Many DVR users believe that by deleting video through the DVR interface, they are rendering video unrecoverable. Fortunately for forensic investigators, this is not the case. In most instances, when video is deleted through the DVR interface, only the index (or accessibility) to that video is being deleted. Assuming the video itself has not been overwritten, DVR Examiner may be able to recover it.
DVR Examiner can recover deleted DVR video by using the “inaccessible recovery” feature in DVR Examiner. What does “inaccessible” mean? In short, it refers to video that the DVR no longer knows how to find. A less precise term for this would be “deleted”, but there are several ways a video can become inaccessible other than deliberate deletion by the user. The most common way would be that the DVR was operating normally and simply needed more space for newer video.
When you initially scan a HDD, one of the first screens that comes up is the Supported System Identified screen. This screen displays all the features that DVR Examiner supports for this particular filesystem. If inaccessible recovery is supported, the “Inaccessible” icon (on the far left) will be highlighted in orange.
DVR Examiner supports two inaccessible recovery types. The first type, simply called “Inaccessible”, refers to the ability of DVR Examiner to locate large segments of deleted video that the DVR no longer recognizes. For example, when a disk is reformatted or deleted, if no additional video is recorded, all the original video is largely intact but simply missing index entries. The second type, “Frame Level Inaccessible” refers to the ability of DVR Examiner to recover very small segments of video which may have been partially overwritten by newer video. This is a much more complex and complete recovery type – we’re often able to recover some video from weeks or months in the past that was never actually overwritten. Keep in mind that either recovery type will typically result in a slower scan process.
DME Forensics hope to be able to add inaccessible recovery to as many filesystems as possible. If you would like to request inaccessible recovery be added for a specific filesystem, you can do so by sending them an email at firstname.lastname@example.org. Please include the name of the filesystem in your email.
Due to limitations within specific filesystems, inaccessible recovery will not always be able to be implemented within DVR Examiner. However, this typically does not prevent their Advanced Technical Services (ATS) team from being able to recover the data manually. If you have a specific case where inaccessible recovery is crucial, please contact DME Forensics to discuss potential options.
If you are involved in the recovery of video from CCTV DVRs and you are not yet a user of DVR Examiner you can obtain a free trial here and discover how much easier it is with a tool specifically built for the task.
This post was originally posted on the DME Forensics blog.