×

Warning message

  • Cisco Support Forums is in Read Only mode while the site is being migrated.
  • Cisco Support Forums is in Read Only mode while the site is being migrated.

parsing raw DAT files from WVC210 IP cam

Unanswered Question
Feb 28th, 2012
User Badges:

Hi,

Is there any information available about the raw DAT file format that cisco uses for the WvC210 IP camera's?

A surveillence system based on 2 WvC210 IP camera's was vandalised and we could salvage only the DAT files, the rest is trashed.

I've loaded the software onto a new system and put the DAT files in the correct location but nothing works on these files.

I can see structure in the raw data, so there is something there.

The validate tools and the DBTools don't have any effect so maybe the files are mangled.

But as a programmer I could parse the files and possibly pad stuff to get it working again.

It's really important we do a full effort to retrieve some evidence, any help is appreciated.

I've read most posts and I relalise the product is EOL, but all I need is the file structure, any tech docs available?

Regards,

Shaun

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
Loading.
Eric Moyers Tue, 02/28/2012 - 07:39
User Badges:
  • Silver, 250 points or more

Hi, My name is Eric Moyers. I am a Network Support Engineer in the Cisco Small Business Support Center. Thank you for using the Cisco Community Post Forums.


Which video monitoring software were you using to record your files. AVMS 2.0.2.1 or 1.2.1?


Thanks

Eric Moyers

Cisco Network Support Engineer

SBSC Wireless and Surveillance SME

CCNA, CCNA-Wireless

1-866-606-1866

shaundmatwgip Tue, 02/28/2012 - 07:54
User Badges:

Hi Eric,

Thanks for answering, the 2 camera system was purchased a month ago.

The software version is AVMS 2.0.2.1

(Build 3.2.29 16647)

Eric Moyers Tue, 02/28/2012 - 08:37
User Badges:
  • Silver, 250 points or more

Mr. O'Neil


We should be able to help you with this. Please call into our support center and get a case created, let one of the answering agents work with you to restore the DB. We can do a WebEx to view your system and work on restoring your files.


If they have issues with this, have them reach out to me. I work in the same area as they do.


Thanks

Eric Moyers

Cisco Network Support Engineer

SBSC Wireless and Surveillance SME

CCNA, CCNA-Wireless

1-866-606-1866

shaundmatwgip Tue, 02/28/2012 - 08:42
User Badges:

Mr. Moyers,


Thank you, that sounds promissing, I will get on it and report back here after!


Regards,

Shaun O'Neil

shaundmatwgip Wed, 03/14/2012 - 04:03
User Badges:

Mr. Moyers,

I did what you advised, (Case ID:Sev 3 SR 620989579) but was only directed to contact http://www.nuuo.com

Apparently that company developed these Cisco camera's, and they will provide future support.

I will contact that company, but I was wondering if there was any specific information you were referring to.

My original question is what file format the .DAT files are?

mpyhala Tue, 02/28/2012 - 11:06
User Badges:
  • Gold, 750 points or more

Shaun,


I have found that changing the extension to .asf allows the .dat files to be played using VLC Player. This might be a good workaround to find the evidence you are looking for.

shaundmatwgip Tue, 02/28/2012 - 11:17
User Badges:

mypyhala,

thanks for your answer, I did try many of this kind of thing, but VLC does not show anything, it does 'walk' throu the files.

Maybe you are using some codec I don't have?

To me the files look encrypted when looking at the file contents in a hex editor, but I can see some structure to it..nothing that looks like header or meta data tho..

mpyhala Tue, 02/28/2012 - 11:35
User Badges:
  • Gold, 750 points or more

Shaun,


That is interesting that you are seeing that. I helped a customer do the same about a week ago in a case where the AVMS software did not show the video in the database but the .dat files were there for the camera. Simply adding .asf to the file name allowed them to play in VLC. I would test this on another computer, it could be an issue with the video card, hardware acceleration, etc.

shaundmatwgip Tue, 02/28/2012 - 11:48
User Badges:

Well, I have used a windows 7 and a windows XP system, but I'll recheck playback as .asf with VLC tomorrow just to rule that out. If you're sure the file format is ASF or ASF compatible, then that's allready good news. I'll compare a playable .asf file to the .dat files in my hex editor, there should be some simularity. I'm wondering now if the original harddrive may have been using a compressed filesystem. That would possibly explain why the files look encrypted to me, the files had to be recovered from the original drive, it wasn't a straight forward copy. Good tips, thanks...

asarutanond Wed, 03/28/2012 - 12:48
User Badges:

If you're recording using the old software that first came out for the WVC200, PVC/WVC2300 then changing the extension to .asf will work and can be viewed on VLC or WMP, unfortunately if you use the software that came with the WVC210 it uses a newer version and this uses a proprietary extension so the recorded files cannot be edited for security reasons. Right after the WVC210 came out the software has been replaced in the PVC/WVC2300 also. The file structure for the new software is such that the recordings are done in .dat files but there is another file that keeps all the index. If one of the .dat files are missing or "changed" the index will essentially be "lost". There is still a way to recover those files.


Alan.

shaundmatwgip Wed, 03/28/2012 - 12:55
User Badges:

Ah, yes this is exactly what we are seeing.

Yes we are using the new version, well the system was purchased two months ago and the shipped version was used.

The software version is AVMS 2.0.2.1


Thanks for confirming that, now I'm really interested in "There is still a way to recover those files"

Can you ellaborate on that?


Also anybody reading, I can supply the files...if anybody wants to try...


Shaun

asarutanond Wed, 03/28/2012 - 13:16
User Badges:

Let me research more into this issue before asking for your files. There is definitely a way to recover and reindex the files. I'll reply back to you today, it's been a while since I worked on the software. I was responsible for the hardware.


Alan.

shaundmatwgip Thu, 03/29/2012 - 10:51
User Badges:

Hi Alan,

Thanks, I downloaded the PDF file.

This looks simmilar to the build in DBtools DB repair in AVMS, when we tried that no files showed up.

But I'll redo that procedure following the guidlines and let you know the results.


Shaun

asarutanond Thu, 03/29/2012 - 10:40
User Badges:

My apologies for not reconnect with you yesterday. I have instructions for you to recover your files, it is on my FTP ftp://68.109.79.133/multimedia user/pwd is shaun/shaun123. I will leave it there for the rest of the day, if you have further questions please let me know.


Alan.

shaundmatwgip Thu, 03/29/2012 - 11:02
User Badges:

Hi Alan,

As before it just returns immediatly with a box saying "There is no single file to check. Contunue?"

And yes/no buttons.

asarutanond Thu, 03/29/2012 - 11:10
User Badges:

Let me do more research, the tool version will help.


Alan.

asarutanond Thu, 03/29/2012 - 13:18
User Badges:

Shaun, one question. Do I understand correctly that you now have the files on another PC (or hard drive)? Did you simulate the other PC by putting the files in the same partition and folder?


Alan.

shaundmatwgip Thu, 03/29/2012 - 13:34
User Badges:

Hi Alan,

I really appreciate all the effort your putting into this issue, it's heart warming!


The dual camera setup was running on an Windows server, in an attic.

During the violence, including a fight, the camera's were attacked, the server was thrown down stairs.

We were able to recover these files by datarecovery means, there were no issues reported with the files so they should be fine but we've been unable to do anything with these .dat files.


I installed the same AVMS software on two systems (WXP and W7) but both show the same results, the files appear invisible to AVMS and it's tools, as far as I understand this is a feature as the fingerprint does not verify.

Anyway, this is why I asked for the file format, maybe I can program a raw data parser...


Shaun

asarutanond Thu, 03/29/2012 - 13:39
User Badges:

Dear Shaun, my question to you is if the files are on the same partition as before, if not that is where it needs to be. If it was on a D: drive before, it should be on the D: drive now on the new machine. The file format is proprietary to Nuuo and I'm sure they're not going to give it up as it is their bread and butter. Don't worry, one way or another I'll see that you get a viewable file.


Alan.

shaundmatwgip Thu, 03/29/2012 - 13:43
User Badges:

ok, I'll have to check our documentation to see how the original server was partitioned.

Is it only the drive letter that's significant or the entire filepath ?

asarutanond Thu, 03/29/2012 - 13:54
User Badges:

You will need as in the instruction I sent you. D:/foldername/filename.


Alan.

mpyhala Mon, 04/09/2012 - 19:55
User Badges:
  • Gold, 750 points or more

Shaun,


I'm curious, have you had any luck with recovering the video? I did a test and found that the .asf extension only works with video recorded in the previous version of AVMS, not the latest.


Please keep us updated.

shaundmatwgip Tue, 04/10/2012 - 01:59
User Badges:

Hi mpyhala,

Thanks for getting back to this, well no luck yet.

Problem is that we did not document the original location of the files, so we've been guessing but without any results.

The DB Tools just reports no files found.

asarutanond Thu, 04/19/2012 - 11:01
User Badges:

Shaun,


Just to let you know I haven't forgotten about you. I'm in the process right now of having the dat files decyphered and converted to avi for you. Once done (if sucessful) I will contact you and send the viewable file to you.


Alan.

shaundmatwgip Fri, 04/20/2012 - 03:19
User Badges:

Hi Alan,

Many thanks, I appreciate your effort..and am keeping my fingers crossed!!

Shaun

asarutanond Tue, 04/24/2012 - 11:10
User Badges:

Hi Shaun,


Are these all the files you've recovered? If there are more you could upload to my FTP. Apparently some files are still missing to put the video together, one of which is .rcd files that are needed. Might you have those?


Alan.

shaundmatwgip Wed, 04/25/2012 - 04:41
User Badges:

Hi Alan,

We have more .DAT files but no .rcd or other files.

Here is the full file list, showing bytes and filenames.

These are all the files that were recovered from the vandalised harddrive.

But I'll double check this just to be sure.


I'm guessing the naming convention is:

C00000/1 (camera number)

S00A ??

20120215 (year-month-day)

151302 (hr-min-sec)

37178 (??)

.dat (file extention)


15-02-2012  16:02           717.034 C00000S00A20120215130237178.dat

15-02-2012  16:40           819.238 C00000S00A20120215134037698.dat

15-02-2012  18:03           718.943 C00000S00A20120215150349680.dat

15-02-2012  19:06           935.351 C00000S00A20120215160626831.dat

15-02-2012  19:08           323.334 C00000S00A20120215160844811.dat

15-02-2012  14:37           971.580 C00001S00A20120215113659726.dat

15-02-2012  15:09           752.687 C00001S00A20120215120925565.dat

15-02-2012  16:00           563.281 C00001S00A20120215130006543.dat

15-02-2012  17:34           615.714 C00001S00A20120215143439943.dat

15-02-2012  17:34        22.921.555 C00001S00A20120215143441035.dat

15-02-2012  19:08           858.214 C00001S00A20120215160839377.dat

15-02-2012  19:13       132.448.256 C00001S00A20120215161340485.dat

15-02-2012  19:19       350.180.000 C00001S00A20120215161947209.dat


These are all the files we have and I've uploaded all to the google docs folder:

https://docs.google.com/open?id=0B8oCN_ZRP1rARTBFWW4tNHhRUEdxTmM0SV9SSTVsQQ

asarutanond Tue, 05/08/2012 - 21:15
User Badges:

Hi Shaun,


I have sent you a private message. Basically all the files you gave me has been converted to jpegs. Please read your mail.


Alan.

shaundmatwgip Wed, 05/09/2012 - 13:58
User Badges:

Hi Alan,

Fantastic news, but the user/pw combi is no longer working for me...

I left you a PM with the details....

Shaun

asarutanond Wed, 05/09/2012 - 15:15
User Badges:

Sorry, I've sent you a PM in reply to your concern, thank you.


Alan.

shaundmatwgip Tue, 05/22/2012 - 03:16
User Badges:

Hi Alan,

I send you a new PM, was wondering if any of the other files could be decoded?

regards,

Shaun

asarutanond Tue, 05/22/2012 - 22:16
User Badges:

All your files seem to be on the same date, do you have any earlier dates or at least give me some files that you think the culprit is in?


Alan.

shaundmatwgip Wed, 05/23/2012 - 03:26
User Badges:

Hi Alan,

The Google Docs folder contains all the files that were recovered.

Were you also able to convert the smaller .DAT files to jpg? I'm hoping they will contain images from the fighting incident.

Shaun

Actions

This Discussion