Recover Deleted Footage from DVR

Every once in a while, a DVR comes into Gillware’s data recovery lab to give our DVR video recovery specialists a challenge. Or, specifically, (usually) the hard drive from a DVR unit comes into Gillware’s lab. These things enter our lab because our client needs lost footage from a DVR unit recovered. Typically, the video footage in question was lost to mechanical failure or deleted. The footage we’re tasked with recovering usually isn’t something so mundane as last week’s episode of Better Call Saul, though. The units we receive for DVR data recovery skew less toward home DVR units and more toward video surveillance units.

Sometimes when this footage goes missing it’s a matter of an accidental deletion. Somebody pressed the wrong button and whoops, there goes last night’s footage. Or someone went in to do some “spring cleaning” and free up some space on the hard disk drive for future recordings, and forgot to back up older ones, or deleted video files that weren’t yet slated to be purged. Sometimes there’s ill intent behind the data loss. An intruder might purposefully delete footage or attempt to physically destroy the DVR unit’s hard drive to cover their tracks.

Our client in this data recovery case came to us with a KGuard SHA24 8 DVR unit. They’d accidentally deleted a few days’ worth of surveillance footage from the unit and needed it recovered. Our logical data recovery specialists, experts in recovering deleted data, were on the case.

DVR data recovery often prove a bit more challenging than the typical deleted data recovery case our logical engineers see on a daily basis. DVRs are a lot like the computers you and I use every day. They’re just a bit more specialized—or rather, a lot more specialized. (The same holds true of, for example, wireless routers and NAS devices. There are computers in more places than you’d think!) The specialization gives our engineers a few more hoops to jump through and hazards to navigate.

Challenges in DVR Video Recovery

These unexpected computers have their own operating systems and file systems; they tend to be some sort of variety or flavor of Linux. The designers of these devices tend to mess with the file systems in pretty creative ways to create proprietary systems. We’ve seen NAS devices, for example, that wrote data in reverse order to the hard drive(s) and let the NAS handle “untwisting” them, so the user wouldn’t be able to read any data if they took the drive out of the enclosure and hooked the naked drive up to their computer.

Trickery notwithstanding, these operating and file systems can also be so heavily modified that they can still end up looking pretty alien compared to freely-available Linux systems. Trying to salvage data from these devices can sometimes be a bit like trying to figure out hieroglyphics without the Rosetta stone (not the language learning program, but the literal Rosetta stone itself). Sometimes we have to come up with the stone ourselves!

In this DVR video recovery case, we could use the DVR unit itself, which the client sent in along with the hard drive, as a Rosetta stone after we’d successfully imaged the hard drive. The hard disk image had all the data on the original drive, down to the last sector, just to prevent the (extremely slim, in our engineers’ capable hands, but still possible) chance of inadvertently altering data on the original drive. To the DVR unit, our disk image might as well have been the genuine article.

Using the KGuard DVR unit as a sort of ad-hoc translator, our deleted data recovery specialists could sift through the drive. Now began the hunt for signs of video footage in this DVR data recovery case.

DVR Data Recovery: How Audiovisual Sausage Gets Made

Even with the DVR unit performing as an interpreter, our engineers couldn’t find signs of deleted video files on the hard drive’s proprietary file system. However, our engineers’ searches did turn up raw stream data in unallocated spaces on the disk.

When you record a video, your recording device writes the audiovisual data as you create it. But it’s not until you finish recording that the audiovisual data you’ve created gets squeezed into a “container” you can go back to and access, like a .mov or .mp4 file. Raw video stream data, in other words, is a bit like sausage without its casing.

Sometimes we can’t directly recover the files containing all that audiovisual goodness. But the raw stream data, however, still exists. Often our engineers can identify the unique footprints of raw stream data, even if the file that should contain that data has gone up in smoke, and have to stuff that “sausage” into a new “casing” after salvaging it. For more details about how our technicians can seek out and salvage raw stream data in data loss situations, check out our case study on AJA video recovery, in which we recover raw stream data from an AJA Ki Pro recorder.

DVR Video Recovery Results

Our DVR video recovery specialists successfully recovered large amounts of raw h.264 stream data from the DVR unit’s hard drive. We shared the raw H264 stream data with our client, as well as our best reconstructions of the video files themselves, and we made sure to guide them through the recovered data and helped them reintegrate it as best we could. The results we produced left our client satisfied. This DVR data recovery case garnered a 9 on our ten-point scale.