability to double click on saved case to load it within DVR Examiner.

Along with some Bug fixes and performance updates.

You can read the full release notes here

You can read DME Forensics blog post about the release here

 

 

 

 

If you have a current subscription please download this version from the support portal here

If you are involved in the recovery of video from CCTV DVRs and you are not yet a user of DVR Examiner you can obtain a free trial here and discover how much easier it is with a tool specifically built for the task.

Free 30 Day Trial

 

Upcoming DVR Examiner Updates: More DVRs, Faster!

DVR Examiner - extract video from CCTV DVR hard driveThis post authored by Tyler Schlecht originally appeared here

One of the most common requests we receive from our users is to provide ‘More DVRs, Faster!’ With the release of DVR Examiner 2.0, we made substantial updates to our framework to make it easier to add new/updated DVR filesystems. Now, we are excited to announce even more progress towards the ‘More DVRs, Faster’ goal. In January 2018, we will be releasing an updated framework that will enable us to more quickly add new/updated filesystems. In addition, we will be implementing some updates to the software that may impact your licensing.

Continuous Filesystem Updates

With DVR Examiner 2.2, we will be enabling continuous filesystem updates to allow us to give our users access to more DVR’s, faster! This functionality will allow us to push incremental filesystem updates to you as soon as our team finishes developing and testing a new or updated DVR filesystem. This will give you access to new DVR filesystem improvements without having to wait for the next update to the core application.  [Read more…]

VideoFOCUS Screen Capture

Working with digital CCTV files in a proprietary format isn’t easy and sometimes you need to use screen capture, what Salient Sciences call the “Import method of last resort”, to get the video into VideoFOCUS so that you can then start to process the material.

In this video Don Tunstall, the General Manager at Salient Sciences, talks us through the process and provides some useful tips on good practice.

Screen Capturing into VideoFOCUS from Salient Sciences on Vimeo.

If you would like to know more about how VideoFOCUS software can help you to process both Audio and Video material please contact us using the form here make sure to select the software that you are interested in from the drop down list.

Moving Forward with DVR Examiner 2.0

There is a new post on the DME Forensics blog written by the companies President Jimmy Schroering in which he gives an insight into the development of DVR Examiner Version 2 and what we can look forward to.

He also mentions the important feedback provided by existing users and how that helps DME Forensics develop the software.

You can read the post here

Moving Forward with DVR Examiner 2.0

If you have a current subscription please download the latest version from the support portal here

If you are involved in the recovery of video from CCTV DVRs and you are not yet a user of DVR Examiner you can obtain a free trial here and discover how much easier it is with a tool specifically built for the task.

Free 30 Day Trial

DVR Examiner – Features – Clip Attributes

What units does the Duration Slider use?

I was recently asked by a user of the software what units the Duration Slider in the Clip Attributes panel uses. So to answer their question I thought I would write this blog post. (If you can’t wait for the answer it is…………… minutes, but see below for more info.)

With the introduction of V2.x the developers at DME Forensics have introduced many new features and expanded the capabilities of some of the existing ones too so this post answers the above question but also introduces users to some of the other features of the Clip Filters panel. You can also pre filter the clip results prior to initiating the scan function see the paragraph at the end of this post.

DVR Examiner Clip Attributes Panel

The following (mostly taken from the help file)  applies to V2.0.4.0;

Clip Filters

Once you have scanned the hard drive and been presented with the results in the clip list you can filter the results for faster review.

At the moment the panel is split into three headings, more detail regarding the first two headings is available in the software’s help file;

Date/Time Configuration

Will allow you to adjust for any difference between the actual time and the time set on the DVR.

Date/Time Filtering

You can set the date/time of interest, defaults to first and last found on the DVR hard drive.

Clip Attributes

Size Slider – Filter clips based on size in MB. The left slider can be used to designate a minimum size and the right slider can be used to designate a maximum size.
Duration Slider – Like the Size Slider, the Duration Slider can be used to designate the minimum and maximum clip durations displayed in the clip grid. The original question prompting this blog was “What units does the slider use?”
The answer is minutes BUT be aware that at the moment the indicator  reports only full minutes so as you move the sliders only the minute is reported but the position of the slider actually relates to the fraction of that second.
Using the example depicted in the image above, if you positioned the minimum slider as far to the right so that the indicator displays 2 but just before it changes to 3 and select “Apply” none of the clips would be shown.

So why might you want the ability to filter on size or duration?

In general, I suspect both of these would be used primarily in situations where the DVR is recording motion. In those situations, DVR Examiner will recover a lot of clips of smaller size and/or duration. So, if you are reviewing video looking for an event that would likely take some time to commit, you could start by filtering out all of the really short/small clips and focus on the larger ones. On the reverse side, the DVR may be mostly recording continuously, so you are left with thousands of 200MB clips of 1 hour each. You could set a max size or duration filter less than those to find any motion events that were recording.
The size filter could also apply for some of the DVRs that record a high quality stream and a lower quality stream. The duration and time stamp will likely be the same, but one clip would be smaller than the other. That being said those DVRs typically tag the secondary stream as a different channel which could be filtered as well.

For completeness here are the other options under the Clip Attributes heading (more details in the help file);

Status – The Status dropdown will display all options available for the filesystem scanned.

Channel – The Channel dropdown will display all channels recovered from the DVR, not all channels available on the DVR.

Has Tags (not shown in the image) – Find clips with or without tags.

Has Notes – Find clips with or without notes.

Pre Filter ResultsDVR Examiner - clip filter

There is also an option to filter the clips prior to scanning, this is useful to reduce the amount of clips displayed, if you need to change the filter parameters you can still do that once the clip list has loaded. I think the feature to only list clips within x hours of last recorded Date/Time would be something I would use a lot.
If you have any questions or ideas for new features please let me know by clicking here to send me an email.

If you have a current DVR Examiner subscription please download the latest version from the support portal here

If you are involved in the recovery of video from CCTV DVRs and you are not yet a user of DVR Examiner you can obtain a free trial here and discover how much easier it is with a tool specifically built for the task.

Free 30 Day Trial

DVR Examiner V2.0.4 released

DVR Examiner Version 2.0.4 released
DME Forensics have released an update which introduces support for some new filesystems and improvements to existing ones. If you like to keep tabs on these updates you may have also noticed that there was a V2.0.3 release. You can read the release notes for both new versions on the page here.

If you have a current subscription please download this version from the support portal here

If you are involved in the recovery of video from CCTV DVRs and you are not yet a user of DVR Examiner you can obtain a free trial here and discover how much easier it is with a tool specifically built for the task.

Free 30 Day Trial