Abstract
Closed-circuit television cameras conduct round-the-clock surveillance to capture video evidence of illegal activities and suspects. The camera outputs are processed and stored on hard drives in standalone digital video recorders. As closed-circuit television cameras operate continuously, video files are constantly stored on the hard drives, with the new files periodically overwriting older files. The partially-overwritten files, which are present in slack space, can be recovered via data carving. However, the majority of the recovered video files are often fragmented. Unlike a normal video stream, a recovered video stream comprises frames that are not in chronological order. As a result, it is very tedious for a digital forensic professional to manually locate frames of interest.
This chapter describes a method for identifying timestamps in carved digital video recorder footage. Experimental results using a Python implementation demonstrate the efficiency of timestamp identification and its effectiveness at recreating video footage.
This is a preview of subscription content, log in via an institution to check access.
Access this chapter
Tax calculation will be finalised at checkout
Purchases are for personal use only
Preview
Unable to display preview. Download preview PDF.
Similar content being viewed by others
References
A. Ariffin, J. Slay and K. Choo, Data recovery from proprietary formatted CCTV hard disks, in Advances in Digital Forensics IX, G. Peterson and S. Shenoi (Eds.), Springer, Berlin Heidelberg, Germany, pp. 213–223, 2013.
M. Ashraf, Forensic Multimedia File Carving, Master’s Thesis, Department of Computer and Systems Sciences, School of Information and Communication Technology, KTH Royal Institute of Technology, Stockholm, Sweden, 2012.
Datarecovery.com, Hexadecimal Flags for Partition Type, Edwardsville, Illinois (www.datarecovery.com/rd/hexadecimal-flags-for-partition-type/#:%7E:text=Hexadecimal%20flags%20are%20values%20that,the%20hexadecimal20flags%20listed%20below.), July 23, 2014.
DME Forensics, Inaccessible data recovery with DVR Examiner, Golden, Colorado (dmeforensics.com/inaccessible-data-recovery-dvr-examiner), 2019.
Exterro, Custom Carvers, Portland, Oregon (support.exterro.com/support/solutions/articles/69000765593-custom-carvers), 2022.
R. Gomm, N. Le-Khac, M. Scanlon and M. Kechadi, An analytical approach to the recovery of data from 3rd party proprietary CCTV filesystems, Proceedings of the Fifteenth European Conference on Cyber Warfare and Security, pp. 117–126, 2016.
Kakao, Global PotPlayer, Jeju-si, South Korea (potplayer.daum.net), 2022.
D. Lehri, CCTV Frame Timestamp Extractor, SourceForge (www.sourceforge.net/projects/carvedvrtimestamps), 2021.
Magnet Forensics, Magnet DVR Examiner, Herndon, Virginia (www.magnetforensics.com/products/magnet-dvr-examiner), 2022.
J. Park and S. Lee, Data fragment forensics for embedded DVR systems, Digital Investigation, vol. 11(3), pp. 187–200, 2014.
N. Poole, Q. Zhou and P. Abatis, Analysis of CCTV digital video recorder hard disk storage system, Digital Investigation, vol. 5(3-4), pp. 85–92, 2009.
rkcosmos, EasyOCR, GitHub (github.com/JaidedAI/EasyOCR), July 8, 2021.
SalvationDATA Technology, [Case study] DVR forensics: Fragmented files (overwritten video clips) come alive with SalvationDATA patented technology, SalvationDATA Blog, Chengdu, China, September 27, 2019.
Stellar Data Recovery, Video Repair Tool, Metuchen, New Jersey (www.stellarinfo.com/disk-recovery/video-repair.php), 2022.
W. van Dongen, Case study: Forensic analysis of a Samsung digital video recorder, Digital Investigation, vol. 5(1-2), pp. 19–28, 2008.
Yodot Software, Yodot Video Repair Software, Mountain View, California (www.yodot.com/video-repair.html), 2022.
Author information
Authors and Affiliations
Corresponding author
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2022 IFIP International Federation for Information Processing
About this paper
Cite this paper
Lehri, D., Roy, A. (2022). Identifying Desired Timestamps in Carved Digital Video Recorder Footage. In: Peterson, G., Shenoi, S. (eds) Advances in Digital Forensics XVIII. DigitalForensics 2022. IFIP Advances in Information and Communication Technology, vol 653. Springer, Cham. https://doi.org/10.1007/978-3-031-10078-9_8
Download citation
DOI: https://doi.org/10.1007/978-3-031-10078-9_8
Published:
Publisher Name: Springer, Cham
Print ISBN: 978-3-031-10077-2
Online ISBN: 978-3-031-10078-9
eBook Packages: Computer ScienceComputer Science (R0)
