With agencies processing hundreds, if not thousands, of DVRs each year, investigators are increasingly looking for time-saving strategies throughout video acquisition. Many DVR Examiner users find value in the ability to run a DVR scan or export unattended, so you can focus on other tasks while the program recovers vital video evidence. For DVR Examiner to successfully scan the hard drive, it is important to be sure to set your USB Power Settings correctly.
As portable devices become increasingly common, many computers are set up to save battery power as much as possible. Even a freshly installed Windows operating system (OS) on a desktop machine is most likely to be set up on a power management plan to save energy. One common way that Windows saves power is to turn off the USB ports, which can interrupt the connection of DVR Examiner to the hard drive.
If this occurs, DVR Examiner will alert you with a notification about the lost connection. In addition, an error log entry is created, for example: Error encountered during scan: E01 forensic image unable to be successfully closed after error. Forcing closed. Fatal read failure.
In DVR Examiner, we implemented strategies to read from the drive and maintain that connection even after the scan completes. However, Windows has absolute control over every process and can shut down power to the USB port if you leave your computer unattended.
To prevent your computer from interrupting the USB connection, you can manually verify your USB power options in the Control Panel or the Command Line. We recommend that you disable USB Selective Suspend Settings by changing the setting to disabled for both “On Battery” and “Plugged in.” Follow these steps:
Control Panel > Hardware and Sound > Power Options > Change Advanced Power Settings
You can also update this setting in the Command Line to apply across multiple computers. To download this script, click here. To open this script, unzip the file, then right click and hit “Run with PowerShell”. Otherwise, you can use the information below to disable USB Selective Suspend Setting on your own.
Start Command Prompt or PowerShell window and issue the following commands to disable (0) selective suspend while on battery and while plugged in:
powercfg /SETDCVALUEINDEX SCHEME_CURRENT 2a737441-1930-4402-8d77-b2bebba308a3 48e6b7a6-50f5-4782-a5d4-53bb8f07e226 0
powercfg /SETACVALUEINDEX SCHEME_CURRENT 2a737441-1930-4402-8d77-b2bebba308a3 48e6b7a6-50f5-4782-a5d4-53bb8f07e226 0
If, for whatever reason, you ever need to enable selective suspend in the future, issue the same commands, but substitute a 1 for the final 0 in each command.
Once this setting has been updated, investigators who experienced issues in the past should now be able to successfully run unattended scans in DVR Examiner, helping users focus on finding answers and solving cases.