cgsecurity.org

Hi there,
After 2 weeks of trying to recover a lost partition on my DVR, I finally came to point where I figured out where my lost data is on the lost drive.
A 500gb DVR hdd failed when I connected it through a USB docking station to win 7. Apparently the fie system was linux and it failed.
Anyway the drive is 500gb and using testdisk and photorec I recovered 400gb of data as mpg files and none of it was my data, these were just old data from the previous dvr this hdd was mounted on)
I am assuming my data to be *.dad files
I also know that my data is from 776000000 - 976000000 sectors of the drive
My problems:
1. I need custom extension *.dad to be recovered. I do not understand how to form that signature for photorec to recover these
2. I want to search only a certain part of the hdd, above sectors
3. I am trying through windows and unfortunately when I go through different steps listed all over the internet, fidentify_win gives an error saying " fidentify cygwin warning:
MS-DOS style path detected: C:\Users\Master Is\photorec.sig
Preferred POSIX equivalent is: /cygdrive/c/Users/Master Is/photorec.sig
CYGWIN environment variable option "nodosfilewarning" turns off this warning."
I have a folder named testdisk on my desktop which includes photorec and testdik and fidentify_win etc. I just double click to open fidentify and it gives an error.

Where should I write that path??
Thanks

You can ignore the warning.
Concerning the .dad files, please provides file samples or some hex dump of the beginning of a few files

I added hex view of 2 files

Create a photorec.sig file with

thank you
can you also tell me where to put this photoreg.sig? any specific folder?
also is there a way to search a specific sector of the hard drive instead of all of it?

ok great finally after 3 weeks I began recovering data
thank you!!!

but there is a problem. This data is dvr recording of security cams. There were 4 cameras.
Normally for each cam there is a different *.dad file.
However only in the first 15 minutes I recovered 11.000 small files. It finds too many files, they should be bigger files normally.
At the beginning of the scan I chose expert mode and when it asked me the sector size I chose the default value of 512.
Can that be the problem? If I choose a bigger size can I get bigger files??
thank you again

yes big problems here.
17.000 small files recovered
and they are mixed
meaning cam1 and cam2 are in the same small file

do you think we could recover different file sizes by changing the custom signature?
I don't know much about programming but is this signature saying "recover all the files that start with dhav on 0 buffer"
is there any way of adding different characteristics to that sig?

Can you upload some original dad files ? What is the name/brand of the recording device ?
I will see if it's possible to do.

the min file size I found is 25Mb
I could send via wetransfer.com if you give me an address

My email is grenier@cgsecurity.org