Forensic analysis of video data deletion and recovery in Honeywell surveillance file system
Jinhee Yoon, Sungjae Hwang

TL;DR
This paper analyzes Honeywell's proprietary video file system to understand deletion mechanisms and demonstrates methods for recovering deleted video data, aiding forensic investigations.
Contribution
It provides the first analysis of Honeywell's undocumented file system, revealing deletion methods and demonstrating video recovery techniques.
Findings
Deletion methods include formatting, data expiration, and overwriting.
Video data can be recovered after deletion using binary diffing techniques.
The study enhances forensic analysis capabilities for Honeywell surveillance devices.
Abstract
Real-time video surveillance systems store recorded video using digital video recorders (DVRs) and network video recorders (NVRs). To support continuous high-volume video storage, these devices employ specialized, nonstandard file systems that are often proprietary and undocumented. This lack of documentation significantly increases the time and effort required for forensic analysis. In this study, we analyze an undocumented proprietary file system used by Honeywell video surveillance devices-one that, to the best of our knowledge, has not been examined in prior work-and investigate its deletion mechanisms and demonstrate the feasibility of video recovery after deletion. We perform a file system analysis using a binary diffing technique and evaluate three deletion methods supported by the target device: 1) formatting-based deletion, 2) data expiration, and 3) overwrite. For each method,…
Peer Reviews
No public reviews on file for this paper yet. If you reviewed it on a platform where reviews are public (OpenReview, ICLR, NeurIPS, ICML), you can paste yours below so the community can read it here.
Videos
No videos yet. Explain this paper in a talk, walkthrough, or lecture? Add one.
