Forensics
AVTECH 773M video files recovery May 31 2010 09:00AM
Marco Leone (mfoolb gmail com) (2 replies)
Re: AVTECH 773M video files recovery Jun 02 2010 05:16PM
Steven H. Margolis (shm aero org)
We took apart a surveillance system a few years ago; perhaps yours is arranged similarly. The still frames were byte-reversed JPEGs behind a small header containing block numbers to create a doubly-linked list pointing to successive blocks (linear block addressing). Each frame + header was stored in a whole number of 512 byte blocks, in our case, either 2 or 3 depending on how effective wa the JPEG compression of that frame. The first block's back pointer indicated the last block used and was, we assumed, used to tell the recorder where to place the next frame (we had the disk only, not the device). As you describe, the data was written directly to disk without a recognizable partition table.

I hope this helps.

Steve

On May 31, 2010, at 2:00 AM, Marco Leone wrote:

> Hi,
>
> I'm trying to recovery video data from a disk used with a DVR AVTECH
> 773-m (ADV7171 chipset); if I insert this disk into the DVR it can't
> read it giving an empty disk error. I'm quite sure the data is still
> into the disk.
>
> It seems that the DVR write raw data to the disk, none of the tools
> I've used was able to retrieve any file system or partition
> information.
>
> I've tried to do some reverse engineering using a working disk that
> has a couple of recording but at the moment I'm not makeing any
> progress.
>
> Photorec recovered files from the not working disk but it seems they
> are all false positive.
>
> Do you have any information about data format used by AVTECH?
> Can you suggest tools/path to follow to try and recover the data?
>
> Thank you very much in advance for helping.
>
> Ciao.
>
>
> --
>
> Marco.
>
> -----------------------------------------------------------------
> Certify Software Integrity - thawte Code Signing Certificates
> This guide will show you how Code Signing Certificates are used to secure code that can be downloaded from the Internet. You will also learn how these certificates operate with different software platforms.
> http://www.dinclinx.com/Redirect.aspx?36;5000;25;1371;0;2;946;005be7f5c8
72ea1f
>
>

-----------------------------------------------------------------
Certify Software Integrity - thawte Code Signing Certificates
This guide will show you how Code Signing Certificates are used to secure code that can be downloaded from the Internet. You will also learn how these certificates operate with different software platforms.
http://www.dinclinx.com/Redirect.aspx?36;5000;25;1371;0;2;946;005be7f5c8
72ea1f

[ reply ]
Re: AVTECH 773M video files recovery May 31 2010 08:55PM
Michael Painter (tvhawaii shaka com)


 

Privacy Statement
Copyright 2010, SecurityFocus