# Identifying Desired Timestamps in Carved Digital Video Recorder Footage

Divam Lehri, Anyesh Roy

► To cite this version:

Divam Lehri, Anyesh Roy. Identifying Desired Timestamps in Carved Digital Video Recorder Footage. 18th IFIP International Conference on Digital Forensics (DigitalForensics), Jan 2022, Virtual, United States. pp.141-152, 10.1007/978-3-031-10078-9_8. hal-05315735

HAL Id: hal-05315735

https://inria.hal.science/hal-05315735v1

Submitted on 15 Oct 2025

HAL is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_1.png" /></figure>
<figure><img src="image_2.png" /></figure>

ifip

International Federation for Information Processing

This document is the original author manuscript of a paper submitted to an IFIP
conference proceedings or other IFIP publication by Springer Nature. As such, there
may be some differences in the official published version of the paper. Such
differences, if any, are usually due to reformatting during preparation for publication or
minor corrections made by the author(s) during final proofreading of the publication
manuscript.
Chapter 8

IDENTIFYING DESIRED TIMESTAMPS
IN CARVED DIGITAL VIDEO RECORDER
FOOTAGE

Divam Lehri and Anyesh Roy

**Abstract** Closed-circuit television cameras conduct round-the-clock surveillance to capture video evidence of illegal activities and suspects. The camera outputs are processed and stored on hard drives in standalone digital video recorders. As closed-circuit television cameras operate continuously, video files are constantly stored on the hard drives, with the new files periodically overwriting older files. The partially-overwritten files, which are present in slack space, can be recovered via data carving. However, the majority of the recovered video files are often fragmented. Unlike a normal video stream, a recovered video stream comprises frames that are not in chronological order. As a result, it is very tedious for a digital forensic professional to manually locate frames of interest.

This chapter describes a method for identifying timestamps in carved
digital video recorder footage. Experimental results using a Python
implementation demonstrate the efficiency of timestamp identification
and its effectiveness at recreating video footage.

**Keywords:** CCTV forensics, Digital video recorder, file carving, timestamps

1. Introduction

Closed-circuit television (CCTV) cameras perform round-the-clock
surveillance and store video footage on digital video recorder hard drives.
Recovering video footage from digital video recorders is challenging due
to their proprietary filesystems and video file formats. The inability of
standard media players to decode and play videos with proprietary file
formats also hinders investigations. Digital forensic professionals often
have a hard time searching for and downloading media players in the
hope of playing videos with odd file formats. The use of non-standard
container formats for videos also means that common video repair utilities are of little use in dealing with corrupted videos [11].

The video files on a digital video recorder hard drive are fragmented because they are stored as blocks in a non-contiguous manner for better memory utilization [13]. Park and Lee [10] have shown that data fragments are stored in unused areas of a digital video recorder filesystem. Additionally, because a closed-circuit television camera operates continuously, video footage files are constantly stored on the hard drive. A digital video recorder is often configured to perform automatic overwriting by default after a specific period of time or when the storage capacity limit is reached. As a result, new video files overwrite the older files on the hard drive.

Overwritten files, deleted files and files in proprietary formats can be recovered via data carving. The advantage of data carving over traditional recovery techniques is that it is independent of the filesystem. However, the majority of recovered video files are fragmented and most file carvers are not robust enough to handle even small amounts of fragmentation [2].

A digital video recorder typically has a high-capacity hard drive ranging from 1 TB to 6 TB. As a result, large numbers of video files are recovered after carving. When a digital video recorder begins to overwrite footage in previous blocks, the earliest footage is in the top block and the latest footage is in the bottom block. Additional overwriting leads to the earliest footage being located below the latest footage, which provides unexpected results during file carving [4, 9]. Also, the carved files are often corrupted or have unordered frames.

In normal closed-circuit television camera footage, a video file contains frames with timestamps in chronological order. However, this is not the case with carved footage because multiple video fragments reside in slack space. As a result, a carved video file has frames with unordered event timestamps and interrupted channel sequences.

Figure 1 shows consecutive frames from a carved video file from a digital video recorder. The first frame on the left occurs in the video at duration 4:10 with event timestamp 20/04/2020 23:46:46 Channel:CAM2. The next frame on the right occurs at duration 4:11 with event timestamp 08/05/2020 15:08:01 Channel:CAM7.

Carved fragments must be restructured and merged to create a complete video file. In such situation, a digital forensic professional has to manually play every video file on the digital video recorder to search for footage with the desired date-time values. A video clip of just a few minutes can have several hundred frames. As a result, it is very tedious
<figure><img src="image_3.png" /><figcaption>*Figure 1.* Consecutive frames from a carved video file.</figcaption></figure>

for a digital forensic professional to manually locate and reorder frames
to recreate video footage.

This chapter describes a method for identifying timestamps in carved
digital video recorder footage. Experimental results using a Python
implementation demonstrate the efficiency of timestamp identification
and its effectiveness at recreating video footage.

## 2. Related Work

Digital forensics research has focused on recovering overwritten fragments from digital video recorders, but most research efforts involve manual reverse engineering of the filesystems, which is time-consuming and requires significant knowledge about the filesystems, video formats and codecs. Several forensic tools leverage databases containing signatures of known video formats to eliminate the manual determination of the filesystem structure prior to data carving. Some tools, notably Magnet DVR Examiner [9] and FTK Custom Carver [5], support a variety of proprietary video formats. However, the identification of video footage timestamps at the byte level is a complex task and poses several challenges to digital forensic professionals.

Griffin et al. [1] developed a technique for carving video files with timestamps from digital video recorders that use proprietary file formats. The technique examines a cloned copy of a digital video recorder hard drive in hexadecimal format and probes for file signatures. The signatures of the video header, video footer, channel and event timestamp (date and time) are identified by searching for repeating patterns in the bytes of a video file. A desired event timestamp is located by decoding it to a Unix 32-bit timestamp and then converting it to the hexadecimal format. Following this, the hard drive is searched for the hexadecimal bytes. For example, the event timestamp `20/04/2020 23:46:46` is decoded to the Unix timestamp `1587426406`, which is converted to hexadecimal `0x66\0x34\0x9E\0x5E` (little endian).
Van Dongen [15] published a case study involving the recovery of overwritten videos in a Samsung digital video recorder using database file (DB) signatures. An image of the digital video recorder hard drive was created and processed using FTK. The filesystem turned out to be the Linux-based ext3, which is recognized by FTK. Analysis revealed that, due to its proprietary video format, the MPEG-STREAM file found in one of the partitions could not be played using a standard player and no information about the header was available. Database (DB) files in another partition were found to serve as bookkeeping records for the video footage and contained pointers to locations in the MPEG-STREAM file. Van Dongen examined the structure of the DB file signatures and attempted to recover overwritten fragments of the files in unallocated space to recover the overwritten video recordings.

Interpreting file data structures, headers and footers to recover files is referred to as manual carving. Manual data carving requires considerable time and knowledge about the filesystem, video format and codec. Such carving is hindered by the fact that most digital video recorders have proprietary filesystems without any documentation.

Other challenges are determining the byte order (little or big endian), limited knowledge of video file signatures at the byte level and finding media players that support proprietary file formats. Moreover, standard filesystems contain hexadecimal flags for partition types that are located in the master boot record. Sector 0 of a drive contains its master boot record, which has a simple code between hexadecimal 1BE and 1FF (decimal 446 to 511) that indicates the partition type [3]. Many digital video recorders do not have a hexadecimal flag and, even if a flag is present, it may not be identifiable because the filesystem is proprietary. For example, Gomm et al. [6] discovered that a Ganz digital video recorder hard drive does not contain a magic marker, indicating that it does have an industry-recognized filesystem. Additionally, when video files are fragmented, additional effort is required to parse and restructure the video footage, which are difficult to do manually.

This research stands out from related work in that it identifies timestamps in the video frames of carved digital video recorder files at the pixel level instead of the byte level.

### 3. Method and Implementation

The method for identifying timestamps extracts frames from carved digital video recorder files and records when the frames appear in the video. After all the frames from a video are extracted, optical character recognition (OCR) is applied to each frame to retrieve the date and time
<figure><img src="image_4.png" /><figcaption>Figure 2. Detailed method workflow.</figcaption></figure>

information contained in the frame. The method also reconstructs videos in situations where carved videos have corrupted headers or proprietary codecs. The reconstructed videos can then be replayed by a standard media player. Third-party applications such as Stellar Video Repair [14] and Yodot MOV Repair [16] may be used in conjunction with the method to repair corrupted videos. If a video has low resolution or poor quality, it is necessary to execute various image enhancement operations such as grayscaling and de-noising the extracted frames.

The method is implemented in Python (version 3.7.5). It works in conjunction with the FFmpeg library (version N-100029) and EasyOCR Python module (version 1.2.5.1). The EasyOCR Python module for performing optical character recognition is available at [12]. Image enhancement operations are provided by the Python OpenCV library.

The Python script, which provides a command line interface, executes on Windows, Macintosh and Linux machines. The script supports multiple instances, enabling multiple video files to be processed simultaneously. To achieve the best performance, a computing system with a CUDA-powered graphics processing unit is recommended. The script has been evaluated on an EDAS FOX forensic workstation with 12 Core Intel Xeon 2.4 GHz processors, 64 GB RAM, NVIDIA GEForce GTX 750 Ti Graphics Card and running the Windows 10 Pro operating system.

# 4. Detailed Method Workflow

Figure 2 shows the detailed method workflow. The video files retrieved after carving are supplied as inputs to the Python script. If the script is unable to process the input video file, it throws an error and the video
<figure><img src="image_5.png" /><figcaption>Figure 3. Frames out90.png (left), out91.png (center) and out92.png (right).</figcaption></figure>

file undergoes reconstruction; otherwise, the frames from the input video file are extracted. During frame extraction, the script simultaneously captures the time duration at which each frame occurs in the video file. The time duration values are used to name the extracted frames.

Figure 3 shows frames named out90.png, out91.png and out92.png based on their durations in the video. The video frame rate must be known in order to interpret their durations. In the example, the video frame rate is one frame per second. Thus, the frame named out90.png has a duration of 90/1 = 90 seconds, which means that it appears 1 minute and 30 seconds into the video.

Naming frames in this manner renders the search for frames highly efficient. Also, a digital forensic professional does not have to watch an entire video when a frame with the desired timestamp is found via optical character recognition because the duration at which the frame appears in the video is already known.

Video reconstruction is required when video files are unplayable due to their proprietary formats or missing or corrupted header structures. The reconstruction procedure is performed in a forensically-sound manner, ensuring that all the frames in the original video are preserved.

Video reconstruction involves two approaches: (i) video conversion or (ii) frame re-stitching:

* **Video Conversion:** Video conversion transforms the raw bit-stream (H.264 format) extracted from an unplayable video file to a container format. A custom frame rate can be specified when converting the video to the container format. The container serves as a wrapper that encapsulates the raw bitstream along with other bundled elements such as the codec, metadata and, most importantly, header structures. A video file is playable upon conversion because it is equipped with a new container with all the necessary structures. If the header structures are missing, a video cannot be decoded and is, therefore, unplayable.

Figures 4 and 5 show the differences between carved and normal videos with the same container format. Figure 4 shows the hexa-
<figure><img src="image_6.png" /><figcaption>Figure 4. Hexadecimal view of a carved video file in the RMF container format.</figcaption></figure>

decimal view of a carved video file in the RMF container format. Although, the first byte contains the RMF structure, all the other header structures are missing, which renders the video unplayable. In contrast, the normal video file in Figure 5 is playable because it has all the RMF file header structures (RMF, PROP, CONT, MDPR and DATA).

* **Frame Re-Stitching:** Frame re-stitching extracts frames from a damaged video file and constructs a new video file, preferably in the MP4 format, from the extracted frames. As in the case of video conversion, a custom frame rate can be specified when converting a video to the MP4 format. Frame extraction employs the FFmpeg library, following which the script applies optical character recognition to the extracted frames.

The optical character recognition output has the Python list data type, which contains the frame timestamp and channel number, and other text content in the frame along with a confidence level.
<figure><img src="image_7.png" /><figcaption>Figure 5. Hexadecimal view of a normal video file in the RMF container format.</figcaption></figure>

The list can be sliced to simplify the output. The timestamp values from the list are then saved in a text file. Performing string searches with the desired event timestamps in the text file reveals whether or not the input video file contains frames with the desired timestamps.

## 5. Experimental Results

The experiments employed a TVT TD-2116TS digital video recorder with a 2 TB hard drive. The hard drive was imaged using the Ditto DX forensic tool in the E01 compression format and the image was processed using FTK. The disk image emerged as unallocated space in FTK, indicating that the filesystem was proprietary and unrecognizable by FTK. Nevertheless, FTK custom carvers were imported to carve the video files. Specifically, the signatures of well-known video formats were added to the custom carver and the maximum file size was set to 2 GB. The carving, which took around two hours to complete, yielded 658 video files, each of size 2 GB.
<figure><img src="image_8.png" /><figcaption>Figure 6. User interaction with the Python script.</figcaption></figure>

The carved files were exported from FTK and saved on the computing system. However, attempts to play the videos on VLC and Windows media players resulted in errors. Upon searching for and trying other media players, it was discovered that the PotPlayer [7] could decode and play the videos. However, the timeline bars were missing during playback, possibly because some file structures were overwritten. Since the videos did not require reconstruction, frame extraction was performed as detailed in the previous section.

The Python implementation was applied to a digital video recorder with a different make and model to further validate its accuracy and functionality. In this case, a Hikvision DS-7A0BHGHI digital video recorder with a 1 TB hard drive was employed. The hard drive was imaged in the E01 compressed format and the image was processed using FTK. The image could be read by FTK because most Hikvision digital video recorders use Linux filesystems that are supported by FTK. File carving took about 1.5 hours and yielded 302 videos. The videos were playable on a VLC media player. However, five videos, which could not be reconstructed, were unplayable.

Frames were extracted from all the playable videos. Figure 6 shows a user interaction with the Python script. The script takes the path of the extracted frames as input and provides an alert when all the frames have been scanned.

Optical character recognition applied to the extracted frames yielded the output text file shown in Figure 7. The output text file contains the timestamps of all the frames along with the file names, which indicate the times (in seconds) of their occurrences in the video footage.

Experiments were conducted to evaluate the speed and accuracy of the Python implementation. The script, which was executed on the EDAS FOX forensic workstation described above, required 4 hours and 34 minutes to complete optical character recognition on 5,700 frames extracted from carved video footage. The workstation supported the execution of four instances of the script at a time. The execution of multiple instances of the script simultaneously on two forensic workstations
<table><caption>Figure 7. Output text file with frame timestamps and file names.</caption><tr><td>20/04/2020</td><td>23:54:50</td><td>out437.png</td></tr><tr><td>20/04/2020</td><td>23:54:51</td><td>out438.png</td></tr><tr><td>20/04/2020</td><td>23:54:52</td><td>out439.png</td></tr><tr><td>20/04/2020</td><td>23:54:53</td><td>out440.png</td></tr><tr><td>20/04/2020</td><td>23:46:36</td><td>out441.png</td></tr><tr><td>20/04/2020</td><td>23:46:37</td><td>out442.png</td></tr><tr><td>20/04/2020</td><td>23:46:38</td><td>out443.png</td></tr><tr><td>20/04/2020</td><td>23:46:39</td><td>out444.png</td></tr><tr><td>20/04/2020</td><td>23:46:40</td><td>out445.png</td></tr><tr><td>20/04/2020</td><td>23:46:41</td><td>out446.png</td></tr><tr><td>20/04/2020</td><td>23:46:42</td><td>out447.png</td></tr><tr><td>20/04/2020</td><td>23:46:43</td><td>out448.png</td></tr><tr><td>20/04/2020</td><td>23:46:44</td><td>out449.png</td></tr><tr><td>20/04/2020</td><td>23:46:45</td><td>out450.png</td></tr><tr><td>20/04/2020</td><td>23:46:46</td><td>out451.png</td></tr><tr><td>20/04/2020</td><td>23:46:47</td><td>out452.png</td></tr><tr><td>08/05/2020</td><td>15:08:01</td><td>out453.png</td></tr><tr><td>08/05/2020</td><td>15:08:02</td><td>out454.png</td></tr><tr><td>08/05/2020</td><td>15:08:03</td><td>out455.png</td></tr><tr><td>08/05/2020</td><td>15:08:04</td><td>out456.png</td></tr><tr><td>08/05/2020</td><td>15:08:05</td><td>out457.png</td></tr><tr><td>08/05/2020</td><td>15:08:06</td><td>out458.png</td></tr><tr><td>08/05/2020</td><td>15:08:07</td><td>out459.png</td></tr><tr><td>08/05/2020</td><td>15:08:08</td><td>out460.png</td></tr><tr><td>08/05/2020</td><td>15:08:09</td><td>out461.png</td></tr><tr><td>08/05/2020</td><td>15:08:10</td><td>out462.png</td></tr><tr><td>08/05/2020</td><td>15:08:11</td><td>out463.png</td></tr><tr><td>08/05/2020</td><td>15:08:12</td><td>out464.png</td></tr><tr><td>08/05/2020</td><td>15:08:13</td><td>out465.png</td></tr></table>

tions took around five days to complete optical character recognition on 302 videos.

## 6. Conclusions

Recovering video footage from digital video recorders is hindered by their proprietary filesystems and video file formats. Unlike a normal video stream, carved video files are typically fragmented, comprising frames with unordered event timestamps and interrupted channel sequences. As a result, it is very tedious for digital forensic professionals to manually locate and reorder frames to recreate video footage.

The method described in this chapter identifies timestamps in carved digital video recorder footage at the pixel level instead of at the byte level. Specifically, it uses optical character recognition to capture timestamps and channel numbers present on frames, and automates the task of searching for desired timestamps when recreating video footage.

Experimental results using the Python implementation demonstrate the efficiency and effectiveness of the method. The Python implemen-
tation, which is open source and executes on Windows, Macintosh and Linux platforms, can handle carved video files from digital video recorders of diverse makes and models. The implementation is currently being used in a law enforcement laboratory, where it significantly reduces the time and effort needed to recover video footage in criminal investigations. To increase its dissemination and use, the codebase is published under an Apache 2.0 license and is available at SourceForge [8].

Although image processing techniques are integrated in the Python implementation and are customizable based on the noise and lightning present in video footage, low quality images reduce the accuracy of optical character recognition of video frame data and, thus, the efficacy of recreating video footage. Future research will attempt to employ deep learning techniques to enhance optical character recognition accuracy.

## References

[1] A. Griffin, J. Slay and K. Choo, Data recovery from proprietary formatted CCTV hard disks, in *Advances in Digital Forensics IX*, G. Peterson and S. Shenoi (Eds.), Springer, Berlin Heidelberg, Germany, pp. 213–223, 2013.

[2] M. Ashraf, Forensic Multimedia File Carving, Master's Thesis, Department of Computer and Systems Sciences, School of Information and Communication Technology, KTH Royal Institute of Technology, Stockholm, Sweden, 2012.

[3] Datarecovery.com, Hexadecimal Flags for Partition Type, Edwardsville, Illinois (www.datarecovery.com/rd/hexadecimal-flags-for-partition-type/#:%7E text=Hexadecimal%20flags%20are%20values%20that,the%20hexadecimal%20flags%20listed%20below.), July 23, 2014.

[4] DME Forensics, Inaccessible data recovery with DVR Examiner, Golden, Colorado (dmeforensics.com/inaccessible-data-recovery-dvr-examiner), 2019.

[5] Exterro, Custom Carvers, Portland, Oregon (support.errro.com/support/solutions/articles/69000765593-custom-carvers), 2022.

[6] R. Gomm, N. Le-Khac, M. Scanlon and M. Kechadi, An analytical approach to the recovery of data from 3rd party proprietary CCTV filesystems, *Proceedings of the Fifteenth European Conference on Cyber Warfare and Security*, pp. 117–126, 2016.

[7] Kakao, Global PotPlayer, Jeju-si, South Korea (potplayer.daum.net), 2022.
[8] D. Lehri, CCTV Frame Timestamp Extractor, SourceForge (www.sourceforge.net/projects/carvedvrtimestamps), 2021.

[9] Magnet Forensics, Magnet DVR Examiner, Herndon, Virginia (www.magnetforensics.com/products/magnet-dvr-examiner), 2022.

[10] J. Park and S. Lee, Data fragment forensics for embedded DVR systems, *Digital Investigation*, vol. 11(3), pp. 187-200, 2014.

[11] N. Poole, Q. Zhou and P. Abatis, Analysis of CCTV digital video recorder hard disk storage system, *Digital Investigation*, vol. 5(3-4), pp. 85-92, 2009.

[12] rkcosmos, EasyOCR, GitHub (github.com/JaidedAI/EasyOCR), July 8, 2021.

[13] SalvationDATA Technology, [Case study] DVR forensics: Fragmented files (overwritten video clips) come alive with SalvationDATA patented technology, *SalvationDATA Blog*, Chengdu, China, September 27, 2019.

[14] Stellar Data Recovery, Video Repair Tool, Metuchen, New Jersey (www.stellarinfo.com/disk-recovery/video-repair.php), 2022.

[15] W. van Dongen, Case study: Forensic analysis of a Samsung digital video recorder, *Digital Investigation*, vol. 5(1-2), pp. 19-28, 2008.

[16] Yodot Software, Yodot Video Repair Software, Mountain View, California (www.yodot.com/video-repair.html), 2022.