VideoHelp Forum
+ Reply to Thread
Results 1 to 13 of 13
Thread
  1. Member
    Join Date
    Oct 2014
    Location
    United States
    Search Comp PM
    I have been told a DVD we need the data from has a FAT 32 error.

    But check this out, The agency who makes this claim, of an error, has an IT guy.

    The system that allegedly recorded this video is a DATA 911 system. The DATA 911 system is allegedly a flash drive system.

    I have my doubts, but lets go with what they are telling me.

    If you are using a different system, than the DATA 911 system, can you view the DVD that was supposedly copied from the flash drive? We are being told the DVD is corrupt/FAT 32 error.

    Or are they simply just using a different system that is not compatible with the DATA 911 system?
    Quote Quote  
  2. Member Cornucopia's Avatar
    Join Date
    Oct 2001
    Location
    Deep in the Heart of Texas
    Search PM
    DVDs do NOT use FAT, FAT32, nor exFAT as their filesystem. They use UDF, and additionally, possibly also ISO9660, maybe RockRidge or Joliet.

    If there is a "FAT32 error", it is when they are trying to copy FROM their source storage TO the DVD disc.

    Whether things are viewable or not is a totally different matter from whether you are getting a filesystem error or not. How do they say that the data is recorded into THEIR system? If they use a common, industry-standard container + codecs AND if it is not encrypted, it shouldn't be difficult at all. But that's a lot of IFs.

    You and They need to be clearer about the setup & the process. PM me if necessary.

    Scott
    Quote Quote  
  3. Member
    Join Date
    Oct 2014
    Location
    United States
    Search Comp PM
    My understanding is the DATA 911 system is Flash drive system, which from reading other threads uses a FAT32 system. The IT guy is supposed to copy the video from the Flash drive/Fat 32 system, but claims there is an error message. That being a "FAT 32 error".

    Shouldn't an IT guy know how to transfer data from a flash drive to a DVD, All we want is a copy we can play on a normal player.

    Supposedly the DATA 911 system is encrypted, but it is his system, he knows his system.

    Is there something called a FAT 32 error message. Or is it just a reference to the IT person as to which system he needs to use to copy the data?
    Quote Quote  
  4. I'm a Super Moderator johns0's Avatar
    Join Date
    Jun 2002
    Location
    canada
    Search Comp PM
    Sounds like a problem with the flash drive having the file encrypted.
    I think,therefore i am a hamster.
    Quote Quote  
  5. Member Cornucopia's Avatar
    Join Date
    Oct 2001
    Location
    Deep in the Heart of Texas
    Search PM
    "IT guy" covers a whole lot of technology categories. Very few know EVERYTHING. But even a layperson can transfer data from flash to DVD, as long as they know the proper steps required for their version of the process.

    "FAT32" is a whole filesystem. There are THOUSANDS of fat32 error messages...You need more detailed info than that.

    Assuming it IS the actual "data911" brand, the video is likely a 1280x720p30 AVC (in MP4?) file. As long as the video is not encrypted (which for security & privacy-sake, I WOULD expect it to be), it should be able to be easily viewed elsewhere. I note that it uses 64GB SD cards (and higher). This means, it should NOT be using FAT32 at all, as 64GB+ SD cards ought to be using exFAT. Maybe that or the encryption thing is the problem. Those would be my first 2 avenues of investigation.

    Scott
    Quote Quote  
  6. Member
    Join Date
    Oct 2014
    Location
    United States
    Search Comp PM
    You guys are much better at this than I! Obviously!

    The problem is, it is two agencies of government involved. One is the Sheriff's Department. The other CHP. Can you find out, which system each department uses in their patrol vehicles, to video tape traffic stops?

    We asked for the video of the stop, but first request went to wrong agency, Sheriff's Department made stop, request went to CHP. When the DA responded, they said it was "corrupted". I am assuming from the CHP.

    Sheriff's Department says they placed a DVD into evidence. But now we find out, the system they use is a supposed to be a flash drive. Their system is called a Kustom Signal Digital Eye Witness system. With automatic record when Emergency lights or siren are activated. Also automatic transfer of data upon record, so it is immediately transferred wirelessly back to the station server. Does that sound like a flashdrive system to you?


    We have no idea what system the CHP uses but assume by the information it is a DATA 911 system, the deputy then probably took a CHP DVD from the CHP officers vehicle, and placed it into evidence as if it were a Sheriff's Department DVD. Could this explain the reason the sheriff's department says it can't copy the data to a DVD?

    I know more information than what you were expecting!
    Quote Quote  
  7. Member Cornucopia's Avatar
    Join Date
    Oct 2001
    Location
    Deep in the Heart of Texas
    Search PM
    OK, so the Kustom Signal Digital Eye Witness is a DEMM (digital evidence media manager, aka media database) for the videos taken by the G3 and G3Extreme in-car video systems (assuming the same mftr used throughout - most common). The G3 system uses 4 cameras/views each of 720x480 (aka standard def) @ 30p using AVC (aka h.264) encoding.

    The DEMM has an "export to DVD" function, for use as a presentation tool in courtrooms. It does a conversion of the 720x480p30 h.264 video to DVD-standard 720x480i30 MPEG2 video, and then authors & burns it to disc. This DVD is for presentation/demonstration purposes only and is not the ACTUAL original video evidence, but because it was burned direct from the DEMM, it is acceptable as a legal proxy for the evidence.

    Both companies' systems, while similar, are not exactly compatible in their internal DVR state. And it is extremely likely that, until they are logged into a secure server, they are encrypted. This is to prevent unauthorized access and to prevent tampering of the signal until they are in a place where the (video) data is logged & verified & monitored. Without this, there would be no proof of chain of custody, thereby invalidating them.

    So NO, they are not just easily "copy-able". In order to do it right, a camera recorded in-car would be stored on the in-car DVR (in encrypted form). This encryption & app that reads it does NOT allow for editing, and allows for playback ONLY by authorized parties and using authorized devices (originally only the recording DVR, but then expanded to the secure server, etc.). Some systems allow for simultaneous secure wireless upload to their secure server at the law enforcement facility, but this is a secondary/backup process in order to provide for both more instantaneous catalogging and less loss of data from the field. If this feature isn't available, the data would have to be offloaded from the SD card to the secure server first (by physically putting the SD card in the server's secure card reader and uploading). Once the transaction is logged & verified, the SD card is stored/retired/rotated, depending on the agency's policy. If the system is REALLY good and advanced, the triggers for the recordings will also be uploaded ahead of time to give warning that footage is expected.

    So the encrypted data is NOW on the secure server. In order to get a COPY, one would now have to export (and be authorized to do so). One can export into a DVD presentation copy (as mentioned before), or to one of a few other types (archival - less compressed but standardized; as-recorded - but unencrypted and so not usable as legit evidence; possibly others). The DVD is also not encrypted, either in the standard pressed Hollywood way nor in the IT law-enforcement way.

    To get the video from one agency's server to another would require either an export + authentication of rights to maintain the encryption and the Chain-of-Custody (and this export could be as-recorded, or converted to match the new system). Or it could use a DVD or generic export, but because of having no encryption (and chain-of-custody verification?) now it would only be usable as a reference.

    So, I would suggest you get with the ORIGINAL agency (who actually did the recording) and request a new copy based on their original recordings (earliest down the chain as possible). If they don't know how to do this to your satisfaction, I suggest they contact ME. I would be happy to do this facilitation (probably at no charge), as long as I can use success at it as a future reference. I have done numerous forensic media jobs before, and would welcome additions to that area.

    HTH,

    Scott
    Quote Quote  
  8. Member
    Join Date
    Oct 2014
    Location
    United States
    Search Comp PM
    Thank you, Scott and the other guy, for answering my question. I am not done yet, but have forwarded your answer to my attorney. He is a difficult person to convince, so if you have references as to where you got your information, on Data 911 and KSDEW systems, that would be helpful.
    The "SD" was an abbreviation I wanted clarification on!

    Standard Disc, or Sheriff's Department, or something else?

    Thanks again, I don't expect my attorney to contact me tonight so maybe tomorrow. Since you are in Texas, I am in California, is this possible over the internet to accomplish this?

    At least step by step would be helpful!
    Quote Quote  
  9. Member Cornucopia's Avatar
    Join Date
    Oct 2001
    Location
    Deep in the Heart of Texas
    Search PM
    In the context of memory cards, SD would mean "Secure Digital".
    In the context of video formats, SD would mean "Standard Definition".
    There is a context where SD would mean "Sheriff's Department", but I would probably never make use of it that way.

    The info on Data911 and KSDEW systems, I got direct from their own websites (plus knowledge from having worked with these kinds of systems). You just have to know what to look for.

    Sure Internet contact is OK. If you want to continue this here in the public forum, that's fine - just continue posting here. If you would prefer to converse privately, you can PM (private message) me, like I mentioned before, or even email.

    If you mean, "is this possible to fix the 'corruption' problem via the Internet?", probably not but it's a start.

    Scott
    Last edited by Cornucopia; 20th Oct 2014 at 23:48.
    Quote Quote  
  10. Member
    Join Date
    Oct 2014
    Location
    United States
    Search Comp PM
    Hi, back again, we got a report from the Sheriff's department. Very generic report. Nothing in it really. Can you see if any of this makes sense to you!

    They sent it PDF but I can't figure out how to copy text. It won't let me copy and paste.

    So I will type it out here.

    Report Purpose: Document computer forensic examination.
    On date, Sgt blank, delivered a DVD that was used in the In-Car Video System. He told me he was unable to view the files stored on the DVD and requested me to complete a recovery. I was able to view the directory structure that included folders and individual flies in both Window Explorer but was unable to open the files.

    I then used the Encase v7.10 forensic software to create an image of the DVD and extract the files. I was again able to see the folders and individual flles. During the acquisition process I encountered numerous sector errors that prevented me form completing the image. The errors are the result of the computer being unable to read the data on the DVD. This can be caused by damage to the DVD or a problem when the videos were originally recorded. I examined the DVD but did not see any apparent damage that would cause the problem. I then attempted to extract individual recorded videos but was unable to do so.

    A copy of the original report and the examined DVD were given to Sgt blank.

    Closing statement:

    Case status unchanged by this report

    /s/Computer Forensic Examiner bland

    date




    My questions are no identification of the DVD was given. There is a specific DVD at play here. It has numbers related to it. There is no mention of the system this DVD was formatted to. There is a specific issue as to whether this Sheriff's Department or CHP system is on the DVD in question. The two are DATA 911 and Kustom Signal Digital Eye Witness. Not the generic "In-Car Video System" he mentions.

    Does any thing he mentions about trying to retrieve the data, make sense? He doesn't mention what Fat32 errors he encountered. Just numerous sector errors.


    He mentions using a Encase v7.10 Forensic software, anything on that software, age, likely effective in this issue.

    He mentions able to "view the directory structure that included folders and individual files in both Windows Explorer" but doesn't mention what he meant by both. Assume he went online to use internet problem solvers to open files. Shouldn't the Sheriff's Department have their own software to open these files.

    Would all of this be possible if the DVD was formatted but blank! Nothing to open so it only has operational files.


    Again we were told originally the Sheriff's Department uses a DATA 911 system. After investigation we are told sheriff's department actually uses the KSDEW system. This can be confusing. I believe the first person wasn't authorized to open files. So when she attempted she was denied, we were told DVD corrupt, expect me to accept this BS and give up. Investigator asks a few questions gets information the system is a KSDEW which has automatic record, , automatic transfer to "back office" when emergency lights are activated. This is when my PD refused to do any more for me. Now we know the system, but still don't know if this DVD is from CHP or SD.
    Quote Quote  
  11. Member Cornucopia's Avatar
    Join Date
    Oct 2001
    Location
    Deep in the Heart of Texas
    Search PM
    I don't really want to step on some other professional's toes here, but it seems to me:

    1. Encase is best at analysis & data preservation & COE(chain-of-evidence) documentation. It is not best at data recovery (when there is corrupt/incomplete data).
    2. The kind of problems that were described as being encountered could be directly attributed to corrupt recording/burning and/or playback/reading of the DVD.
    3. The DVD is, as I already mentioned before, a 2nd-generation copy and NOT an original. (Original is in-car recording on SDcard, Clone/duplicate is transferred to Secure Server DEMM system, 2nd gen is the DVD or other type copies).
    4. It should thus not be assumed that the Original/Duplicate is damaged/corrupted. So an easy fix would be to Re-export from clone/duplicate to a new/different DVD. Or at least TEST the original/duplicate to see if it is valid, then proceed.
    5. A DVD that is compliant with the "DVD-Video" application spec does NOT get formatted ahead of time - it is burned in a disc-at-once fashion start-to-finish, and the bits that create the filesystem structure are laid down immediately prior to the bits that comprise the video data being laid down. So there should be no "empty" video files.
    6. A DVD that shows video files in such an "empty" manner wasn't burned correctly to begin with, unless it was using some other kind of system which is inherently NOT meant to be "DVD-Video" compliant (not likely, since that would negate its universal playability).
    7. "Sector errors" could mean problems reading the file structure, the directory/filesystem, or the actual off-disc bit readability (the expected definition, if being strictly literal). Whether the term is used correctly or not isn't self-evident.
    8. When encountering DVDs, with expected DVD-Video title compliance, which exhibit "sector errors", the prime go-to app would be IMO ISOBuster, even before Encase. Again, corrupt data recovery must precede extant data analysis/documentation.
    9. "In-car video system" isn't a name brand or model, it is a generic term for where the data came from, possibly used as if it was a brand/version specifier.
    10. Windows Explorer is notorious for being a "lowest-common denominator", or consumer-semi-friendly capability-thin method that is a shortcut when avoiding the time/money/energy expenditure of thorough & powerful professional tools, both to catalog, to analyze, to view/preview, to recover and to manipulate. In other words, it is often an easy "first resort" check, but NEVER a "LAST RESORT" verify type of tool in the hands of troubleshooters.

    Maybe others can suggest a few more things...

    Scott
    Quote Quote  
  12. Member Ethlred's Avatar
    Join Date
    Feb 2008
    Location
    United States
    Search Comp PM
    Somehow I got a PM from SBowder about this. I have no idea why but Cornucopia's replies seem to be very solid to me. I am glad to have read them but they are outside my knowledge, but not so far out that I did not understand what Cornucopia said. Assuming he said it right anyway.

    Well I learned something anyway. That the police encrypt as they should.
    Quote Quote  
  13. Banned
    Join Date
    Oct 2004
    Location
    Freedonia
    Search Comp PM
    I realize this thread is mostly a few weeks old, but maybe another perspective is useful.

    I work in IT and my job occasionally requires me to contact our customers' IT departments when we have problems connecting to their servers to drop off files or they have problems decrypting what we drop off. This is a huge generalization, but in very general terms, bigger companies tend to have better IT departments than smaller companies. A sheriff's or police department would be a "smaller company". I'd expect a local law enforcement branch to have a very small IT staff. They're probably not paid well, so they're not likely to have the cream of the crop there. Often people with low motivation and weak skills take those kinds of jobs. They probably know how to do Windows stuff and not much else and it doesn't take much to get them out of their comfort zone. It's quite possible that they don't really understand how to properly make the DVD requested and there's no deception going on. They did their best and their best wasn't good enough. I also can't completely rule out that maybe they do know what they are doing and they botched it deliberately, trying to play dumb and hoping the OP will just give up. But that depends on how corrupt the local cops are.
    Quote Quote  
Visit our sponsor! Try DVDFab and backup Blu-rays!