How to Recover Deleted Video Files of a Specific Date?

Overview

Video and DVR forensics is a sub-branch of digital forensics, it is the activity to identify, retrieve and analyze video and metadata from CCTV DVRs and surveillance systems in a forensically sound manner. The way videos and images are captured can have a dramatic impact on how people interpret what they see. In a criminal case, where a video could be a key to proving someone’s innocence or guilt, but videos can easily be damaged accidentally or intentionally. This article is showing you how to recover deleted video files from a target surveillance hard drive.

Different Types of Video Files

Video files can be roughly divided into 4 types: ordinary video files, deleted video files, lost video files and fragmented video files.

1. Ordinary video files: video files that can be directly accessed by the DVR system.

2. Deleted video files: video files that have been deleted intentionally or unintentionally by someone and marked as deleted by the operating system, but the data still exists. We can recover deleted video files by analyzing the file allocation table and checking the allocated data area.

3. Lost video files: lost video files can be recovered or not will differ depending on whether the disk partition allocates storage space. For disk partitions with allocated storage space and a healthy file system structure, the operating system can access ordinary files through the file directory. For disk partitions that have no allocated space and do not have a healthy file system structure, the operating system cannot access the data in this area, even with the use of professional data recovery tools, video files cannot be recovered.

4. Fragmented video files: it occurs when a single file has been broken into multiple pieces.

Case Study

Recently, when the police seized the surveillance host of a hotel involved in the case, they found that the captured surveillance video had been deleted, and the surveillance hard drive had a capacity of 4TB. Investigators hope to restore the surveillance video files of the crime scene on a specific date so as to convict the suspect through video clues. At this time, it is necessary to restore the video files of a specific date according to the needs of the specific case to save time.

• Device: Dahua Sample.DD
• Tool: VIP 2.0 Video Investigation Portable

After extracting the data from the target surveillance hard drive, the extracted video files will be displayed in the video file list of VIP 2.0.

1. Click the add button to load the image file.

2. Select the image file “Dahua Sample.DD”

3. Select the loaded image file and start scanning

4. Here we need to select expert mode to scan.

5. Select fragments to scan.

6. Find video files close to the crimetime.

7. Expand the scanning sector range based on the scanning range in the previous step

8. Video files of relevant specific date can be viewed.

In Summary

When recovering deleted video files, formatted surveillance videos need to be restored in expert mode. In expert mode, if the case is not urgent, investigators can select deep scan, so that complete data information can be obtained. When the case information is particularly urgent, please select the fragment scan. After scanning based on a preliminary estimate of the approximate number of sectors, then expand the number of scanned sectors to obtain video files of a specific date.