A digital video recorder (DVR) of closed-circuit television (CCTV) commonly has an in-built capability to export video files to an optical storage media such as digital versatile disc. In the event that the DVR is damaged, its contents cannot be easily exported. Hence, it is generally accepted that recovering video files with its timestamps from a DVR hard disk using proprietary file format in a forensically sound manner is an expensive and challenging exercise. In this paper, we propose a technique that allows digital forensics practitioners to carve video files with timestamps (data recovery) without referring to the DVR hard disk’s file system. We then performed a forensic analysis to validate our proposed technique.
- Aswami Ariffin, Jill Slay and Raymond Choo