CCTV DVR Harddisk Recovery after Fomat / Crash Etc.

This page explains how to recover some of the Recorded footage from Low cost standalone Chinese DVRs.

Like these ones.

http://tv2211.com/en/pcshow.asp?ArticleID=20017

I Bet there are more DVR models based on the same or similar Chipset /SOC.

I accidentally formatted one of these using the menu in the DVR and it removed all the time search info and showed

the DVR as EMPTY I had some important footage that I needed to get out so I had to figure out the format of the data

stored in the hard disk and how to play it. The approach I am stating should also theoretically work on hard disks that have

bad sectors or partially readable. This should work in case you are able to recover the data from completely crashed hard disk.

I did the recovery on Linux, you should be able to do this on other OSs too.

These DVRs use the harddisk as a circular tape and start dumping data to them in the raw format.

When I connected the 512 GB DVR Harddisk  to a Linux Box I could see the harddisk but it did not have any partitions. This

is how I assumed that they are using the Harddisk in raw format.

$ cat /proc/partitions

would  show up something like

major minor  #blocks  name

8        0 488386584 sda

8       16   78149687 sdb

8       17   61761861 sdb1

8       18   16386300 sdb2

8       32  488386584 sdc

8       33  487335425 sdc1

8       34    1048576 sdc2

I first took a copy of the entire hard disk so that I did not mess up my original disk while recovering.

$ dd  if=/dev/sda   of=image.img   bs=10M

From this file i took a slice

$ dd if=image.img of=test1 bs=10M count=1

This creates a 10 M slice.

When i tried playing this file from the 4n_NetViewer(eng).exe ( the dvr playback application that came with the DVR) it would not play.

Then I backed up a 5M file directly from another working DVR with footage in it to a USB flash disk and that file was playing.

When I compared the files I found that the DVR was storing the data in the Harddisk in a different Byte order from that in the USB disk.

I wrote a small C program that could convert the byte order.

#include <stdio.h>

#include <string.h>

int main(int argc, char* argv[])

{

char st[255],t,fname[256];

FILE *fp1,*fp2;

if (argc!=2)

{

printf("Usage: %s File\n",argv[0]);

return 0;

}

strcpy(fname,argv[1]);

strcat(fname,".vvs");

fp1=fopen(argv[1],"rb");

if (fp1==0)

{

printf("Unable to open %s File\n",argv[1]);

return 0;

}

fp2=fopen(fname,"wb");

if (fp2==0)

{

printf("Unable to create %s File\n",fname);

return 0;

}

printf("Starting...");

for(;;)

{

if (fread(st,4,1,fp1)<=0) break;

t=st[0];

st[0]=st[1];

st[1]=t;

t=st[2];

st[2]=st[3];

st[3]=t;

fwrite(&st,4,1,fp2);

}

printf("Done...");

fclose(fp1);

fclose(fp2);

return 0;

}

The above program can be saved to gcctv.c compiled using

$ gcc gcctv.c -o gcctv

I used this program to convert the 10 M file to

$ ./gcctv test1

This creates the test1.vvs with the right byte order that the Network application can play.

You can now use the above method to get any slice from the harddisk to play.

Ex:

$ dd if=image.img of=test1 bs=10M count=1 skip=100

$ dd if=image.img of=test1 bs=10M count=10 skip=300