A method for forensic recovery of video recordings from file systems of digital video recorders

Abstract

The utility model relates to the field of digital forensics, in particular to methods for extracting existing and restoring deleted video files from proprietary file systems of digital video recorders (DVRs) and network video recorders (NVRs) from Hikvision and Dahua. The essence of the method: the physical storage medium of the video recorder is connected to the computing device via a reading interface in the "read-only" mode; the header area is read from the medium and the file system type is identified by the signature; the file system metadata is read at fixed offsets; a sector-by-sector reading of the medium is performed and video frames are detected by characteristic signatures; the frames are validated by checking the header and footer signatures; They generate chronological video sequences with an adaptive discontinuity threshold, convert them into video files, and save them along with a forensic report. The technical result is a 91.8% recovery rate, 96.7% temporal accuracy, and a 2.4% false-positive rate thanks to automatic file system type identification, dual signature validation, and adaptive sequence generation.