We understand that the recovery of ALL video on a DVR hard drive is very important to our users. So how can you verify that DVR Examiner is finding all the video on the drive? There are a few ways users can use empirical verification to be sure DVR Examiner is recovering all the evidence you need.
One of the easiest ways to verify the output from DVR Examiner is to compare the total size of video located by DVR Examiner to the expected amount of data. For example, if you have a 500GB hard drive that you know is full, you should expect DVR Examiner to identify close to the same amount of data. Typically, DVR Examiner will not recover the full amount of data, due to indexing and partitioning of the drive, but the number will be close.
To calculate the total size of video in DVR Examiner go to the clip list window and select the clip(s) that have been recovered by DVR Examiner. Once all these clips are selected, at the bottom of the screen you will see the word “Selected” and the number of clips highlighted in blue. Click on this and you will receive a pop up with approximate size of the clip(s) selected.
Other Types of Verification
If you are getting errors from DVR Examiner and you believe data is not being shown, you should attempt to image the drive. When the image is being created, a log is created. This log will provide any errors that occurred during the imaging process. If you encounter no errors, attempt to scan the newly created image.
Let’s say that during one of the verification processes your data isn’t matching up. Your next step is to determine why.
- Scan the drive with DVR Examiner
- Identify the time span of the data found
- Inspect the time frame where the event occurred
- Determine the total amount of video data
- Verify what channels were recorded
- Connect a clone to the original DVR
- Examine the same information from the DVR itself
- Compare the two sets of data
- Does the time span of video available on the DVR match DVR Examiner?
- Do the # of recorded channels match DVR Examiner?
- Is the total size of recorded video similar to or the same as DVR Examiner reports?
While you can try to compare the DVR Examiner clip list with the list of clips in the DVR, keep in mind that these may not always be a one-to-one match. Certain filesystems do not provide the data as clips, instead they let you select a given time range to view or export. In these cases, DVR Examiner will use these timeframes to define what the clips will be. If the filesystem saves the data as clips, we will have to occasionally truncate or create a new clip using the preexisting data. Don’t forget to disable any filters in the DVR Examiner Clip List. When a filter has been applied, it can cause video that does not fall under the filter’s requirements to not appear. Filters can be cleared from the clip list window by clicking ‘reset’ and then ‘apply filters’.
No access to the DVR?
You may not have access to the DVR for every case you work. This may be due to damaged, password protected, or missing DVRs. Without the original DVR, troubleshooting an issue can be a little harder. However, many of our filesystems offer inaccessible scanning. This scan searches for data that is not accessible to the DVR (deleted or overwritten). Useful if the data is missing and suspected to be deleted.
If you have followed the above steps and suspect that video is not being found, please contact DME Forensics Technical Support. We can be reached by phone at 1(800) 413-0363 or by email at firstname.lastname@example.org