DME Forensics Blog

11 Tips When Faced with a Non-working DVR

April 10,2017 /

DVR Forensics /

0 Comments

As most of you who have had interactions with surveillance DVRs have probably experienced, DVRs are a pain in the butt. Ignoring the physical conditions of where the DVR is located (the attic/drop ceiling, next to the grease trap in the kitchen, under 5 inches of dust), the DVRs themselves can be really finicky, really slow, and they all behave a little differently. While we have designed DVR Examiner to work with the DVR hard drive directly, bypassing the need for the DVR itself, it may still sometimes be necessary for you to work with the DVR itself to export video or determine the DVR settings.

Understanding what to do when you encounter a DVR in the field that isn’t working can be crucial to preserving any evidence that may exist on the device.

As a part of the DVR Examiner development process, we interact with a lot of DVRs. Some of them are in pristine working condition, and some not so much. We have compiled the below list of tips & tricks for getting a DVR to work. Before you start troubleshooting, we recommend you complete the below steps:

 

  1. Document the current state: While the DVR is off, it is a good time to take note of the current configuration. We suggest documenting the make/model of the DVR (if there is one) and the current configuration of anything that is plugged into the DVR. Pictures work well for this, particularly if there is no make and model information available.

DVR_3-4_trans.png

  1. Preserve the data: There are many things that can occur during the startup of a non-running DVR that could cause unintended changes to the data stored on the hard drive including:
    1. Power Surge: Failure of the DVR power supply or system board may cause a power surge that can kill an otherwise working DVR.
    2. Hard Drive Association: Some DVRs store the serial number or other properties of the hard drive in memory as the ‘associated drive.’ A malfunction of the system board, or depletion of the CMOS battery may cause that association to be lost, resulting in the DVR ‘formatting’ the hard drive upon boot.
    3. Video Expiration: Some DVRs have the option to set video to ‘expire’ after X number of days. If the DVR has been powered off for any period of time, booting it up may cause the DVR to ‘erase’ that video.


The best way to preserve the data would be to make a forensic image of the DVR’s hard drive. While this copy of the data will not be able to be used in the DVR, it still gives you a copy of the original evidence before any modifications were made. Once you have a solid forensic image, you can make a clone from that later if needed.

Once we have documented the current state of the DVR and made a copy of the data just in case, we can try and troubleshoot why the DVR is not working.

  1. Check the power supply – Just because there happens to be a power supply on the shelf next to the DVR, doesn’t necessarily mean that it is the correct power supply. Most DVRs use a 12v power supply with a standard DC Barrel Jack; we typically see anywhere from .5 amps to 5 amps for DVRs, and around 1 amp for camera power. When checking the power supply, be sure to check all the connections; most DC power supplies have a connection at the wall, the power brick and the back of the DVR.
  2. If the power supply looks good, check for any additional power buttons or switches. While a lot of DVRs will boot as soon as they are plugged in, some may have power switches on the back and/or power buttons on the front.
  3. Is there a hard drive? It’s rare, but some DVRs will require a drive in order to properly boot. If you have removed the hard drive to create a clone or image, you may need to re-connect the original drive, a clone, or an empty spare drive. Be mindful of the impacts of drive association: putting in a different hard drive may prevent you from using the DVR to recover your video in the future. 

DVR Inside.png

  1. Is the hard drive spinning? A quick and easy way to check is to touch or carefully pick up the hard drive. If it is spinning you will generally be able to feel it. With some unbranded ‘black box’ DVRs, there are no lights so checking the hard drive can be a good indicator that the system has power. If the drive does not spin, it may indicate additional issues with power (bad power supply, or invalid amperage) or an issue with the hard drive itself.
  1. Is the hard drive working? We should know this from our attempts to make a forensic image of the drive. If the drive does not work it may cause the DVR to be unable to boot, or may be shorting out the system. Try disconnecting the hard drive and booting the DVR.
  1. If the hard drive is spinning, the DVR has power and may be working. If you do not see any display on the monitor, double check the connections. Some DVRs may have multiple video outputs (VGA, BNC, RCA, HDMI, etc.) but be aware, not all DVRs use all of the ports the same way.

    Some DVRs will leverage a ‘SPOT’ output, that allows you to assign one or more cameras to a specific monitor. Others will only display menus on the BNC/RCA port, and leave the VGA ports for viewing cameras. Others can require button combinations to switch between video outputs or to set the resolution for your monitor. It is always a wise idea to try all the different video ports available to you to see if one of them works.
    Back of DVR .png
  2. Is there a remote? Some DVRs will only function when using a remote. They may turn on and spin up the hard drive, but they will not output video until you press a button on the remote. Typically, these are the same DVRs that have very few, or no buttons on the front panel and may or may not accept a USB mouse. If the DVR has a make/model, you may be able to find a spare remote on eBay or through the manufacturer. 
  1. Use the manual: If there is a manual provided with the DVR, or you have a make/model for the DVR and can find one online, a quick read through the manual can be helpful for troubleshooting basic issues. Many times, the power requirements and video output options will be highlighted in the manual.
  1. Use DVR Examiner! If you are just trying to recover video, using DVR Examiner will likely be faster and easier than using the DVR itself, plus there is no risk of unintended loss of your evidence. DVR Examiner is a forensically sound method of recovering video from the DVR. If the DVR is off and you use a write-blocker to scan the hard drive with DVR Examiner, you can re-install the hard drive and the DVR will never even know it was removed.physical_setup_masked_trans.png