Someone recently asked me if I could have a quick look at the hard disk from a Q-SEE QSD6209 DVR. The DVR quit working, but the disk seemed to be ok. They were hoping I could pull some video files off of it. I haven't had much luck and was wondering if anyone who's managed to recover data from a DVR would be able to give me any tips.
The vendor knowledge base claims the disk should have an ext2 filesystem. It doesn't and I'm not convinced their FAQ is correct. The disk was undamaged and a disk from a very similar DVR that I had brief access to didn't have any recognizable filesystems. The first 512 bytes of the disk look like this:
Code: Select all
hexdump -C disk-min.raw
Code: Select all
00000000 69 56 65 6e 61 79 64 72 03 b1 00 00 00 00 00 00 |iVenaydr........|
00000010 1c 1d 60 59 00 00 01 00 00 00 01 00 00 00 00 02 |..`Y............|
00000020 1c 1d 60 59 00 00 02 00 00 00 03 00 00 00 e0 01 |..`Y............|
00000030 54 53 32 33 30 35 31 33 53 30 00 56 00 00 00 00 |TS230513S0.V....|
00000040 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
00000050 00 00 00 00 00 00 00 00 00 00 00 20 00 00 10 00 |........... ....|
00000060 00 00 e3 01 00 00 00 00 00 00 00 00 00 00 00 00 |................|
00000070 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
*
00000200
The brief access I had to a similar device was at a remote site. The only thing I was able to have done to it was to have someone pull the hard disk and check if there were any partitions on it. The access I was able to arrange was very limited and I can't get access to it again. I realize that not being able to get sample files from a similar device might make it impossible for me to recover any data from the disk.
I found a similar thread where someone talks about a (roughly) similar DVR here. When I run photorec will all default options, it recovers about 8GB of *.dad files; 1-3GB files. The start of these files look like this:
Code: Select all
head -c 64 f127845970.dad | hexdump -C
Code: Select all
00000000 44 48 41 56 8c a4 c6 a2 b1 19 5e 2f 5e 3f 30 bc |DHAV......^/^?0.|
00000010 af 93 a7 21 d1 17 a5 6d 36 94 59 c5 de 39 39 c5 |...!...m6.Y..99.|
00000020 d2 bd 8c f7 28 0d f5 6a 3e ec ce 69 35 e8 f7 67 |....(..j>..i5..g|
00000030 04 09 d2 20 cd d6 f5 87 ae 13 00 42 56 60 a7 24 |... .......BV`.$|
Code: Select all
head -c 64 f194963612.dad | hexdump -C
Code: Select all
00000000 44 48 41 56 da aa 89 92 d2 e0 22 42 2d b2 49 55 |DHAV......"B-.IU|
00000010 b5 ca 55 a9 55 49 1a 5b ca 88 a1 2b 19 53 73 c5 |..U.UI.[...+.Ss.|
00000020 aa 41 0d a1 f6 2a 54 a3 71 52 d4 5e 98 6a 5a 44 |.A...*T.qR.^.jZD|
00000030 68 06 d6 8c 49 6a d4 a2 44 33 b2 66 1a 52 b1 56 |h...Ij..D3.f.R.V|
Code: Select all
head -c 64 f254854006.dad | hexdump -C
Code: Select all
00000000 44 48 41 56 82 a4 3a a5 83 e6 c6 55 33 71 74 48 |DHAV..:....U3qtH|
00000010 91 5e a4 10 ed ff e2 56 e0 89 51 72 2a 35 a7 83 |.^.....V..Qr*5..|
00000020 89 68 d5 e0 08 6d f4 9c f5 ab 28 91 53 4d f8 00 |.h...m....(.SM..|
00000030 63 9d b5 78 a6 54 15 d3 28 ac 05 9f a9 8a de 79 |c..x.T..(......y|
Code: Select all
head -c 64 f347955922.dad | hexdump -C
Code: Select all
00000000 44 48 41 56 ea aa 9c f6 b5 56 21 8f 10 ea b8 87 |DHAV.....V!.....|
00000010 43 68 5a 44 06 72 6d 6b 49 c9 56 d7 9a 52 97 e9 |ChZD.rmkI.V..R..|
00000020 ff 73 e5 ba 9d f8 f5 d5 6f b5 e9 3b f7 c4 98 24 |.s......o..;...$|
00000030 94 03 af 00 ee 11 dc 9b 60 92 50 0e bc 02 94 47 |........`.P....G|
Code: Select all
head -c 64 f66348396.dad | hexdump -C
Code: Select all
00000000 44 48 41 56 4a 9e 12 1d 2b 8e 9e 9a 01 01 a1 02 |DHAVJ...+.......|
00000010 d8 28 f0 ee b3 7f d8 fe 03 7f 63 b7 ec 80 c9 ad |.(........c.....|
00000020 22 39 93 91 8c c8 aa 4f 5c 1f 11 8c 9f 9f fe 6e |"9.....O\......n|
00000030 00 dc 8e 7e 92 07 88 15 e0 32 a1 1d f8 ce 62 5b |...~.....2....b[|
I'm trying to recover from a GNU ddrescue image of a 250GB disk (512 byte sectors). I tried running testdisk first, but it wasn't able to find any partitions that looked useful. It claimed to find a small FAT32 partition, but didn't seem right to me. It also gave me an error about the disk being too small and read-only. I forgot to make notes before exiting, so I may have to rerun testdisk. Is it possible for testdisk to have false positives?
I also tried the custom photorec signature suggested in the linked thread, but it wasn't able to find anything:
Code: Select all
echo "dav 0 DAHUA" > ~/.photorec.sig
photorec disk.raw