When it comes to adding support for new DVRs into DVR Examiner, or recovering video manually for a laboratory case, understanding the proprietary metadata of a given DVR filesystem is critical.
While I will be posting a series of posts over the next few months on understanding the proprietary structure of DVR filesystems, I wanted to share some information about Hikvision systems that was recently requested.
Most DVR filesystems store key metadata in 2 different places: the index(es) and at the beginning of each frame. In the case of the Hikvision-based systems, the index information is stored at the end of each data block, and provides a date time range per channel for the clips within that block. In this metadata, the date time is stored as a traditional Unix epoch timestamp (seconds since 1970). However, the date/time metadata at the frame level is stored in a very different manner.