Hikvision raw data

[Ricesim]

Hello all,

I'm attempting to recover some footage for a local church, and I'm having some issues.

So far I have:

Write blocked and copied the original HDD.

Carved out the data I believe contains is the footage using active partition recovery.

The carved out file is around 1.6 TBs, came out as .lz4, and is playable in a few players. Those players being Windows Media Player, HX_Player, and Pot Player.

My issue is that I have no way to "seek" with these players. I'm guessing the meta data saying "how long" this file should be is not intact. In HX_Player I can skip around a little, but it's like hours at a time. I did see that the day and a few hours + and - of the time I need is on this huge file.

Does anyone have any advice on trying to play it accurately? Thank you for your time.

 

[Ricesim]

I should clarify and say this HDD was taken out of a W-Box (white labeled Hikvision) DVR. The original footage was quick formatted, but I used Active Part. Rec. to recover that 1.6TB file. There were other files I recovered as well with playable footage, but none of them were the correct time stamp.

 

[alastairstevenson]

There are multiple NVR forensic CCTV recovery utilities available - some paid for, some with free trial versions.
Last year I bought a Hikvision NVR off eBay where the HDDs had been initiallised via the NVR menus - by a professional CCTV management company - and the stored video was able to to be browsed by date / time / camera in a similar way to the NVR menus.

I don't recall the specific product I used, but I was quite taken aback at how well it worked, even though the NVR said the storage was empty.
Try a Google search, using 'forensic' in the search terms.

 

[alastairstevenson]

I don't recall the specific product I used, but I was quite taken aback at how well it worked, even though the NVR said the storage was empty.

I had a look on my Windows PC, but didn't find the program that I'd used.
I suspect it was on a PC that I no longer have.

I should have mentioned that these forensic programs recognise and support the proprietary file system layouts used by common CCTV manufacturers.
You could imagine that with such a lot of CCTV in use these days, and with miscreants trying to hide their tracks by 'initiallising' HDDs in NVRs etc, there is quite a need for such programs that can magically retrieve what appears to be not there.

 

[kasterzanayed]

Because of problems like this, I try to keep files that are important to me on third-party sources, send them to the cloud, or make multiple copies. I can keep all my important work files on my computer for a while but then take them out to an external drive or google disk. Of course, files stored on google can be lost, but only if my account is hacked. But the hard drive and other storage locations are often compromised by our activities. I've already made several * spam link removed * in my practice because I accidentally wiped all the information from that drive. I was worried that the files were permanently lost, but they helped me get them back. Maybe this will help you too.

 

[alastairstevenson]

There isn’t always an easy way to recover lost data, especially lost footage.

Not necessarily so, in my experience, it can be very easy.
There is redundancy in the file structures used in NVRs, from what I have seen.
And plenty of 3rd-party research on the topic.
For speed and efficiency, manufacturers tend not to use a common general-purpose file system which would add overhead but rather one built for the purpose.

And you could imagine that for evidential purposes as well as others - there is a need to recover data that a miscreant may have 'wiped', maybe with the 'format HDD' facility in an NVR.
It's not the data that gets wiped, it's the file structures that reference it, so the data remains.
As a consequence there is a fair selection of forensic types of software available that will recognise different NVR manufacturers file systems, and recover apparently lost data.