Request Help

Request Help

We are happy to help! Please fill out this form or call us
Call: 866-438-6932

DVR recovery CCTV data recovery

DVR Data recovery

Surveillance is ubiquitous in our society, inevitably at some point many may need DVR data recovery.  From Google Nest, Amazon Ring, to more sophisticated DVR multi camera surveillance systems. Unfortunately, when accidents, crimes, or other catastrophic events occur our DVR systems may be damaged.  In the event of arson, burglary, and other crimes the surveillance system may be the first target of destruction by the perpetrator(s).

In the last 10 years we have worked with various law enforcement agencies both Federal (ATF, FBI) and local recovering video footage from various arson cases. In arson cases we have recovered the footage of the perpetrator lugging gas jugs from his car and setting buildings ablaze. In one case we recovered footage of the criminal looking directly at the CCTV camera prior to vandalizing the DVR and setting fire wot the building.

DVR drive configurations

DVR systems can have one or more drive in the system. 

  • A DVR may have a single drive that records for a week or more, the maximum calendar is usually 30 days. When the time frame for retention expires the oldest data is deleted and a new day is recorded. 
  • Two drives in a DVR may be set up as a RAID 1, often referred to as mirror set. Put simply, the second drive in the set is a copy of the first.  This is helpful if one drive fails.
  • Conversely, two drives can also be set up as a JBOD or span set. The data starts on the first drive and spans over to the second.  This increases the amount of data or calendar days a DVR can store.
  • Additionally, they may also be setup as a RAID 0, where two drives use a set stripe of sectors to read and write.
  • If a DVR has 3 or more drives they may be setup for redundancy or RAID 5, if one drive fails the two remaining drives can still function in a degraded state. (caution if DVR is setup as RAID 5 always check to ensure all drive are online)

How a DVR records data

DVRs may have various file systems. Most video is stored in the H.264 or MPEG-4 Part 10, which is a video compression standard based on block-oriented, motion-compensated coding.  Deciphering the file system and customization of the video codec can be time consuming and various tools may be necessary to extract video from a drive that was previously in a DVR-CCTV system.

DVR Manufacturers:

  • DHFS (DAHUA DVR ), RSFS (raysharp), WFS {WFS 0.1/ WFS 0.2 / WFS 0.3/ WFS0.4}
  • Hikvision, ZHILING,FS3.2,KSF, JF, Keeper, MCG, VVF ,HYAV, Avtech , kouoer, Hisome, IFV
  • Dmax,Eagle,HBGK,BL_WAPE,Jovision,Juanvison,Tiandy,TianMin,TDFS,ZENO,IDIS,Jemsay,
  • icatch, iVenaydr, STREAMING, SWANN, TP-Link, Zhongldun, ZView, BlueSky, KSF_Dc, Uware, FHDRH
  • Acegear, Common, Novus, Tango, JVS_SV7, Uware8K, Lorex, QVFS, WFS0.5, WFS_EXT1, SD-MDVR, DHFS, Linux

Hard Drive Recovery from fire damage.

  • Printed Circuit Board (PCB) will need to be reconstructed by using an exact match and writing rom from to old PCB (if possible) to new PCB.
  • Removing corrosive debris, smoke, water from a platter surface(s). This may require a significant investment in time. Most drives are not single platter drives. Drives in DVRs are usually large and have several platters.  Removing debris while retaining platter alignment requires a significant amount of R & D and time on behalf of a data recovery engineer.
  • Avoiding the bad stuff- when a drive is severely damaged in a fire and then submerged in water or chemical compounds after the fire has been extinguished, there may still be some lingering debris or some corrosion to a platter surface. We may then have to disable heads in ROM to allow us to chose what head or heads we want to image prior to hitting a platter surface that may destroy the head assigned to it.  This allows us to get an idea of where the data of interest may reside on the hard drive.
  • Finally, if we have successfully retrieved data from platters with no or limited damage we will go after the remaining surfaces using large jumps if a sector is unreadable or if the drive times out. We may choose to read using PIO mode instead of UDMA, there are scripts we can employ to handle situations where the drive is just barely readable to prolong the life of the head reading and limit damage to the platter surface. 
//www.googleadservices.com/pagead/conversion.js