Automated Forensic Recovery Methodology for Video Evidence from Hikvision and Dahua DVR/NVR Systems
Rzayeva L. Shayakhmetov M. Atanbayev Y. Budenov R. Mutaher H.
November 2025Multidisciplinary Digital Publishing Institute (MDPI)
Information (Switzerland)
2025#16Issue 11
Digital video surveillance systems are now common in the security infrastructure of modern times, but proprietary file systems provided by large manufacturers are a major challenge to the work of the forensic investigator. This paper proposes a forensic recovery methodology of Hikvision and Dahua surveillance systems by utilizing three major innovations: (1) adaptive temporal sequencing, which dynamically changes gap detection thresholds; (2) dual-signature validation with header–footer matching of DHFS frames; and (3) automatic manufacturer identification. The strategy puts into practice direct binary analysis of proprietary file systems, frame-based parsing and automatic video reconstruction. Testing on 27 surveillance hard drives showed a recovery rate of 91.8, a temporal accuracy of 96.7% and a false positive rate of 2.4%—the lowest of the tools tested with statistically significant improvements over commercial tools (p < 0.01). Better results with fragmented streams (87.2 vs. 82.4% with commercial tools) meet key forensic needs of determining valid evidence chronology. The open methodology offers the necessary algorithmic transparency to be court-admissible, and the automated MP4 conversion with metadata left intact makes the integration of forensic workflow possible. The study provides a scientifically validated approach to proprietary surveillance formats, which evidences technical innovativeness and practical usefulness to digital forensics investigations.
adaptive temporal sequencing , binary analysis , Dahua , digital forensics , dual-signature validation , DVR forensics , evidence extraction , forensic methodology , Hikvision , proprietary file systems , surveillance systems , video recovery
Text of the article Перейти на текст статьи
Research and Innovation Center “CyberTech”, Astana IT University, Astana, 010000, Kazakhstan
TSARKA Group, Astana, 010000, Kazakhstan
Department of Computer Science, Birmingham City University, Birmingham, B4 7XG, United Kingdom
Research and Innovation Center “CyberTech”
TSARKA Group
Department of Computer Science
10 лет помогаем публиковать статьи Международный издатель
Книга Публикация научной статьи Волощук 2026 Book Publication of a scientific article 2026