Case Files: Recovering Deleted Evidence with DVR Examiner

This guest post comes from Greg Masi of Virginia State Police, who recently used DVR Examiner to investigate a homicide. 

Recently, Richmond PD was called to investigate a homicide. Upon arrival they found a victim dead at a residence. They were able to locate a home security surveillance system, but while on-scene the Detective accessed the DVR only to find a limited number of video clips for a limited number of days. The date & time of incident did not appear to be present. Concerned that the homeowner may have deleted or formatted the DVR prior to the arrival of police, the Detective seized the equipment and brought the DVR in to VA State Police for review.

Knowing DVR Examiner possessed the ability to retrieve inaccessible content, we decided to scan this DVR for such content. Upon scanning the system, we were able to identify that the system was supported and that we would be able to scan for inaccessible content. DVR Examiner ended up retrieving enough inaccessible content to include the dates & times of interest to the investigation and prove something or somebody reset this system to possibly cover up potential evidence.

Without DVR Examiner, we do not believe the data would have been retrieved while on-scene as the Detective would have thought there was no data of interest.