1

I have a network video recorder - the Swann NVR8-7085. It had telnet enabled and I managed to figure out the user/pass to get in (I downloaded the firmware from the site, extracted the squashfs filesystem, and set John the Ripper on /etc/passwd). Once telnet'd in, I started poking around and looking at the mounted partitions. It seems like the disk has a small partition at /dev/sdb1 that holds the BusyBox OS. The rest of the disk is held in /dev/sdb2, which is not mounted nor has any identifiable file system as far as I can tell. It's roughly 992GB, so I think the video files are stored there. Since the device doesn't have a file system nor is it mounted, I'm guessing the DVR software writes raw byte streams to it from the cameras. On /dev/sdb1 there are files that correspond to timestamps of captured video I think:

# pwd
/mnt/sdb/00/2014/10/26
# ls -1
0020141026005959
0020141026020000
0020141026025959
0020141026040000
0020141026050000
0020141026054108
etc...

Those files seem to be where some record of the recorded videos are. But they're not easily readable. I opened them up in a hexeditor and I'm not sure what to look for. I'm happy to share one but it's a few KB. Not sure if I should copy-paste it here. Any suggestions where to go from here?

  • If you can: remove the disk from the DVR, attach it to a PC, copy the files from /dev/sdb1 to the PC, dd /dev/sdb2 to an image file. Put the disk in the DVR, record a few seconds. Attach the disk to the PC again, check which file is new on /dev/sdb1, and check which blocks of /dev/sdb2 have changed. Try if you can match the changed block numbers to contents of the new file. – Guntram Blohm Nov 25 '14 at 17:28
  • How would I be able to tell which blocks changed? – savoyardal Nov 25 '14 at 19:05
  • The easiest (read: need no tools that you don't already have in linux) way would just be cmp -l /dev/sdb2 /path/to/saved/dump. Or, get as fancy as you want by using dd to pipe separate parts of the files to md5sum and compare the hashes. – Guntram Blohm Nov 25 '14 at 19:38
  • Will that also tell me the addresses of the changed blocks? I am suspicious that the timestamp files are a list of blocks where the parts of the video are found. Like a custom file system of sorts. But I can't find any sort of pattern. I would think a list of blocks would tell me which blocks, or a list of block pairs would tell me a range of blocks. – savoyardal Nov 25 '14 at 20:01
  • cmp -l will tell you the addresses of the changed bytes. Divide them by 512 to get the block numbers. Of course, if they implemented their own file system, they might use 1024 byte logical blocks as well. Or 4096 bytes. They might encrpyt the timestamp files. The whole /dev/sdb might be an encrypted partition. The whole process can be anywhere from "quite easy" to "very hard", and might require you to disassemble & understand the binaries and libraries in the end; for starters, it's just "rule out the easy options". – Guntram Blohm Nov 25 '14 at 20:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.