Help Recovering DVR Footage to catch a robber

[TenYardFight]

My client works for a bank who took over a local business when the owner defaulted on his loan. They were robbed at gunpoint the other night. They don't have the password to the DVR, and they've enlisted my help to get the footage for the police. I removed the HD and mounted it to my machine to look for the files. That looks like it will be successful. Still, I'd like to know how these things work. Can anyone share some information with me? It's not branded my a major manufacturer, though there is a part number I don't have in front of me right now. There are 16 BNC inputs and a single sata 1TB Hard Drive inside.

1.) Most importantly, how can I crack the password?
2.) What type of operating system do these things typically use?
3.) Are they usually FAT or NTFS?

Any other details that can help me help them? Thanks in advance.

[angry_geek]

If it's a known brand, call the manufacturer. They always have a "back door" password just for these situations. If it's a roll your own job, you may be out of luck.

[TenYardFight]

It's definitely not a known brand, thanks though. It only says "Made in China".

[NWPhotog]

Originally Posted by Ten Yard Fight

It's definitely not a known brand, thanks though. It only says "Made in China".

Never hacked a Linux system but sounds like a challenge!

[iisjman07]

"They don't have the password to the DVR"; gonna need more information than that... What type of password is it and when does the box ask for it?

If the password is stored on the DVR, then you could be in luck. If the files are encrypted then you're stuffed.

I've only ever taken apart one linux based DVR system, and it had an unknown file system, so the password may not be as useful as you think. Luckily however, it used typical file types, and so I used file carving tools to locate file headers on the disk, and was able to recover some images. I believe I used Scalpel, Foremost & Photorec.

[TenYardFight]

Thanks. It's not a windows password. It's comes up as an overlay on top of the sixteen screen monitoring station. I removed the drive and slaved it. Disk shows in Disk Management, but the files aren't visible. Trying GDB right now. 90 minutes to go.

[Trenatos]

Correct me if I'm wrong, but if the police got involved, and I assume so since this was at gunpoint, shouldn't the DVR have been handed to the *police technicians* as part of evidence?

[TenYardFight]

At least in this instance, that's not how the police handled it. The police "tried" to access the DVR and failed themselves. They probably didn't assign their crack techs to it (=

ETA: That's exactly what I'm supposed to do. Burn the appropriate footage to disk so the police can have it.

[cmonova]

Originally Posted by Trenatos

Correct me if I'm wrong, but if the police got involved, and I assume so since this was at gunpoint, shouldn't the DVR have been handed to the *police technicians* as part of evidence?

You would think that...But...last week here at an auto body show one two guys got into it and one took a sander and smashed the other in the head with it and dropped him then proceeded to start railing him.

Owner called me to come get the footage off his cameras. The police were there and I asked them..."why don't you just take the whole system" and they said they don't do that, they just want the footage copied and given to them. Kind of wierd.

[Trenatos]

Wow..
I'm not from here (The US), where I'm from I've never heard of the police not taking the DVR(Or at least the storage media) with them as part of evidence in investigations... That's what I get for assuming things I guess :P

Do you have access to controls such as play, fast forward, rewind, etc.?
If you can't get past the password you could then go super low tech and hook up a recording device to one of the monitor outputs and just record the specific events.