Forensic Security DVR System Acquisition & Analysis

image3

The solution we use for acquiring video and metadata from CCTV DVRs is a forensically sound process. Whether in the field or in the lab, our process allows us to bypass DVR passwords and archaic menus to quickly extract evidence from the DVR hard drive directly.


Traditional computer forensic techniques can fall short with CCTV DVR systems due to the proprietary filesystems and data used. 


Tired of having to guess or track down DVR passwords? By working from the DVR hard drive directly, we eliminate the need for any passwords or menus.


Was your DVR toasted in an arson? Destroyed by a subject or just seen better days? If the hard drive works, we can possibly recover the data.


Hard drive not working? We can possibly help! Contact us and we can evaluate the options available for your situation.

Hard Drive Level Access

image4

Unlike using "export" functions, by accessing the hard drive directly, we can create a forensic image of the DVR system, including potentially deleted / inaccessible videos, that the DVR doesn't even know it still has.


By accessing the DVR hard drive (or forensic image) directly, we can identify and recover video significantly faster than manually exporting individual clips from the DVR itself. 


Bypass Password & OS

image5

Don’t waste time trying to guess or recover unknown DVR passwords. By accessing the hard drive directly, there is a good chance we can easily bypass the passwords.


Recovering Deleted Video

image6

On supported systems, our process can recover video that is no longer accessible to the DVR. This allows you to recover formatted, deleted, or partially overwritten video. 

Frame Level Timestamps

image7

Our process has the ability to overlay critical metadata such as Channel and Date/Time during preview, allowing you to easily develop a timeline of events. DVR time set incorrectly? The metadata overlay can display the corrected timestamp. 

Commonly Supported Systems

Unfortunately, it is not possible to determine which proprietary filesystem is used within a given make or model of DVR so we are not able to provide a complete list of supported systems. Below, we have highlighted some of the most common types of systems that our process supports: 

Popular Makes/Models

  • Swann
  • Zmodo
  • Q-See
  • HIKVISION
  • Samsung
  • .... more

Proprietary Filesystems

  • DHFS (Dahua)
  • WFS 1/2/3/4
  • IFS
  • HIKVISION
  • TangoMagic
  • ... more

Known Filesystems

  • EXT 2/3/4
  • FAT
  • XFS
  • JFS
  • Unpartitioned Space
  • ... more