2011
01.20

Extracting data from a CCTV DVR hard disk

3 people like this post.
Share

Today I was handed a hard disk, removed from from a CCTV DVR about which we knew nothing (no model/make). The request was to extract as much footage as possible from it. I hooked the disk to my laptop via a SATA/USB adaptor but, unsurprisingly, wasn’t able to find/mount a filesystem. I dumped the first 30 megabytes off the device (dd if=/dev/sdb of=x.bin bs=1M count=30) and opend the resulting file with a hex editor:

# od -t x1 -a x.bin | sed 's/nul/   /g' | head
0000000  44  48  46  53  34  2e  31  00  00  00  00  00  00  00  00  00
          D   H   F   S   4   .   1                                    
0000020  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00
                                                                       
*
0036040  00  00  00  00  00  00  00  00  03  00  00  00  01  00  00  00
                                        etx             soh            
0036060  03  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00
        etx                                                            
0036100  00  00  00  00  00  00  00  00  22  00  00  00  00  00  00  00

The first bytes read “DHFS4.1″. Various Google searches return just one english hit: a machine translated page from chinese mentioning a company named “Dahua” that manufactures some video surveillance equipment. On their support page an HDD Download Tool can be found (filename: HDD Download Tool.rar). It can look up video clips stored on a disk by date, time and channel (input number), and extract them as “.dav” files (e.g: 01.23.03-01.33.21[M][@2a2ed][0].dav). You can convert .dav files to .avi using “dhavi.exe” (from bahamassecurity.com). I was able to run the latter with Wine, which probably means that .dav content can be packed into an .avi container without transcoding (even though the website says something about H.264 codecs). The former tool, instead, requires Windows because of the raw disk I/O going on.

Hopefully, this post gathered some difficult to find info, coming either from Chinese pages or sites not indexed by Google…

Size    | md5sum                           | Filename
--------+----------------------------------+------------------------
240168  | cbe0912a78074226060d4101f4f67902 | *HDD Download Tool.rar
87552   | 18b79f0827dfa27cf4e068f02d78f02b | *HDD Download Tool User's Manua 2009-6.doc
216081  | 993c1bd56e03427351bb8cdfea142803 | *General_DiskCopy_Eng_TS_V1.00.0.R.090611.rar
299008  | 624721057cd0857ef5ecbde9643debfd | *General_DiskCopy_Eng_TS_V1.00.0.R.090611.exe
208896  | e5e3fa834ccf7e6b1ad222b1aa38b91c | *DiskIOCtl.dll
1037312 | 4a5b234d673e5d10fbddddae3bb777a1 | *dhavi.exe
Share

12 comments so far

Add Your Comment
  1. Ne sai una piu del diavolo !

    (quindi 2 in meno delle donne !)

    Max.

  2. […] See the original post here: 108.bz » Extracting data from a CCTV DVR hard disk […]

  3. nice job, pal.

  4. I have downloaded the HD download tool but cannot enter the diskname, the dropdown list is not coming out .Please help…..

    • Hi Polly, I’m sorry I don’t have that device anymore, nor the related software… The only suggestion that comes to my mind is making sure that you’re running the tool on Windows XP; it won’t work on Windows 7…

      ciao,

      Giuliano

  5. Polly K…………have you started the tool as admin?

  6. The \HDD Download Tool\? Yep, definitely. I seem to remember that it’s accessing the HD at a low level (block by block): you’ll need Admin privileges to do that.


    Giuliano

  7. I have hdd formated and only 2 days new recording data. Can I recover the old recording data?

    • It depends on how the disk has been formatted… In any case, recovering data from a formatted hard disk which uses a non standard filesystem (such as the CCTV DVR’s) will surely prove difficult if not impossible. You might want to get in touch with a specialized data recovery company.

      Giuliano

  8. The disk was formatted with the DVR. I can recover data from previous days?
    Thank you!

  9. To be honest, I doubt you’ll be able to restore anything from that disk… Especially if, as part of the formatting, the DVR overwrites the disk contents (I don’t know exactly how it works). If its contents are super important, your best bet is to call a specialized Company and see what they tell you. Just Google for \hard disk data recovery\ and pick one of the sponsored links.

    Giuliano

  10. Do you have any tool that recover overwritten data?