Footage recovery from dvr hdd

[adelage]

Hi,
I need to recover some footage from an Atlantis a15-tx400 dvr, and I (wrongly) thought that the quickest way would be to remove the hdd from the dvr and plug it to my PC, rather then using the tedious usb method with the dvr UI. Unfortunately, even though I was able to access the file system through Diskinternal Linux Reader, the files inside are not readable, they are just a ton of 1GB files which don't have any extensions. I have even tried with a forensics software called DVR EXAMINER by Magnet but it can't decode the hdd, saying that it can't read RAYSHARP file system, or something like that.
The problem is that once I plugged the hdd back to the dvr the date was reset to 1/1/1970, and even after setting it back to the current date it still doesn't show any recorded footage.
I am sure the footage is still there since form the beginning I have unplugged all the cameras and I made sure nothing was written nor the hdd was formatted, but I can't find any way to extract the footage from it. Any suggestion would be really appreciated.

 

[alastairstevenson]

I was able to access the file system through Diskinternal Linux Reader, the files inside are not readable, they are just a ton of 1GB files which don't have any extensions.

What does binwalk suggest the files consist of?

 

[adelage]

What does binwalk suggest the files consist of?

sorry, what is binwalk?
anyway, here's a screen of Linux Reader

 

[alastairstevenson]

sorry, what is binwalk?

Sorry, I'd assumed you were using Linux. I was wrong.

binwalk is a standard Linux utility that will examine the contents of a file and attempt to identify what is held inside it.
Although some indications can be false matches, it generally gives some pretty good clues that provide a basis for further analysis.

 

[adelage]

Sorry, I'd assumed you were using Linux. I was wrong.

binwalk is a standard Linux utility that will examine the contents of a file and attempt to identify what is held inside it.
Although some indications can be false matches, it generally gives some pretty good clues that provide a basis for further analysis.

No, I rarely use Linux and I am not very good at it unfortunately, now I am trying to use HX-recovery but I cannot find which which is the right DVR to select before the scan, Atlantis is not in the list, and Raysharp fails to work. I guess I have to try one by one until something works..

 

[adelage]

Ok so I tried literally every single dvr option within hx recovery but nothing works, nor I could get something with ease us recovery software…does anyone know any other good software for the recovery of files from dvrs?

 

[looney2ns]

Put it back into the original DVR to get the videos.
Look at all the time you have wasted that could of been used to be getting videos off the NVR.

 

[adelage]

Put it back into the original DVR to get the videos.
Look at all the time you have wasted that could of been used to be getting videos off the NVR.

The dvr doesn’t show any footage, the timing was reset to 1970 and I even after setting it back to the current date with online synchronisation the footage doesn’t show up, I believe before it was set manually and unless I manage to match the exact timing the dvr won’t recognise the footage

 

[wittaj]

Are you 100% positive the NVR was actually recording for the time in question?

Like did you actually watch video from a couple days prior or was the last time any video was looked at was months or years prior?

We see this type of question from time to time and usually the answer once they are able to access the video is the HDD quit recording long ago and the footage is nowhere near recent.

 

[mat200]

Hi,
I need to recover some footage from an Atlantis a15-tx400 dvr, and I (wrongly) thought that the quickest way would be to remove the hdd from the dvr and plug it to my PC, rather then using the tedious usb method with the dvr UI. Unfortunately, even though I was able to access the file system through Diskinternal Linux Reader, the files inside are not readable, they are just a ton of 1GB files which don't have any extensions. I have even tried with a forensics software called DVR EXAMINER by Magnet but it can't decode the hdd, saying that it can't read RAYSHARP file system, or something like that.
The problem is that once I plugged the hdd back to the dvr the date was reset to 1/1/1970, and even after setting it back to the current date it still doesn't show any recorded footage.
I am sure the footage is still there since form the beginning I have unplugged all the cameras and I made sure nothing was written nor the hdd was formatted, but I can't find any way to extract the footage from it. Any suggestion would be really appreciated.

Interesting challenge .. I am very curious to see how this one gets solved.

Odd that the date reverted back to 1970 .. time to check the battery in the dvr and if it keeps the date. Wondering if there is more info that got reset

Time to disk duplicate now

 

[adelage]

Are you 100% positive the NVR was actually recording for the time in question?

Like did you actually watch video from a couple days prior or was the last time any video was looked at was months or years prior?

We see this type of question from time to time and usually the answer once they are able to access the video is the HDD quit recording long ago and the footage is nowhere near recent.

I saw the footage prior to removing the hdd, and the date was correct, but since I had to extract 5 days of footage from 2 cameras (almost 250 hours of footage) doing it with the built in viewer was extremely tedious, and unfortunately I assumed it was possible to do it by simply plugging in the hdd to the pc and copy it straight away…I would have never guessed that simply removing the hdd would have fxxxed the whole dvr settings!
The footage is needed is for an investigation over a theft, and the local police already told me that they need the video files ready to watch, they don’t have the “tools” needed to extract the footage from the hdd..I
guess CSI is just a tv show, especially in local areas like the one where I live

 

[wittaj]

Yeah CSI doesn't show reality. The files are encrypted or proprietary or in a different operating system than simply connecting it to a computer, but you know that now.

Sadly it sounds like you may just have to advance one month at a time year after year and hope the NVR sees it at some month/year. As long as the time stamp on the video is correct who cares if when pulling it from the NVR is says 1978 lol.

 

[mat200]

I saw the footage prior to removing the hdd, and the date was correct, but since I had to extract 5 days of footage from 2 cameras (almost 250 hours of footage) doing it with the built in viewer was extremely tedious, and unfortunately I assumed it was possible to do it by simply plugging in the hdd to the pc and copy it straight away…I would have never guessed that simply removing the hdd would have fxxxed the whole dvr settings!
The footage is needed is for an investigation over a theft, and the local police already told me that they need the video files ready to watch, they don’t have the “tools” needed to extract the footage from the hdd..I
guess CSI is just a tv show, especially in local areas like the one where I live

CSI time .. you need to disk duplicate now .. then set aside the original one and work with the copy you just made.

Put a new hdd into the dvr if you need hdd storage for the active cameras