DME Forensics Blog

What is a Filesystem?

April 6,2015 /

Getting Started With DVR Examiner /

0 Comments

So just what is a "filesystem"?

A filesystem is term that DME Forensics uses to refer to a specific family of DVRs. Families are often made up of several different lineages all combined together right? We see DVRs the same way.

We deal with the internal computer components, namely main boards and chipsets, that come inside the DVRs. Many people are surprised to find out that quite a few DVRs share the same components. If DVRs share the same components it is very likely that they will handle data, and specifically video, in the same way.

For example we have a filesystem called "60D" that's used in GE StoreSafe DVRs. This "DVR Family" is very small, as GE was very restrictive about which DVRs could use this filesystem, thus the vast majority of the DVRs that use this filesystem will be GE StoreSafe DVRs.

On the other hand the "KSF_dc" filesystem or "family" is quite large. We've found many different brands that share the same components, and thus are part of the same "family". Swann, NightOwl, and many other brands fall into this family, but not every DVR from Swann or NightOwl is part of this family. Sometimes manufacturers change components for a specific model or style of DVR, or maybe they need it to support a different number of cameras or quality settings. NightOwl for instance has DVRs that we know of specifically that fit into at least 4 different filesystems.

Clarification: A "filesystem" can contain one or more traditional "file systems" like EXT or FAT32. We use the term "filesystem" without a space to try and differentiate the DVR filesystems from the more traditional ones.

Where can I find what filesystem I have?

There are two main ways to find out what filesystem your DVR is. The first and easiest way is right after your click the "detect" button on the source screen. The window that comes up if your filesystem is detected shows our filesystem name right at the top:

In this case, the filesystem is DRV_264.

The other way to get to this window requires that your filesystem is fully supported. Once you've scanned your data you'll arrive at the clip list. In the clip list screen there's a menu bar for "Report". Under that menu there's an option for "filesystem information" that will bring this window up again.

What do the names mean?

Honestly? The names are made up. Most of the time, however, they do have an identifier that means something to us. Sometimes it's about the structure of the drive, sometimes it's specific hex that's on the drive, sometimes it's even readable text written out in hex on the drive. "This is Tango Magic" happens to appear on some drives, hence: TangoMagic! Often times we'll also add what encoder the DVR is using too, like _MPEG, _JP2, or _264. Mostly the names are just there for the benefit of communication, so don't worry too much about why any one name exists specifically.

In conclusion...

Filesystems are just DME Forensics' way of naming how the DVR handles files. We have to have them to be able to communicate about DVRs with our customers and amongst ourselves. Hopefully with the extra detail in this post, you can understand why we're not able to answer you if a specific DVR is supported in most cases. We have a pretty good feel for DVRs and can often guess about what filesystem a certain DVR might be, but we can never know for sure until someone tests it out, so test out those DVRs, and more importantly let us know what you find! The more you tell us about what you're running into, the more we can make DVR Examiner work for you!