Looking for tips to recover files from a Q-SEE QSD6209 DVR.

Using PhotoRec to recover lost data
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
ryan29
Posts: 3
Joined: 18 Feb 2016, 00:58

Looking for tips to recover files from a Q-SEE QSD6209 DVR.

#1 Post by ryan29 »

Hi,

Someone recently asked me if I could have a quick look at the hard disk from a Q-SEE QSD6209 DVR. The DVR quit working, but the disk seemed to be ok. They were hoping I could pull some video files off of it. I haven't had much luck and was wondering if anyone who's managed to recover data from a DVR would be able to give me any tips.

The vendor knowledge base claims the disk should have an ext2 filesystem. It doesn't and I'm not convinced their FAQ is correct. The disk was undamaged and a disk from a very similar DVR that I had brief access to didn't have any recognizable filesystems. The first 512 bytes of the disk look like this:

Code: Select all

hexdump -C disk-min.raw

Code: Select all

00000000  69 56 65 6e 61 79 64 72  03 b1 00 00 00 00 00 00  |iVenaydr........|
00000010  1c 1d 60 59 00 00 01 00  00 00 01 00 00 00 00 02  |..`Y............|
00000020  1c 1d 60 59 00 00 02 00  00 00 03 00 00 00 e0 01  |..`Y............|
00000030  54 53 32 33 30 35 31 33  53 30 00 56 00 00 00 00  |TS230513S0.V....|
00000040  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000050  00 00 00 00 00 00 00 00  00 00 00 20 00 00 10 00  |........... ....|
00000060  00 00 e3 01 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000070  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
00000200
I think that if I understood how the vendor was storing data I'd have a reasonable chance of getting something off of it. I emailed the vendor and they were not at all helpful. All I was able to get from support was a canned response with links to knowledge base articles that I'd already read.

The brief access I had to a similar device was at a remote site. The only thing I was able to have done to it was to have someone pull the hard disk and check if there were any partitions on it. The access I was able to arrange was very limited and I can't get access to it again. I realize that not being able to get sample files from a similar device might make it impossible for me to recover any data from the disk.

I found a similar thread where someone talks about a (roughly) similar DVR here. When I run photorec will all default options, it recovers about 8GB of *.dad files; 1-3GB files. The start of these files look like this:

Code: Select all

head -c 64 f127845970.dad | hexdump -C

Code: Select all

00000000  44 48 41 56 8c a4 c6 a2  b1 19 5e 2f 5e 3f 30 bc  |DHAV......^/^?0.|
00000010  af 93 a7 21 d1 17 a5 6d  36 94 59 c5 de 39 39 c5  |...!...m6.Y..99.|
00000020  d2 bd 8c f7 28 0d f5 6a  3e ec ce 69 35 e8 f7 67  |....(..j>..i5..g|
00000030  04 09 d2 20 cd d6 f5 87  ae 13 00 42 56 60 a7 24  |... .......BV`.$|

Code: Select all

head -c 64 f194963612.dad | hexdump -C

Code: Select all

00000000  44 48 41 56 da aa 89 92  d2 e0 22 42 2d b2 49 55  |DHAV......"B-.IU|
00000010  b5 ca 55 a9 55 49 1a 5b  ca 88 a1 2b 19 53 73 c5  |..U.UI.[...+.Ss.|
00000020  aa 41 0d a1 f6 2a 54 a3  71 52 d4 5e 98 6a 5a 44  |.A...*T.qR.^.jZD|
00000030  68 06 d6 8c 49 6a d4 a2  44 33 b2 66 1a 52 b1 56  |h...Ij..D3.f.R.V|

Code: Select all

head -c 64 f254854006.dad | hexdump -C

Code: Select all

00000000  44 48 41 56 82 a4 3a a5  83 e6 c6 55 33 71 74 48  |DHAV..:....U3qtH|
00000010  91 5e a4 10 ed ff e2 56  e0 89 51 72 2a 35 a7 83  |.^.....V..Qr*5..|
00000020  89 68 d5 e0 08 6d f4 9c  f5 ab 28 91 53 4d f8 00  |.h...m....(.SM..|
00000030  63 9d b5 78 a6 54 15 d3  28 ac 05 9f a9 8a de 79  |c..x.T..(......y|

Code: Select all

head -c 64 f347955922.dad | hexdump -C

Code: Select all

00000000  44 48 41 56 ea aa 9c f6  b5 56 21 8f 10 ea b8 87  |DHAV.....V!.....|
00000010  43 68 5a 44 06 72 6d 6b  49 c9 56 d7 9a 52 97 e9  |ChZD.rmkI.V..R..|
00000020  ff 73 e5 ba 9d f8 f5 d5  6f b5 e9 3b f7 c4 98 24  |.s......o..;...$|
00000030  94 03 af 00 ee 11 dc 9b  60 92 50 0e bc 02 94 47  |........`.P....G|

Code: Select all

head -c 64 f66348396.dad | hexdump -C

Code: Select all

00000000  44 48 41 56 4a 9e 12 1d  2b 8e 9e 9a 01 01 a1 02  |DHAVJ...+.......|
00000010  d8 28 f0 ee b3 7f d8 fe  03 7f 63 b7 ec 80 c9 ad  |.(........c.....|
00000020  22 39 93 91 8c c8 aa 4f  5c 1f 11 8c 9f 9f fe 6e  |"9.....O\......n|
00000030  00 dc 8e 7e 92 07 88 15  e0 32 a1 1d f8 ce 62 5b  |...~.....2....b[|
The playback software for the DVR expects *.dav files. I can't seem to do anything with the *.dad files that were recovered. Based on the thread I linked, it's likely photorec is at least partially recovering files I'm interested in. However, I don't know enough to properly assess if photorec is recovering partial files or if *.dad files are some type of internal temporary file used by the DVR or something else entirely. If anyone can give me an explanation, or even an educated guess, of what I'm getting it would be useful.

I'm trying to recover from a GNU ddrescue image of a 250GB disk (512 byte sectors). I tried running testdisk first, but it wasn't able to find any partitions that looked useful. It claimed to find a small FAT32 partition, but didn't seem right to me. It also gave me an error about the disk being too small and read-only. I forgot to make notes before exiting, so I may have to rerun testdisk. Is it possible for testdisk to have false positives?

I also tried the custom photorec signature suggested in the linked thread, but it wasn't able to find anything:

Code: Select all

echo "dav 0 DAHUA" > ~/.photorec.sig
photorec disk.raw
As mentioned, I'm working from an image of the original disk, so I'm willing to try anything even if it's destructive.

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: Looking for tips to recover files from a Q-SEE QSD6209 D

#2 Post by cgrenier »

When running PhotoRec, have you try the ext2/3/4 setting ? Maybe you will be able to play the recovered dad files.

ryan29
Posts: 3
Joined: 18 Feb 2016, 00:58

Re: Looking for tips to recover files from a Q-SEE QSD6209 D

#3 Post by ryan29 »

Hi,

Thanks for the reply. Yes, I tried both the ext2/3/4 and the other setting.

I happened to get lucky on this and found a tool that was able to play video from the raw disk. I tried one of the vendor tools and, even though it failed, it gave me a hint that it was looking for a Vineyard formatted storage device. I was able to find a tool / player (PC Viewr D6 Series - I can't recommend anywhere to download it) that would read the raw disk.

Of note, the viewer didn't work in a VM. When I first tried it I was using a VirtualBox raw disk image that was created over a loop mount of my ddrescue image. The viewer looked like it was working, but everything was black. On a hunch I copied my image back to a real disk and plugged it into a Windows machine. It worked.

Thanks again for taking the time to reply,
Ryan

p0p0v
Posts: 7
Joined: 12 Feb 2016, 10:26

Re: Looking for tips to recover files from a Q-SEE QSD6209 D

#4 Post by p0p0v »

...and may be your PC Viewr D6 Series can play recovered *.dad files?

ryan29
Posts: 3
Joined: 18 Feb 2016, 00:58

Re: Looking for tips to recover files from a Q-SEE QSD6209 D

#5 Post by ryan29 »

p0p0v wrote:...and may be your PC Viewr D6 Series can play recovered *.dad files?
Unfortunately it wasn't able to.

Locked