FORENSIC RECOVERY OF VIDEO EVIDENCE FROM DAHUA DHFS4.1 SURVEILLANCE SYSTEMS AFTER FORMATTING
DOI:
https://doi.org/10.37943/FXNG8769%20Keywords:
digital forensics, video recovery , Dahua DHFS4.1 , signature validation , post-formatting recoveryAbstract
Video footage from proprietary surveillance systems is central to criminal investigations, yet its forensic recovery remains poorly supported. Conventional carving fails on Dahua systems because the proprietary DHFS4.1 file system uses frame encapsulation, header-footer validation pairs and embedded checksums. This paper addresses two open questions: how each of the four DHFS4.1 validation levels affects the false discovery rate (FDR) and recovery rate, and how quick formatting and partial bulk zero-fill overwriting differ in their impact on recovery. The technique combines dual-signature frame validation, frame-size and checksum consistency checking, and adaptive time sequencing, extending our earlier pipeline; the principal contribution is the validation-level ablation, the paired comparison against three independent tools, and the partial-overwrite study. All methods were executed on forensic images of eleven Dahua NVR hard drives acquired behind a hardware write blocker, so every comparison is paired within drive. The proposed method achieved a recovery rate (RR) of 88.0%, a temporal accuracy (TA) of 89.0% and a file-level FDR of 4.0%; four-level validation reduced the frame-level FDR 13.5-fold, from 27.0% (single signature) to 2.0%, at the cost of a 3.2-percentage-point drop in RR. The RR advantage over each compared tool was statistically significant (paired-samples t-test, n = 11, p < 0.05) and confirmed by the Wilcoxon signed-rank test. Quick formatting still permitted 76% recovery, whereas bulk zero-fill reduced it to 34% and raised the file-level FDR to 41%; a collision analysis shows that this increase stems from payload fragmentation rather than chance signature matches. Within the tested scope, the methodology performs comparably to commercial tools and, because every decision rule is published, is re-implementable and transparent. The findings offer practical guidance for prioritising evidence collection from Dahua surveillance systems.
References
MarketsandMarkets. (2025, November). Video surveillance market size, share & analysis, 2031. https://www.marketsandmarkets.com/Market-Reports/video-surveillance-market-645.html
Grand View Research. (n.d.). Video surveillance market size & share report, 2026–2033. Retrieved September 21, 2026, from https://www.grandviewresearch.com/industry-analysis/video-surveillance-market-report
Memoori Research. (2026, June 16). Video surveillance market leaders 2026 compared side-by-side. https://memoori.com/video-surveillance-market-leaders-2026/
Karbayeva, D. (2026, April 29). Bolee 27 tysyach kamer v Kazakhstane osnashcheny elementami II – MVD [More than 27,000 cameras in Kazakhstan are equipped with AI elements – Ministry of Internal Affairs]. Kazinform. https://www.inform.kz/ru/bolee-27-tisyach-kamer-v-kazahstane-osnasheni-elementami-ii-mvd-a5f490
Brookman, F., & Jones, H. (2022). Capturing killers: The construction of CCTV evidence during homicide investigations. Policing and Society, 32(2), 125–144. https://doi.org/10.1080/10439463.2021.1879075
Jung, Y., & Wheeler, A. P. (2023). The effect of public surveillance cameras on crime clearance rates. Journal of Experimental Criminology, 19(1), 143–164. https://doi.org/10.1007/s11292-021-09477-8
Rzayeva, L., Shayakhmetov, M., Atanbayev, Y., Budenov, R., & Mutaher, H. (2025). Automated forensic recovery methodology for video evidence from Hikvision and Dahua DVR/NVR systems. Information, 16(11), 983. https://doi.org/10.3390/info16110983
Dragonas, E., Lambrinoudakis, C., & Kotsis, M. (2024). IoT forensics: Exploiting log records from the DAHUA technology CCTV systems. Journal of Forensic Sciences, 69(1), 117–130. https://doi.org/10.1111/1556-4029.15401
Altinisik, E., & Sencar, H. T. (2021). Automatic generation of H.264 parameter sets to recover video file fragments. IEEE Transactions on Information Forensics and Security, 16, 4857–4868. https://doi.org/10.1109/TIFS.2021.3118876
van der Meer, V., van den Bos, J., Jonker, H., & Dassen, L. (2024). Problem solved: A reliable, deterministic method for JPEG fragmentation point detection. Forensic Science International: Digital Investigation, 48, 301687. https://doi.org/10.1016/j.fsidi.2023.301687
Mittal, G., Korus, P., & Memon, N. (2021). FiFTy: Large-scale file fragment type identification using convolutional neural networks. IEEE Transactions on Information Forensics and Security, 16, 28–41. https://doi.org/10.1109/TIFS.2020.3004266
Forensic Focus. (2016–2021). Forensic video data recovery tools for CCTV DVRs [Online forum thread]. https://www.forensicfocus.com/forums/general/forensic-video-data-recovery-tools-for-cctv-dvrs/
Fegan, J. (2025, January 28). Challenges in recovering data from modern surveillance systems. Envista Forensics. https://www.envistaforensics.com/knowledge-center/insights/articles/challenges-in-recovering-data-from-modern-surveillance-systems/
Hu, H. (2025, April 30). How VIP2.0 enhances video forensics. SalvationDATA. https://www.salvationdata.com/product-tips/how-vip2-0-enhances-video-forensics/
Richard, G. G., III, & Marziale, L. (n.d.). Scalpel [Computer software]. The Sleuth Kit. https://github.com/sleuthkit/scalpel
Yoon, J., & Hwang, S. (2026). Forensic analysis of video data deletion and recovery in Honeywell surveillance file system. Forensic Science International: Digital Investigation, 57, 302116. https://doi.org/10.1016/j.fsidi.2026.302116
Byun, J., Shim, K.-S., & Kim, Y. W. (2026). Video data recovery from slack space of pre-allocated video files. Journal of Forensic Sciences. Advance online publication. https://doi.org/10.1111/1556-4029.70412
Dragonas, E., Lambrinoudakis, C., & Kotsis, M. (2023). IoT forensics: Exploiting unexplored log records from the HIKVISION file system. Journal of Forensic Sciences, 68(6), 2002–2011. https://doi.org/10.1111/1556-4029.15349
Rzayeva, L., Shayakhmetov, M., Konakbayev, O., Jussupova, G. G., Seniushin, I., & Tasbolat, A. (2026). Forensic video recovery from multi-channel analog DVR systems: Channel demultiplexing and temporal reconstruction from interleaved DHAV streams. Information, 17(5), 493. https://doi.org/10.3390/info17050493
International Telecommunication Union. (2026). Advanced video coding for generic audiovisual services (ITU-T Recommendation H.264, 06/2026). https://www.itu.int/rec/T-REC-H.264-202606-I/en
International Telecommunication Union. (2026). High efficiency video coding (ITU-T Recommendation H.265, 01/2026). https://www.itu.int/rec/T-REC-H.265-202601-I/en
Bross, B., Wang, Y.-K., Ye, Y., Liu, S., Chen, J., Sullivan, G. J., & Ohm, J.-R. (2021). Overview of the Versatile Video Coding (VVC) standard and its applications. IEEE Transactions on Circuits and Systems for Video Technology, 31(10), 3736–3764. https://doi.org/10.1109/TCSVT.2021.3101953
Hargreaves, C., Nelson, A., & Casey, E. (2024). An abstract model for digital forensic analysis tools: A foundation for systematic error mitigation analysis. Forensic Science International: Digital Investigation, 48, 301679. https://doi.org/10.1016/j.fsidi.2023.301679
Garrett, B. L., & Rudin, C. (2023). Interpretable algorithmic forensics. Proceedings of the National Academy of Sciences, 120(41), e2301842120. https://doi.org/10.1073/pnas.2301842120
Scientific Working Group on Digital Evidence. (2025). SWGDE best practices for computer forensic examinations (Document 18-F-001, Version 2.0). https://swgde.org/wp-content/uploads/2025/09/2025-07-28-Best-Practices-for-Computer-Forensic-Examinations-18-F-001-2.0.pdf
Downloads
Published
How to Cite
Issue
Section
License
Copyright (c) 2026 Articles are open access under the Creative Commons License
This work is licensed under a Creative Commons Attribution-NonCommercial-NoDerivatives 4.0 International License.
Authors who publish a manuscript in this journal agree to the following terms:
- The authors reserve the right to authorship of their work and transfer to the journal the right of first publication under the terms of the Creative Commons Attribution License, which allows others to freely distribute the published work with a mandatory link to the the original work and the first publication of the work in this journal.
- Authors have the right to conclude independent additional agreements that relate to the non-exclusive distribution of the work in the form in which it was published by this journal (for example, to post the work in the electronic repository of the institution or publish as part of a monograph), providing the link to the first publication of the work in this journal.
- Other terms stated in the Copyright Agreement.