Navigating Surveillance TF Card Video File Recovery

Overview

Nowadays, CCTV should be installed in more public places, such as shopping malls, schools, playgrounds, etc. In the event of an accident such as a fire, earthquake, or even a crime, evidence can be obtained from CCTV and video surveillance. Recovering Evidence from CCTV Footage is designed to provide investigators with best practices for identifying, collecting and correctly transmitting sensitive digital video evidence from crime scenes, thereby maintaining the integrity of the video evidence. The focus is on collecting evidence, preserving the integrity of the video evidence, and using the correct software to accurately play and review the collected video. For this situation, standard steps for data recovery from surveillance are necessary. Some CCTV video files are stored in TF cards, so it is also important to recover data from surveillance TF cards.

What is TF Card?

Surveillance video files can be stored in SD card, TF card, USB, hard disk, cloud and other locations. Regarding SD cards and TF cards, there is a little difference between the two. TF card originated from SanDisk and later evolved into the more commonly recognized term – microSD card. This shift is part of an industry standardization initiative. While “TF card” is still used in some regions and by certain manufacturers, it essentially refers to a microSD card, which is functionally equivalent. TF cards are also a common way to store surveillance video files because using TF cards has some advantages: as previously mentioned, TF cards exhibit remarkable smallness, rendering them suitable for devices with spatial constraints：

• Despite their modest physical stature, TF cards are available in a diverse array of capacities, providing substantial storage space for a multitude of purposes.
• TF cards facilitate seamless data transfer between devices, enabling users to carry their data with them wherever they roam.
• TF cards are engineered to withstand physical jolts and exhibit resilience against extreme temperatures and humidity
• TF cards present an compatibility with a wide spectrum of devices, encompassing smartphones, tablets, digital cameras, and more.
• TF cards present an economically efficient means of expanding storage capacity, eliminating the necessity to invest in new equipment.

Case Study

The police station receive the case, and when investigators come to the place get the TF card which used for the surveillance, then found out some video clips are lost, so it’s important to recovery data from the internet EZVIZ surveillance that can lift evidences to push the process of the case, and the time of the recovery video files is at 11/19/2023 from 3PM to 4PM. So it should use the VIP 2.0 system try to recovery the video files as much as possible.

• Inspection Materials: EZVIZsurveillance/TF card
• Inspection Tool: VIP 2.0 from SalvationDATA

Steps to recovery video files from EZVIZ surveillance:

Step 1. Connect the TF card to the VIP2.0 through the read-only interface. Since the TF card has a FAT32 file system, you can directly view the files in the card.

Step 2. From the existing file list, we can see that the creation time and modification time of all files are the same, and the video file sizes are the same. It can be preliminary inferred that the camera was re-initialized at 19:27 on November 25, 2023.

Step 3. Open VIP 2.0 video forensics software, and switch to expert mode. Since EZVIZ is a sub-brand of “Hikvision”, select “Hikvision” file system and scan.

Step 4. After the scan, we looked at the file list and obtained a total of 299 files, about 28.94GB in size. The time range was from 4:48:48 on November 22, 2019 to 9:24:4 on November 29, 2023.

Step 5. Filtering the footage from November 19, 2023, we found 4 very small video files, with only fleeting glimpses visible after extraction.

Step 6. Filtering the footage after 19:27 on November 25, 2023, we found 72 video files, occupying approximately 17.89GB of space.

Step 7. Filtering the footage before 19:27 on November 25, 2023, we found 227 video files, occupying approximately 11.06GB of space.

Step 8. Again, after filtering out video files smaller than 1MB, we found that there are still 45 video files that can be played normally, occupying approximately 11.03GB of space. The videos start at 6:51:56 on November 16, 2023 and end at 20:30:40 on November 18, 2023.

Step 9. Schematic diagram of video time distribution in TF card.

Conclusion

Since the surveillance has been working after initialization, the video files stored in the TF card will be overwritten cyclically. Now the surveillance video in the hard disk can be divided into 3 parts:

1. 45 uncovered videos with a size of approximately 11.03GBfrom 6:51:56 on November 16, 2023 to 20:30:40 on November 18, 2023.
2. 72 re-recorded videos after initialization with a size of approximately 17.89GBfrom November 25, 2023 19:27:48 to November 29, 2023 9:24:4, .
3. 182 very small residual video fragments that are not completely covered, accounting for approximately 28.73MB.

Summary: The surveillance video that can be played normally from 15:00 to 16:00 on November 19, 2023 cannot be restored.