Discuss on the Data Recovery Method of Embedded DVR

On condition that the manufacturer keeps the file system and storage mechanism as the secret, this article makes an analysis and comparison of large amount of underlying data, and realize the research of digital video data recovery by researching the head, tail of frame data, passage number, data storage and other


Importance of surveillance video in public security
With the recently rapid development of computer, network and image treatment technology, the video surveillance technology has significantly developed.Currently, the video surveillance that can directly, accurately and timely reflect the objective facts has an important effect in the public security, and the cases solved by surveillance video has been increased.Meanwhile, more and more suspects also get to know the evidence effect of surveillance video, for example, the suspects will deliberately delete the surveillance video to destroy the evidence in the cases of quarrel in singing hall or other entertaining places or of theft by staff in an enterprise.Thus, the inspection demand of public security bureau on the surveillance video is gradually increased.In the inspection and appraisal of digital evidence, the recovery and access of digital video are increasingly related.
Video surveillance generally includes camera, transmission cable and video surveillance system.Camera collects the front-end video image signal.After collection, the video signal will be transmitted to the host machine by cables and distributed to each monitor.Meanwhile the video and audio signal will be synchronously input in the DVR.DVR is also called the Digital Video Recorder, and commonly called as video recorder.As all of the videos are digitally stored in the video recorder, the video recorder is not only the core of video surveillance system, and also the object of digital evidence inspection.

Introduction of recovery methods of video data in the embedded DVR
There are many kinds of video recorders, and for the need of technical confidentiality for each manufacturer, the file system specially owned by manufacturer is usually used, and its storage mechanism and structure are unknown, which cause a big trouble in abstraction and play of videos.In daily works, we received a video recorder produced by Streaming Video Corporation, and the surveillance video in the period of crime occurrence is man-made deleted and required for recovery.

Features of the built-in hard disk storage of embedded DVR
Different from PC type video recorder, the inner operation system and applications of embedded DVR are solidified in the motherboard.As the hard disk has no operation system, so it can be just used to store the video data.As the video that records the actual conditions of the case is stored in the hard disk, there is no doubt that the hard disk will become our main inspection object.By referring to the relevant website, we obtain several important technical parameters.The operation system of this embedded DVR uses Embedded Linux, with the standard of important code H.264.According to the experience of analysis on a large amount of underlying data, the inner hard disk storage of embedded DVR has the following features: (1) In view of the spatial distribution of hard disk data, it can be roughly divided into system identification area, index area, data area, and the video data we care is in the data area.Similar to FAT32, NTFS and other file systems, the data area occupies a large proportion of the whole hard disk storage space.(2) The video data in the hard disk data area is stored in frame unit, with each frame of data having symbolic frame head and tail.
(3) The storage space occupied by each frame of data is not fixed, and the size is related to the image content.
(4) The digital video will be stored in a cycling overwriting manner according to time order (5) The deletion and formatting program of video recorder does not delete the date in the data area, but rewrite the content area, which is our theoretical basis for data recovery.

Recovery methods of video data in the embedded DVR
We know that the video data is stored in frame unit, and a continuous video is composed of much frame data.To complete the recovery task, the priority is to clarify the structure of frame data.As for this video recorder, as it uses the image code standard H.264, the frame data area is generally added with frame head and tail customized by manufacturer based on 264 raw data flow.The start code of H.264 raw data flow is "0000000161H", therefore "0000000161H" may be used as the key words in Winhex software for searching.To avoid interference, we generally start searching the date in middle section.As shown in Figure 1, the appearance frequency of "0000000161H" is very high in hard disk.Then, we shall determine the head and tail of frame data.In the search result "0000000161H", we shall select five sections, and cut out several bytes prior to "0000000161H" in section.By comparing and checking the underlying data, we found that "31337762A800A800 00015200H" repeatedly appears in the middle of each section (as shown in Figure 2 and Figure 3).By preliminary reasoning, "31337762A800A80000015200H" may be the frame head of frame data.For further confirmation, we respectively select several data sections with "0000000161H" in different position in data area for analysis, check and comparison, and find that there are "33337762A800A80000015200H" (as shown in Figure 4), "32337762A800A80000015200H" (as shown in Figure 5) and other bytes that appear, by which we reason that the frame head may be "337762A800A800000 15200H".Use "337762A800A80000015200H" as the key word to search, we found a lot of results.By abstracting several results therein, we found that the key word and "0000000161H" appear in pairs.Therefore, we may confirm that "337762A800A80000015200H" is the head of frame data.According to previous inspection experience, for saving of space, the manufacturer generally leaves little interval among each frame data.So a byte section ahead of the frame head is generally the tail of frame data.By contrasting several data sections, we do not find any bytes with regularity, by which it is reasoned that the manufacturer may not specially define the frame tail.In fact, the determination of frame head, either with frame tail or not, does not greatly affect us to abstract the video data.

SHS Web of Conferences
Furthermore, we also find another regularity.A byte "30H", "31H", "32H", "33H" with regularity appear ahead of the frame head "337762A800A80000015200H". To clarify the meaning of this byte, we respectively export several frame data starting with "30337762A800A8 0000015200H", "31337762A800A80000015200H", "323 37762A800A80000015200H", "33337762A800A800000 15200H" to be stored as a file and checked by a player software provided by manufacturer, in which it is found that the passages displayed in the image are respectively "Passage 1", "Passage 2", "Passage 3" and "Passage 4".For further confirmation of the relation between one byte before the frame head and the passage number, we also select several data section for experiment, and basically confirm that this byte represents the passage number.
We export several sections of continuous data (Note: delete the start section of frame head and export from "0000000161H") to be stored as a file with extension name 264.We try to use video player to play, but unfortunately, Windstorm Image Sound, Perfect Decode and other universal player fail to play the file.By searching on the Internet, we found an exclusive video surveillance player named Hsplayer, which could play the exported file, but the images are switched frequently in each passage, we could not normally watch the video.Therefore, we reasoned that the data storage method of this video recorder may store the video data in each passage with the same time in a same region in order.So we successively copied, matched and exported the data section in the same passage to files to be played by Hsplayer, and the image display was normal.
Generally, the digital video will be stored in a cycling overwriting manner according to time order According to the above storage regularity, we shall search the video data in a certain time section, namely we shall first determine the data area and export the data section in the front, middle and rear part of data area respectively according to the above method to confirm the rough position of video data we wanted to find, and repeated this procedure to reduce the searching scope until we found out the video data in relevant period.

Conclusion
The data recovery of surveillance video has always been the problem that the digital evidence inspection faces, especially the embedded surveillance video.As it uses the file system customized by manufacturer, its storage mechanism and storage structure are varied, and there's not any available professional data recovery tools.Generally, we can only depend on the experience and ability of inspector for artificial recovery.This article discusses the data recovery method of embedded DVR, and makes an analysis, comparison of a large amount of underlying data and research on the head and tail of frame data, as well as the passage number and data storage methods to realize the recovery of video data.But, as for the crack of information, such as time, that is conducive for us to rapidly search the video data is subject to further analysis and research.