DME Forensics Blog

Heading to Enfuse?

May 18,2016 /

DVR Examiner /

0 Comments

Are you going to be at Enfuse 2016? We are!

Jimmy will be heading to Las Vegas for next week's Enfuse 2016, the newly rebranded CEIC from Guidance Software. Be sure to stop by and say hello!

In addition to giving live demonstrations of DVR Examiner at our booth, #506, Jimmy will be addressing topics related to the analysis and recovery of video from CCTV DVRs during his lecture. If you have any questions about the lecture you can find the details below, in your Enfuse schedule, or by stopping by the booth. 

If you stop by the booth, be sure to ask about our special conference pricing, and enter to win a 6-month subscription to DVR Examiner!

Forensic Analysis of CCTV Digital Video Recorders
Thursday, May 26th 11:00AM-12:00PM

Synopsis:

Video from CCTV digital video recorders (DVRs) has become so prevalent that it can be an integral part of any investigation. Unfortunately, recovering evidence from these devices can be a difficult process. At best, the device is difficult to use and the export process is slow. At worst, no password is available or the device itself is damaged (such as in an arson). Sometimes the hard drive itself is the only item submitted for examination, often with no documentation pertaining to what type of system it may have come from. In this session, we will explore how recovering evidence directly from CCTV DVR hard drives differs from traditional computer forensic examinations. While these devices utilize file systems, they are more often than not proprietary and will not be interpretable by traditional computer forensic tools. Even the devices that utilize traditional file systems often store proprietary data and index formats on them. Identifying and interpreting proprietary metadata and indexes used by these systems is the key to identifying how these file systems work. We will explore several options (both manual and automated) for the recovery of data – including data that has been deleted or formatted but not yet overwritten.

 

Recent Posts