I have a network video recorder - the Swann NVR8-7085. It had telnet enabled and I managed to figure out the user/pass to get in (I downloaded the firmware from the site, extracted the squashfs filesystem, and set John the Ripper on /etc/passwd). Once telnet'd in, I started poking around and looking at the mounted partitions. It seems like the disk has a small partition at
/dev/sdb1 that holds the BusyBox OS. The rest of the disk is held in
/dev/sdb2, which is not mounted nor has any identifiable file system as far as I can tell. It's roughly 992GB, so I think the video files are stored there. Since the device doesn't have a file system nor is it mounted, I'm guessing the DVR software writes raw byte streams to it from the cameras. On
/dev/sdb1 there are files that correspond to timestamps of captured video I think:
# pwd /mnt/sdb/00/2014/10/26 # ls -1 0020141026005959 0020141026020000 0020141026025959 0020141026040000 0020141026050000 0020141026054108 etc...
Those files seem to be where some record of the recorded videos are. But they're not easily readable. I opened them up in a hexeditor and I'm not sure what to look for. I'm happy to share one but it's a few KB. Not sure if I should copy-paste it here. Any suggestions where to go from here?