[SOLVED] Data Recover from XVR CCTV WD HDD

[GreenPanda]

Hello everyone ,
I need urgent help with my HDD

My company was asked for a CCTV footage by a local police department.
One of my employees istead of transfer the data in normal way by connecting the Usb to XVR device, disconected
the HDD from it and put in the PC with Windows installed.
He thought the new disk will magically appear under My Computer.

I put the drive back into XVR but now It can't be mounted I only have the format option available.

XVR model : LV-XVR84N
XVR software : XVR_3520DV300_6134C_8_v8.1.11.1

How can I repair the drive or recover the data from it.
Using dmde I was able to get some more info on the drive :

WD WD20PURX-64P6ZY0:80.00A80:WD-WMC4M0E81HWX

LBA:0                  blok: 0
00000000000: 33 C0 8E D0 BC 00 7C 8E  C0 8E D8 BE 00 7C BF 00  3ŔŽĐĽ.|ŽŔŽŘľ.|ż.
00000000010: 06 39 00 00 FC F3 A4 50  68 1C 06 CB FB B9 04 00  .9..üó¤Ph..Ëűą..
00000000020: BD BE 07 80 7E 00 00 7C  0B 0F 85 0E 01 83 C5 10  ˝ľ.€~..|..…..Ĺ.
00000000030: E2 F1 CD 18 88 56 00 55  C6 46 11 05 C6 46 10 00  âńÍ.V.UĆF..ĆF..
00000000040: B4 41 BB AA 55 CD 13 5D  72 0F 81 FB 55 AA 75 09  ´A»ŞUÍ.]r.űUŞu.
00000000050: F7 C1 01 00 74 03 FE 46  10 66 60 80 7E 10 00 74  ÷Á..t.ţF.f`€~..t
00000000060: 26 66 68 00 00 00 00 66  FF 76 08 68 00 00 68 00  &fh....f˙v.h..h.
00000000070: 7C 68 01 00 68 10 00 B4  42 8A 56 00 8B F4 CD 13  |h..h..´BŠV.‹ôÍ.
00000000080: 9F 83 C4 10 9E EB 14 B8  01 02 BB 00 7C 8A 56 00  źÄ.žë.¸..».|ŠV.
00000000090: 8A 76 01 8A 4E 02 8A 6E  03 CD 13 66 61 73 1C FE  Šv.ŠN.Šn.Í.fas.ţ
000000000A0: 4E 11 75 0C 80 7E 00 80  0F 84 8A 00 B2 80 EB 84  N.u.€~.€.„Š.˛€ë„
000000000B0: 55 32 E4 8A 56 00 CD 13  5D EB 9E 81 3E FE 7D 55  U2äŠV.Í.]ëž>ţ}U
000000000C0: AA 75 6E FF 76 00 E8 8D  00 75 17 FA B0 D1 E6 64  Şun˙v.čŤ.u.ú°Ńćd
000000000D0: E8 83 00 B0 DF E6 60 E8  7C 00 B0 FF E6 64 E8 75  č.°ßć`č|.°˙ćdču
000000000E0: 00 FB B8 00 BB CD 1A 66  23 C0 75 3B 66 81 FB 54  .ű¸.»Í.f#Ŕu;fűT
000000000F0: 43 50 41 75 32 81 F9 02  01 72 2C 66 68 07 BB 00  CPAu2ů..r,fh.».
00000000100: 00 66 68 00 02 00 00 66  68 08 00 00 00 66 53 66  .fh....fh....fSf
00000000110: 53 66 55 66 68 00 00 00  00 66 68 00 7C 00 00 66  SfUfh....fh.|..f
00000000120: 61 68 00 00 07 CD 1A 5A  32 F6 EA 00 7C 00 00 CD  ah...Í.Z2öę.|..Í
00000000130: 18 A0 B7 07 EB 08 A0 B6  07 EB 03 A0 B5 07 32 E4  . ·.ë. ¶.ë. µ.2ä
00000000140: 05 00 07 8B F0 AC 3C 00  74 09 BB 07 00 B4 0E CD  ...‹đ¬<.t.»..´.Í
00000000150: 10 EB F2 F4 EB FD 2B C9  E4 64 EB 00 24 02 E0 F8  .ëňôëý+Éädë.$.ŕř
00000000160: 24 02 C3 49 6E 76 61 6C  69 64 20 70 61 72 74 69  $.ĂInvalid parti
00000000170: 74 69 6F 6E 20 74 61 62  6C 65 00 45 72 72 6F 72  tion table.Error
00000000180: 20 6C 6F 61 64 69 6E 67  20 6F 70 65 72 61 74 69   loading operati
00000000190: 6E 67 20 73 79 73 74 65  6D 00 4D 69 73 73 69 6E  ng system.Missin
000000001A0: 67 20 6F 70 65 72 61 74  69 6E 67 20 73 79 73 74  g operating syst
000000001B0: 65 6D 00 00 00 63 7B 9A  00 00 00 00 00 00 00 00  em...c{š........
000000001C0: 02 00 EE FF FF FF 01 00  00 00 FF FF FF FF 00 00  ..î˙˙˙....˙˙˙˙..
000000001D0: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
000000001E0: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
000000001F0: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................

I will be grateful for any help.
Thank you

 

[fzabkar]

If the information is pertinent to a criminal investigation, then the police should have their own data recovery resources.

Otherwise, the first thing I would do is to clone the drive, sector by sector, to a backup HDD, and then work on the backup.

There are no partitions in the partitition table in sector 0, so it does appear that your employee initialised the drive. That said, DVRs often have unique file systems, so this may be normal.

Can you show us DMDE's Partitions window?

 

[GreenPanda]

Hi fzabkar ,
no it's not for criminal investigation they just simply asked if we can give them recording from one day , but now the more important thing for me is to recover the lost data.

Here is the DMDE screenshot :

 

[fzabkar]

It does appear that your employee has initialised the drive. :-(

DVRs tend to use proprietary file systems, so you may need to recover the files in RAW mode. Hopefully they will be contiguous, not fragmented. DVRs also commonly use encryption, so this may be a complication.

I would find a spare 2TB drive, zero fill it, install it in your DVR, and use your DVR to initialise and format it. Then examine its file system with DMDE. If you are lucky, you may only need to copy a few system sectors from the test drive to your patient (or clone).