DME Forensics Blog

Recovering CCTV Video in the Field

May 1,2017 /

Forensic DVR Recovery /



You have shown up at your local convenience store where an unfortunate homicide has taken place, and your suspect is on the loose. Looking at the ceiling, you notice a plethora of cameras looking in all directions, including one trained on the front door. The manager of the establishment takes you back to the DVR - its lights are blinking and fan whirring and the manager tells you “I have no clue how to use this thing, or if it even works!”. How do you recover the footage you need? Time is ticking…First and foremost, is Officer Safety. Make sure that the area is secure, that any biological, chemical, and safety issues have been checked and cleared by the proper personnel.

Now that you are safe to use the DVR, you may want to gather a few things first. Ask the owner of the DVR for the owner’s manual, along with any other documentation that came with the device. Often a CD or DVD is included with the manual that has playback software and a copy of the manual in PDF form. Also check for a Remote, as some DVRs will only work with the Remote to gain access to video playback and export functions.

Second, you will want to ask the owner if they know or have the password for accessing the DVR. If they do not have a password, you may be able to Google a master password for that specific manufacturer, or model. Often, many defaults include leaving the password blank, a number of 1’s in a row, a number of 0’s in a row, 12345 (and other ascending numbers, or even descending numbers), 666666, 888888, among others. You may be able to contact the manufacturer, or another forensic analyst who might be able to help you find the password for your device.

BadPassword 2.jpg

If the DVR you are working with is already powered up, check and make sure it is not recording. If left recording, it could overwrite valuable evidence. Evaluate the health of the DVR, and if you feel that the DVR may not turn back on because it’s making a lot of different funny mechanical noises, your best bet is to use a USB drive and try to export video surrounding the time of your crime . When doing an export from the DVR, try your best to get the video in at least two formats: the one that is native to the DVR (like a .DAT file) and one that can be played by another computer (like a .MP4 or .AVI). Keep in mind that when you use a USB drive, some DVRs don’t work with drives larger than 4GB, so bring drives of varying sizes along with you.

Once your exports are done, it would be a good idea to shut down the DVR and either image the hard drive in the DVR with a forensic imaging tool, or make a clone of the drive. This way your evidence is saved in case anything happens to the DVR.

Enter DVR Examiner, where you can access videos and extract the raw video directly from the DVR, and even AVI files that are playable on most computers. You won’t have to wait for an export to finish, or mess around with the menus. Even lost or forgotten passwords won’t keep you from getting the evidence you need. DVR Examiner allows you to extract video in a forensically sound manner, and it can work with forensic images of DVR hard drives, clones, and even the DVR hard drive itself. When on scene, connecting the DVR hard drive to DVR Examiner can make quick work of getting the best quality video from the DVR, helping you with your investigation.





Recent Posts