Data Recovery from a CCTV DVR Hard Drive

data recovery CCTV

CCTV is almost everywhere these days. The prediction that George Orwell envisioned in his novel “1984” that surveillance would be ubiquitous has proved to be remarkably prescient. CCTV is often watching us wherever we go – whether we like it or not. Walking down the streets of Ireland’s cities and towns CCTV cameras are easy to spot. Walk into any supermarket and you’re probably being watched by ceiling-mounted dome cameras. Walk into any big-chain fast-food restaurant and more discreet cameras are watching you whether you realise it or not. The arguments for and against this type of surveillance can be discussed ad-infinitum.

Behind even the most sophisticated CCTV systems; the humble hard drive is often used as the primary storage device. VHS tapes used to be used for analogue-based systems but were made redundant by DVR (digital video recorders) devices which were more convenient to use and better suited to storing of digital footage. The hard drive, while it negates the need to be continually “changing the tape” can often be the weakest link when it comes to failure of these systems.

One such case we were dealing with during the week illustrates this. A well known multinational logistics firm contacted us about failure of one of their DVR’s hard drives. Recently, there was a theft from their reception area by (possibly) a member of the general public. Their staff were in the process of trying to extract footage from the device onto a USB drive. During this process the DVR froze several times. At this stage they were suspecting something was seriously wrong with the device. Eventually, they turned it off believing that a reboot of the system might resolve the problem. However, upon turning it back on, it would not initialise. To their horror, a red LED appeared on the system indicating “disk fault”. It was at this juncture that they decided to bring the failed DVR system to us.

The data recovery of footage from CCTV DVR systems poses some unique challenges not found with other cases. For example:

1) The file systems used will often be Ext2 or Ext3.

2) The encoding of video footage will often not be standard. It is extremely seldom that CCTV systems use formats such as .AVI or .MOV. The encoding of footage will often be in a proprietary format.

3) The time-stamp on recovered files is often crucial. The data recovery technician must use a recovery technique which endeavours to keep all file/folder time-stamps intact. Moreover, the data recovery technician must ascertain the time/date settings on the DVR device itself. If the time on the host device is not correct or has not been adjusted for DST (daylight saving time) the timestamps of the recovered folders/files will also be wrong.

We look delivery of the DVR system. Our technicians checked the sequence of warning lights on the device to double-check that there was not a problem with the device itself. The time and date were also checked on the DVR. Once these had been verified, the hard drive (a 2TB Seagate Barracuda S-ATA drive) was removed from the DVR’s motherboard. Our diagnostics revealed that the drive had numerous bad sectors and corrupt firmware on the Service Area.

Our technicians first imaged the drive. This is merely a routine safety procedure to make sure that the data is recovered in the safest way possible. Once this had been completed, our data recovery technicians restored the Service Area firmware modules on the drive. After this had been completed, a surface scan was performed. All the bad sectors were relocated and the drive’s defect tables (the G-List) were then updated.

This brought us to a point where we now had an imaged drive which was functioning properly. The video footage was appearing in .stream format (with all timestamps intact) but, alas, it was completely unreadable to our systems. We contacted the European headquarters of CCTV manufacturer who very kindly emailed us their proprietary codec-pack for reading the video footage. This was installed after a quick reboot all of their files became readable on our system. All of the recovered footage was delivered to the client on a USB drive. Big Brother is watching you but he might not be backing up his data…