VideoImage & Video MetadataRead EXIF, XMP, GPS tags and MP4 atoms with ExifTool and know what each field can proveCCTV / DVR Analysis
Export footage from Hikvision, Dahua and other DVRs with correct times, frames and hashes
- Intermediate
- Online or on campus
- 5 hands-on labs
- 7 modules
About this course
A shop is robbed at night. When the police arrive the next morning, the DVR in the back room holds the only record and it will start overwriting that record within days. Someone has to get the right clips out from the right cameras without changing them and write down how far the DVR clock was from real time. That person is often not a specialist. Mistakes made at that stage cannot be fixed later.
This course teaches that job properly. You learn how DVRs and NVRs store video and why Hikvision and Dahua recorders use their own file systems that a normal PC cannot read. You practise the three ways to get footage out. These are native export from the recorder, export over the network with the vendor's client software and imaging the hard disk for recovery in the lab. You learn to keep the native file with its player, hash every export at the time it is made and note the timestamp offset against a trusted clock.
The second half moves to the lab. You study frame rates, dropped frames and motion-triggered recording, see why transcoding is a problem and make clear stills and clips for court through a documented process. The certificate for electronic records under Section 63 of the Bharatiya Sakshya Adhiniyam, 2023 is covered so that your export can be produced in court.
DVR and NVR extractionProprietary file systemsTimestamp offsetHash on export
After this course you can
- Secure a DVR or NVR at a scene and stop footage being lost to overwriting
- Measure and record the offset between the recorder clock and a trusted time source
- Export footage in its native format with the vendor player and hash it at the time of export
- Image a DVR hard disk and recover footage from Hikvision or Dahua file systems with specialist tools
- Check frame rate, gaps and recording mode before drawing any conclusion about timing or speed
- Prepare stills, clips and notes that support a certificate under Section 63 of the Bharatiya Sakshya Adhiniyam, 2023
Syllabus
7 modules · 27 topics
01How CCTV systems record4 topics
- Analogue and HD cameras with DVRs, IP cameras with NVRs
- Continuous, scheduled and motion-triggered recording
- Main and sub streams, resolution and frame rate settings
- H.264 and H.265 compression and what it does to fine detail
02At the scene4 topics
- Finding the recorder, the cameras that matter and the retention period
- Photographing the recorder screen next to a phone set to network time to note the offset
- Checking time zone and daylight saving settings, especially on imported units
- Deciding between export on site and seizing the recorder
03Native export4 topics
- Exporting through the recorder menu to a clean, wiped USB drive
- Network export with Hikvision iVMS-4200 and Dahua SmartPSS
- Keeping the native file and the vendor player together
- Hashing exports with SHA-256 at the time and recording the values
04Proprietary file systems and disk recovery4 topics
- Why a DVR disk shows as unreadable or unformatted on Windows
- Imaging the disk through a write blocker
- Hikvision and Dahua disk layouts and specialist parsers such as Magnet DVR Examiner
- Recovering deleted or partly overwritten footage and the limits of that recovery
05Timing and frames4 topics
- Nominal frame rate compared with the frames actually recorded
- Dropped frames, gaps and variable frame rate
- On-screen timestamps compared with timestamps in the file
- Why speed estimates need verified frame timing
06Playback, conversion and enhancement4 topics
- Why transcoding changes the evidence and when it is acceptable
- Frame-by-frame review with FFmpeg and Amped FIVE
- Documented enhancement steps such as crop, scale, deinterlace and contrast
- What enhancement cannot do with a small or blurred face
07Reporting and court3 topics
- Stills and clips with frame numbers and source details
- The certificate under Section 63 of the Bharatiya Sakshya Adhiniyam, 2023
- Chain of custody for recorders, disks and USB exports
Hands-on labs
- Lab 1
Export footage from a DVR through its menu, hash the export and fill in a seizure note
- Lab 2
Measure the clock offset of a recorder and correct a timeline of events
- Lab 3
Image a DVR disk and recover clips with a specialist parser
- Lab 4
Find dropped frames and gaps in a clip with FFmpeg and MediaInfo
- Lab 5
Prepare an enhanced still in Amped FIVE with a documented, repeatable workflow
Tools you will use
- Magnet DVR Examiner
- Amped FIVE
- Hikvision iVMS-4200
- Dahua SmartPSS
- FFmpeg and ffprobe
- MediaInfo
- FTK Imager
- Hardware write blocker
Who it suits
- Police officers and cyber cell staff who collect CCTV footage
- Video examiners in government and private laboratories
- Security and loss prevention teams in retail, banking and offices
- Lawyers who deal with CCTV evidence
Before you join
- Basic computer skills
- Evidence handling and hashing basics, or the Basics of Cyber Forensics course
Questions about this course
Can I just record the DVR screen on my phone?
Only as a last resort. If you do, say so in your notes. Filming a screen loses quality, frame timing and the link to the original file. A native export or a disk image is always better.
Why won't the exported file play in VLC?
Many recorders export in a proprietary format or wrap the video in a way standard players handle badly. Keep the native file and use the vendor player that comes with the export. Convert only a working copy and record how you did it.
Can blurry footage be enhanced to read a number plate?
Sometimes, if the detail was captured in the first place. Enhancement can make existing detail clearer. It cannot create pixels the camera never recorded.
More courses in Surveillance & Image / Video Forensics
VideoImage & Video MetadataRead EXIF, XMP, GPS tags and MP4 atoms with ExifTool and know what each field can prove
VideoDeepfake / AI ForensicsExamine face swaps and AI-made media, check C2PA provenance and know where detectors failNot sure this is the right one for you?
Tell us your background and what you want to do next. A counsellor will suggest a course and the next batch.