Real-time video surveillance systems store recorded video using digital video recorders (DVRs) and network video recorders (NVRs). To support continuous high-volume video storage, these devices employ specialized, nonstandard file systems that are often proprietary and undocumented. This lack of documentation significantly increases the time and effort required for forensic analysis. In this study, we analyze an undocumented proprietary file system used by Honeywell video surveillance devices-one that, to the best of our knowledge, has not been examined in prior work-and investigate its deletion mechanisms and demonstrate the feasibility of video recovery after deletion. We perform a file system analysis using a binary diffing technique and evaluate three deletion methods supported by the target device: 1) formatting-based deletion, 2) data expiration, and 3) overwrite. For each method, we investigate changes in file system metadata and on-disk data structures and demonstrate the feasibility of video data recovery. Our findings aim to support more efficient and accurate forensic investigations of Honeywell surveillance products and provide foundational insights into the analysis of proprietary file systems used in video recording devices.

翻译：实时视频监控系统通过数字视频录像机（DVR）和网络视频录像机（NVR）存储录制的视频内容。为支持持续的高容量视频存储，这些设备采用专门的非标准文件系统，此类文件系统通常为专有且未公开。这种文档缺失显著增加了取证分析所需的时间和工作量。本研究分析了一种由Honeywell视频监控设备使用的未公开专有文件系统——据我们所知，该文件系统尚未在先前工作中被研究过——并探究其删除机制，同时论证了删除后视频恢复的可行性。我们采用二进制差异比对技术进行文件系统分析，并评估了目标设备支持的三种删除方法：1）格式化删除，2）数据过期，3）覆写。针对每种方法，我们探究了文件系统元数据及磁盘数据结构的变化，并论证了视频数据恢复的可行性。本研究结果旨在为Honeywell监控产品的更高效、更精确取证调查提供支持，并为视频录制设备中专有文件系统的分析奠定基础性见解。