There are several different methods commonly used when recovering video evidence from DVRs. DVR Examiner is a useful tool because it allows you to recover the video fast – usually much faster than traditional methods – and in a forensically sound manner.
DVR Examiner works with hundreds of DVR models and filesystems, especially those that are commonly found. We are constantly working to add new filesystems to the software so you rarely encounter a situation where the program is unable to recover data. However, there are the occasional times that DVR Examiner might return some unusual results (such as having footage from 1970). Here’s a look at why this happens, and how you can get this issue corrected.
Why Am I Getting Unusual Data?
At DME Forensics, we use reverse engineering to build DVR Examiner. This process enables us to find the data, extract it quickly, and protect the video in a forensically sound way. However, reverse engineering has some limitations that are unavoidable. If you have a lot of experience working with DVR recovery, you may have found a filesystem that DVR Examiner doesn’t recognize. While we strive to match DVR Examiner with as many filesystems as possible, new DVRs are continually released, and it does take time to obtain test data and to reverse engineer them.
In the uncommon cases where you might see unusual data, it is likely that DVR Examiner is confusing the found filesystem with an older version. This sometimes happens when a new filesystem is released which appears so similar to an older system that DVR Examiner gets confused. Other times, an older system is re-released with a new variation that we haven’t seen before; for example, recording footage as JPEG images instead of H.264. In these cases, DVR Examiner thinks it can retrieve the data even though it can’t. Therefore, it may misinterpret the data, producing results that don’t make sense, or it may misinterpret the unexpected values as damage to the filesystem or disk.
Luckily, this is a very simple issue to correct! Just follow the steps below and DME Forensics can help you recover the correct data from the DVR.
How To Add A Filesystem
If DVR Examiner does not yet support your filesystem, we can add support later in an update. We are constantly reverse engineering systems and adding support. With your help, we can speed this process along and correct this small bug even faster.
- Submit a profiler. This is the most important step whenever you find an unrecognized filesystem. This report provides a little information, usually not enough for us to reverse engineer the system, but hopefully enough for us to recognize it. Profilers help us determine which systems are in high demand.
- Submit test data. We cannot reverse engineer a system until we can get test data. We do try and buy DVRs that we don’t have, but some are difficult to get. If we don’t have a DVR or test data, submitting test data usually means your system is available much sooner.
- Provide us with a DVR. If you have a DVR you don’t need you can provide it to us to help us produce test data and hopefully reverse engineer the filesystem. In these situations, we prefer DVRs that are no longer considered evidentiary, however, in pressing situations you can contact us to discuss other situations.
- Request priority implementation. While we do try and get to all the DVRs, we understand that sometimes your need is urgent. We do offer a paid service for immediate reverse engineering of unrecognized filesystems. Note that we still need some of the above items to reverse engineer the filesystem as quickly as possible.
If none of these solutions work for you, remember our friendly support staff is only phone call or an email away. You can reach us at services@dmeforensics.com or 1-800-413-0363.
If you have any concerns about whether DVR Examiner supports your filesystem, please download our free trial! If you have already used a free trial previously, contact our support team and we can help you determine if DVR Examiner is able to recover your data.
Leave a Comment