大华嵌入视频监控系统电子数据恢复技术研究

Data Recovery from Dahua Embedded Video Surveillance System

近些年来多数生产视频监控设备的厂商采用非通用型视频监控系统,导致视频数据恢复困难,本文选取了市场占有率较大的大华视频监控系统进行深入分析,通过解析其视频监控DHFS文件系统的关键参数以及帧格式等信息,实现了在大华监控视频数据被误格式化或者部分覆盖的情况下残缺大华视频监控数据的通道分离与重组,进而完成了对大华视频监控数据的恢复工作。实验结果证明了该技术方法的高效性和准确性,同时也为其它类型的非通用型视频监控文件系统的电子数据取证工作提供建设性的取证鉴定思路。

As surveillance video detection technology is playing an increasingly important role in almost all kinds of cases in the process of probing in recent years, the criminal suspects often use a variety of means to forge or tamper their surveillance videos. Thus, in the field of electronic evidence research, data recovery of non-universal video surveillance system is a hot issue. This paper analyzes a kind of video surveillance system with large market share. Firstly, the critical parameters were resolved, together with the obtainment of the size and arrangement of the video surveillance data block. Secondly, the video frame structure was analyzed in-depth in order to determine which channel a data block belongs to or to acquire video record starting time in the data block. Two corresponding algorithms were presented. Eventually, for the mistakenly formatted or partially covered data, the video surveillance data channel was separated and reorganized, leading to the restoration of the type of video surveillance data. Through the analysis of the data block of arbitrary selection, it confirmed that the key parameters were read out correctly. By comparison of the frame format of the readout channel number with the actual display of the channel number in the monitoring video, the correctness of the frame format was verified. Combined with actual case, the results of the two algorithms proposed in this paper were given and briefly analyzed of their implementation, showing the efficiency and accuracy of the technology, providing some reference for forensic work about electronic data of other non-universal video surveillance. For data search and recovery from non-universal video surveillance, the in-depth study is still necessary, in particular on data fragmentation.