Author: Phil Froklage

Data Recovery with DVR Examiner: Accessible, Inaccessible, and VERY Inaccessible

By

Data recovery with DVR Examiner works by reverse engineering the many different DVR filesystems to locate and extract video footage. Most DVRs use a proprietary filesystem. Sometimes this is in conjunction with a known filesystem, often Ext 2 or 3, but even in these cases the video data is typically located in a large proprietary partition which won’t be recognized by conventional computer forensic tools. However, if you take a closer look at these “unallocated” spaces, you may find some familiar structures and multitudes of highly compressed video data.

Analysis of Hikvision Date/Time

By

Hikvision-based systems store date/time metadata a little differently than other DVR filesystems, and when it comes to adding support for new DVRs into DVR Examiner, or recovering video manually for a laboratory case, understanding date/time information is critical.

Meet the Magnet Forensics’ Training Team: Nick Bria

By

Introducing our newest member of the Training Team, Nick Bria. Learn more about Nick’s varied and interesting background and what he’s hoping to bring to his role at Magnet Forensics. Let’s get to know Nick! Want to learn more about what courses are offered? Visit our Training & Certification page for more information. MF: Tell … Continued

Surveillance DVRs: Orderly Shutdown or Pulling the Plug?

By

One ongoing debate within the traditional computer forensics community has been how to respond to a running computer in the field. When you arrive on scene to a running computer, do you go straight to pulling the plug, or do you conduct an orderly shutdown of the computer?