Forensic DVR Recovery is a forensically sound method of recovering video from CCTV DVRs. For each DVR Data Recovery case that we work, we start by examining how the DVR stores data. This is often in a proprietary manner which prevents many traditional examination tools and techniques from accessing the data. Through a reverse engineering process we are able to identify how the proprietary filesystems in these devices operate. Using this knowledge, we are able to recover data, including “deleted” data, in a completely forensically sound manner.
Since traditional recovery from CCTV DVRs require the device to be powered on while the video is being exported, many changes to the data can occur during this process. For example, the DVR is typically actively recording new video which could potentially overwrite existing video of interest. Also, any system malfunctions or unintentional user actions could render the data unrecoverable. By nature, traditional DVR recovery requires the device to be functional and accessible. Arsons or other types of damage can leave the device inoperable, while a simple password can lock out any attempts to export video.
By directly accessing the data on the DVR hard drive in a write-protected environment, the data can be recovered without the risk of any changes. Also, since the original DVR may not be required for a successful recovery, the data can still be recovered if the device is damaged or locked by a password.