Analysis of CCTV digital video recorder hard disk storage system

A commercial closed circuit television digital video recorder was investigated to determine if it was possible to extract useful video data from its storage media without access to the manufacturer's application software. After an initial test period the storage disk was removed, imaged and analysed. The file structure of the storage disk was deduced and the features necessary to locate a sequence of video evidence identified.The format of video data from the device was considered and shown to be based upon standard compression technologies. The observed format was fully documented to enable further development. With a little extra effort in processing the raw video data it was shown how video sequences could be extracted for use as evidence even in cases where the recording device is no longer functional, the turnkey software not available, or data partly corrupted. With careful application standard media players can be employed to view the resulting video sequences.Conclusions are that, while based on proprietary file systems and video formats, data from digital video recorder systems is amenable to analysis using commonly available computer tools. In return for investigative work there is a reasonable probability of being able to recover usable video from systems. There is also scope for the development of more specialised software tools to facilitate this process.