I ran into situation where I need to carve files from failed Hard drive of video surveillance.
PCB fried, but I was able to recover it - by re-soldering faulty diod, but unfortunately surveilance system fried as well, and I am not able to fix it.
So problem - disk is now working but it is not recognized by Autopsy - file system is DHfs 4.1.
Is there anyway how to add unrecognized drive
later I can grep files by header and footer(how fortunate that files have footers :x) )
The problem you have is that Autopsy doesn’t understand DHFS (Dahua). My recommendation would be to image that drive raw (not an EWF .e01) and, after you have a successful image, place it back in the DVR and use the DVR to export the videos. If you don’t have the original DVR or the video is deleted I would recommend a tool such as DVR Examiner. DVR Examiner understand DHFS and will be able to detect and parse your video correctly. You could try DHFS Recovery which is inexpensive but I have no experience with it so I’m not sure how it works.
This is not a fix but a suggestion of a tool that I have personally used on case work.
I’ve used HX-Recovery for this very issue of DHFS file system. The nice part is you can download and run it for free, you just have to pay to recover the data (discount for LE was pretty good at £500 for 3 years).
Thank you for your recommendations! Unfortunately DVR is also fried.
I tried DiskManager from Dahua - it lists files, but some of files are corrupted, and unplayable
So I made dd image, and tomorrow I will run file carver, fortunately for me Dahua dav files have both file headers and footers, I hope carver will understand how files are fragmented across disk.
If for some reason you can’t carve or there are no file header/footer structures (or they are on non-standard offsets), another option I’ve ran in the past is to run mplayer, or ffplay, or vlc, against the entire image to see if it’ll pick up any video streams in the raw .bin image. I’m throwing this out as a last resort technique in case your carve is unsuccessful and you want to see if there is any video in the raw image. I’d use DVR Examiner (or HX-Recovery as mentioned in this thread) first though.
If you want to DM me I might be able to assist you with getting the original DVR back online.
If you remove the hdd and point hx-recovery at it (via a write block) it will recover live and deleted footage.
Alternatively you can image the drive (e01) and point hx-recovery at that too.
Both options will give you the same result.
The dvr unit is not needed for this software.
