Data Clinic - Data Recovery Services
  • Email
  • Facebook
  • Twitter
Call Us Free: 0800 151 2207
  • Data Recovery Home
  • Data Recovery Services
    • Hard Drive Recovery
    • External & USB Drives
    • RAID / Server Recovery
    • NAS
    • SSD
      • SanDisk SSD Data Recovery
      • Lenovo SSD Data Recovery
    • SD Cards
    • Mobile Phones & Tablets
      • >How The Process Works
      • Android Data Recovery
      • iPhone Data Recovery
      • Samsung Data Recovery
      • Sony Xperia Data Recovery
      • Nokia / Windows Data Recovery
      • Water Damaged Phones
    • CCTV & DVR
    • Macs
    • Windows Computers
    • Lost & Deleted Files
    • Advanced Forensic Data Recovery (ADR) Services
    • Forensic Investigation
    • Encrypted Volumes
      • Bitlocker
      • Check Point Endpoint
    • Tape Recovery
    • Tape eDiscovery & Conversion
    • Advanced Recovery Service
    • Spare Parts & Donor Drives
    • Disk Manufacturers
      • Seagate Hard Drive Data Recovery
      • Western Digital Hard Drive Data Recovery
      • Toshiba Hard Drive Data Recovery
    • SCSI Data Recovery
    • SQL Recovery
    • How Do Hard Drives Fail ?
  • Locations
    • Belfast
    • Birmingham
    • Bristol
    • Edinburgh
    • Glasgow
    • Leeds
    • Leicester
    • Liverpool
    • London – Chiswick
    • London – City
    • Manchester
    • Northampton
    • Sheffield
    • Southampton
  • Help & Advice
  • News
  • About Us / Contact

Recovering Deleted CCTV From A Samsung SRD-1670D

/ / Data Clinic Ltd, News

A Case Study

A Samsung SRD1670D CCTV systemAs part of a computer forensics legal case, Data Clinic were recently asked by a solicitor to attempt to recover the footage from a CCTV system. The system had been with Cleveland police for several months, who during that time had been unable to recover any footage. We pick up the story from where we were first contacted by the solicitor.

  1. Contact from the solicitor regarding the CCTV system, Cleveland Police were unable to recover anything and were unable to get through the password protection.

  2. CCTV system arrived with us containing 2 x 2TB Western Digital hard drives, this system was a Samsung SRD-1670D

  3. Each internal hard drive was tested with each displaying symptoms of media degradation, one quite badly degraded. (What is media degradation ? Go here: https://www.dataclinic.co.uk/recovery-hard-disk-drive-bad-sectors/)

  4. Each drive was cloned on to another 2TB WD drive, one a perfect clone the other with approx. 9000 bad sectors from 1.9 billion, both clones were considered more than acceptable for the purposes of CCTV image recovery.

  5. Examination of the drives showed each had an EXT3 partition of around 20GB and a larger XFS partition occupying the rest of the drive.

  6. Both drives were returned to the CCTV system and powered on.

  7. The system was security locked and neither the provided password nor the default would provide access.

  8. The correct username and password was then hacked from a file located in the 20GB partition at the beginning of one of the drives.

  9. We now had access to the system but no footage could be viewed, the system simply detailed each of the drives as empty.

  10. We then accessed the drives once again to see if we could play any of the stored files using various video player and codecs. Each of the files had an extension of .SSF

  11. Example CCTV footageThe files could not be played using any of the software we found nor would our carving methods work.

  12. We then discovered that the drive with the most content had partition damage due to the bad sectors and a lot of the files in the 20GB partition were in accessible. Attaching the drive to a Ubuntu system and running the command xfs_repair -L /dev/sda1 we were able to repair this enough to access and recover the missing files.

  13. It was here we discovered that each of the video files had 3 associated files probably used by the system for metadata or playback purposes.

  14. A new drive was introduced into the system and formatted using the CCTV device itself to provide use with a new undamaged volume.

  15. All of the associated metadata files were then copied over to the 20GB volume and all of the video footage files were copied over to the larger XFS volume.

  16. This newly created and populated drive was then introduced to the system.

  17. Once again the system displayed the volume as empty, no video footage was displayed.

  18. Further scans of the XFS partition revealed some older footage files, the interesting thing here was that these older deleted files were not prefixed with the letter D as with all the current present files.

  19. It was here we discovered that the prefix of D must indicate to the system that these were deleted files and the CCTV recorder was disregarding them.

  20. We then renamed quite a few of these files without the prefixed D and placed back into the system.

  21. Once again the CCTV system showed no video data.

  22. Looking at the volume again in Ubuntu each of the video files we modified had once again been given the D prefix.

  23. It was here we discovered that the system was setup to delete video footage which was older than 40 days, and so much later, when the Police powered on the system, each of the video files were automatically given the D prefix and were disregarded by the system.

  24. We then changed the CCTV systems date setting from sync and manually input the time back to the approx. date of the event in question.

  25. Before re-introducing the disk again, we then renamed all of the video files by again deleted in the prefix.

  26. Once introduced the system now allowed access to all the video footage which was before not viewable.

  27. The footage from the event in question was located and the appropriate time period was extracted from the CCTV system using the back facility and output using the .AVI file type.

  28. Data recovered.

Do You Need To Recover CCTV ?

This case study is just one example of the CCTV recovery work we do. For more information, please contact us.

Links
> Go to our CCTV and DVR Recovery Page
> Go to our Computer Forensics Page

cctv, computer, data, forensics, recovery

Comments are closed.

For an Immediate Quote
Call FREEPHONE
0800 151 2207

or, Request a Callback

Data Clinic Reviews

Data Clinic Ltd
Data Clinic Ltd
4.5
Based on 107 reviews
Write a review
SINBAD
SINBAD
20:59 24 Feb 21
If it's Broken and I mean Broken. They can fix it, recover it!!My memory stick was in pieces but they managed to salvage all the files from it. I am extremely grateful. Thank you so much. 💯% Recommended.
Ann Humphreys
Ann Humphreys
14:36 20 Feb 21
Absolutely fantastic companyAbsolutely excellent service and fast turn round of disc recovery and putting on a new hard driveSaved precious holiday and family photos and music

LONDON
68 Lombard Street, EC3V 9LJ
Tel: 0207 111 0964

BELFAST
The Mount, Belfast BT6 8DD
Tel: 0800 151 2207

BIRMINGHAM
11 St Pauls Square, Birmingham B3 1RB
Tel: 0121 629 0436

BRISTOL
Castlemead, Bristol BS1 3AG
Tel: 0117 322 6585

EDINBURGH
St Andrews Square, Edinburgh EH2 2AF
Tel: 0131 242 0037

GLASGOW
Tay House, 300 Bath Street, Glasgow, G2 4JR
Tel: 0141 301 1677

LEEDS
Building 3, City West Business Park, Gelderd Road, Leeds, LS12 6LN
Tel: 0113 254 9741

LEICESTER
3rd Floor, St. George's House, 6 St George's Way, Leicester LE1 1QZ
Tel: 0800 151 2207

LIVERPOOL
Horton House, Exchange Street East, Liverpool, L2 3PF
Tel: 0151 268 5255

MANCHESTER
The Pavilions, Bridge Hall Lane, Bury, BL9 7NX
Tel: 0161 761 0620

NORTHAMPTON
Victory House, 400 Pavilion Drive, Northampton Business Park, Northampton, NN4 7PA
Tel: 01604 529356

SHEFFIELD
The Balance, 2 Pinfold Street, Sheffield, S1 2GU
Tel: 0114 208 6027

SOUTHAMPTON
Basepoint, Andersons Road, Southampton SO14 5FE
Tel: 0114 208 6027


(c) 2020 Data Clinic Ltd - Data Recovery Services. Click to visit Data Clinic's DATA RECOVERY homepage.