Recovering Deleted CCTV From A Samsung SRD-1670D

A Case Study

As part of a computer forensics legal case, Data Clinic were recently asked by a solicitor to attempt to recover the footage from a CCTV system. The system had been with Cleveland police for several months, who during that time had been unable to recover any footage. We pick up the story from where we were first contacted by the solicitor.

Contact from the solicitor regarding the CCTV system, Cleveland Police were unable to recover anything and were unable to get through the password protection.
CCTV system arrived with us containing 2 x 2TB Western Digital hard drives, this system was a Samsung SRD-1670D
Each internal hard drive was tested with each displaying symptoms of media degradation, one quite badly degraded. (What is media degradation ? Go here: https://www.dataclinic.co.uk/recovery-hard-disk-drive-bad-sectors/)
Each drive was cloned on to another 2TB WD drive, one a perfect clone the other with approx. 9000 bad sectors from 1.9 billion, both clones were considered more than acceptable for the purposes of CCTV image recovery.
Examination of the drives showed each had an EXT3 partition of around 20GB and a larger XFS partition occupying the rest of the drive.
Both drives were returned to the CCTV system and powered on.
The system was security locked and neither the provided password nor the default would provide access.
The correct username and password was then hacked from a file located in the 20GB partition at the beginning of one of the drives.
We now had access to the system but no footage could be viewed, the system simply detailed each of the drives as empty.
We then accessed the drives once again to see if we could play any of the stored files using various video player and codecs. Each of the files had an extension of .SSF
The files could not be played using any of the software we found nor would our carving methods work.
We then discovered that the drive with the most content had partition damage due to the bad sectors and a lot of the files in the 20GB partition were in accessible. Attaching the drive to a Ubuntu system and running the command xfs_repair -L /dev/sda1 we were able to repair this enough to access and recover the missing files.
It was here we discovered that each of the video files had 3 associated files probably used by the system for metadata or playback purposes.
A new drive was introduced into the system and formatted using the CCTV device itself to provide use with a new undamaged volume.
All of the associated metadata files were then copied over to the 20GB volume and all of the video footage files were copied over to the larger XFS volume.
This newly created and populated drive was then introduced to the system.
Once again the system displayed the volume as empty, no video footage was displayed.
Further scans of the XFS partition revealed some older footage files, the interesting thing here was that these older deleted files were not prefixed with the letter D as with all the current present files.
It was here we discovered that the prefix of D must indicate to the system that these were deleted files and the CCTV recorder was disregarding them.
We then renamed quite a few of these files without the prefixed D and placed back into the system.
Once again the CCTV system showed no video data.
Looking at the volume again in Ubuntu each of the video files we modified had once again been given the D prefix.
It was here we discovered that the system was setup to delete video footage which was older than 40 days, and so much later, when the Police powered on the system, each of the video files were automatically given the D prefix and were disregarded by the system.
We then changed the CCTV systems date setting from sync and manually input the time back to the approx. date of the event in question.
Before re-introducing the disk again, we then renamed all of the video files by again deleted in the prefix.
Once introduced the system now allowed access to all the video footage which was before not viewable.
The footage from the event in question was located and the appropriate time period was extracted from the CCTV system using the back facility and output using the .AVI file type.
Data recovered.

Do You Need To Recover CCTV ?

This case study is just one example of the CCTV recovery work we do. For more information, please contact us.

Links
> Go to our CCTV and DVR Recovery Page
> Go to our Computer Forensics Page

cctv, computer, data, forensics, recovery

Jacob Greenwood

14:38 30 Mar 18

5* customer service! Recovered my father's book from an old drive, also retrieved some long forgotten about photos. Simply cant put a price on something like that.

Jarek Roover

12:21 30 Jul 18

Go there if you lost your data

Tony Cowgill

15:56 10 Apr 13

We've used Data Clinic twice now - once for my son's laptop which held all his University work and suddenly seemed to just die, that was recovered with ease. And then secondly in connection with work when our office computer system backups were somehow corrupted. These people really know their stuff - they are very helpful and professional and quick! Thanks so much for everything.

Rob Deighton

11:33 09 Dec 16

Happy to recommend Data Clinic to anybody that suffered Data Loss on storage Media. The guys were extremely helpful and knowledgeable and made the recovery of our valuable data a stress free experience.

George Thorpe

12:19 20 Feb 14

My company provides IT support to approximately 60 Yorkshire based companies ranging from small 10-15 users up to Enterprise sized organizations. Due to disk failure a client recently lost their entire database. We contacted Data Clinic and within hours a representative was onsite, several hours later the drive was returned, again in person by Data Clinic Manchester. I would not hesitate contacting them again, outstanding service in a market that can mean life or death to a business. 10 stars if there was an option!

Kieran Collins

21:02 25 Oct 18

Fantastic. Could not fault them at all, Brilliant, 10 year old iMac full of data and they had the data back to me in 72 hours. Communication via e-mail was fast, clear and superb.

David Tett

14:36 24 Aug 18

Sent them a 4tb WD Red hard drive to recover. They quoted me £588 incl VAT and recovery media. I was a bit sceptical so I asked for it to be returned. First they sent me the wrong hard drive (a 500GB WD Blue). Not too careful about data protection then. When I eventually got the drive back it had been totally stripped and outer casing binned (would have been nice to know about this beforehand). I decided to send it to Curry's PC World. They quoted £90 + recovery media. All data recovered and both hard drives returned within a week. What more is there to say.

Elle Sweet

22:12 20 Aug 18

Awful communication, I was constantly chasing them for updates on my device. My device was with them days before work was started on it. The data this company couldn’t retrieve was later retrieve by Apple. Waste of a £110.

Salutation
First Name
Last Name
Primary Phone*
Primary Email
Device Type*
Description
GDPR opt in