2011
01.20

Extracting data from a CCTV DVR hard disk

3 people like this post.
Share

Today I was handed a hard disk, removed from from a CCTV DVR about which we knew nothing (no model/make). The request was to extract as much footage as possible from it. I hooked the disk to my laptop via a SATA/USB adaptor but, unsurprisingly, wasn’t able to find/mount a filesystem. I dumped the first 30 megabytes off the device (dd if=/dev/sdb of=x.bin bs=1M count=30) and opend the resulting file with a hex editor:

# od -t x1 -a x.bin | sed 's/nul/   /g' | head
0000000  44  48  46  53  34  2e  31  00  00  00  00  00  00  00  00  00
          D   H   F   S   4   .   1                                    
0000020  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00
                                                                       
*
0036040  00  00  00  00  00  00  00  00  03  00  00  00  01  00  00  00
                                        etx             soh            
0036060  03  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00
        etx                                                            
0036100  00  00  00  00  00  00  00  00  22  00  00  00  00  00  00  00

The first bytes read “DHFS4.1”. Various Google searches return just one english hit: a machine translated page from chinese mentioning a company named “Dahua” that manufactures some video surveillance equipment. On their support page an HDD Download Tool can be found (filename: HDD Download Tool.rar). It can look up video clips stored on a disk by date, time and channel (input number), and extract them as “.dav” files (e.g: 01.23.03-01.33.21[M][@2a2ed][0].dav). You can convert .dav files to .avi using “dhavi.exe” (from bahamassecurity.com). I was able to run the latter with Wine, which probably means that .dav content can be packed into an .avi container without transcoding (even though the website says something about H.264 codecs). The former tool, instead, requires Windows because of the raw disk I/O going on.

Hopefully, this post gathered some difficult to find info, coming either from Chinese pages or sites not indexed by Google…

Size    | md5sum                           | Filename
--------+----------------------------------+------------------------
240168  | cbe0912a78074226060d4101f4f67902 | *HDD Download Tool.rar
87552   | 18b79f0827dfa27cf4e068f02d78f02b | *HDD Download Tool User's Manua 2009-6.doc
216081  | 993c1bd56e03427351bb8cdfea142803 | *General_DiskCopy_Eng_TS_V1.00.0.R.090611.rar
299008  | 624721057cd0857ef5ecbde9643debfd | *General_DiskCopy_Eng_TS_V1.00.0.R.090611.exe
208896  | e5e3fa834ccf7e6b1ad222b1aa38b91c | *DiskIOCtl.dll
1037312 | 4a5b234d673e5d10fbddddae3bb777a1 | *dhavi.exe
Share