Digital Forensics: DVR and NVR Surveillance Investigation Scenarios
Published:
Questions
30
Duration
30 min
Faculty-reviewed
0
Updated
20 May 2026
About this mock
Applied scenarios in DVR and NVR forensics for the FACT digital forensics paper, pitched at medium difficulty. The mock walks through real laboratory situations: parsing Hikvision HIKBT_FS and Dahua DHFS proprietary layouts to locate indexed video; reconstructing a four-disk RAID 5 array from three surviving disks given stripe size and bay order; carving H.264 NAL units when the partition table is wiped; pulling the SPS and PPS that an isolated IDR slice depends on; correcting DVR clock drift against an NTP reference and against mobile-tower CDR for an alibi window; reading the ring-index head pointer that marks the loop-record overwrite boundary; choosing between ONVIF Profile S, Profile G, and Profile T for forensic export; verifying integrity of a multi-segment .dav export through SHA-256 and timestamp continuity; recovering a truncated MP4 by synthesising a moov atom from the surviving mdat NAL units; and applying Section 63 of the Bharatiya Sakshya Adhiniyam 2023 (formerly Section 65B IEA 1872) certificate, Tomaso Bruno (2015), Anvar P.V. (2014), and Arjun Panditrao (2020) to admissibility challenges.
Written for FACT digital-forensics aspirants, NFSU MSc Cyber Security and Digital Forensics students, and serving investigators upskilling on CCTV scene seizure under the BNSS 2023 search-and-seizure framework. The questions assume a working knowledge of the easy DVR and NVR mock and now extend to scenario-based decisions across DVR file systems, RAID, carving, codecs, statutory regimes, and chain-of-custody mechanics.
Topics covered:
- Hikvision HIKBT_FS and Dahua DHFS proprietary layouts
- RAID 5 reconstruction with missing data or parity
- Physical acquisition versus vendor client export decisions
- H.264 and H.265 NAL units, parameter sets, IDR anchors
- DVR clock drift, NTP, CDR temporal corroboration
- Loop-record ring index and overwrite boundary
- ONVIF Profile S, Profile G, and Profile T capabilities
- Section 63 BSA 2023 certificate and Tomaso Bruno case law
Work through the 30 scenarios under timed conditions, review the explanations against the cited standards and statutes, and run the answer sheet against the topic matrix at the head of the SQL seed. Allow 30 minutes.
Sources & references
Questions in this mock are written and verified against the following sources. Citations are recorded per question and shown in the explanation after submission.
- cited in 5 questions
BlackBag (Cellebrite)
DVR Examiner technical brief, password recovery via UART on Hikvision and Dahua DVRs
Open source - cited in 4 questions
- cited in 3 questions
Carrier, Brian
File System Forensic Analysis (Addison-Wesley, 2005), Chapter on RAID 5 Parity Reconstruction
- cited in 3 questions
Salvation Data
Video Investigation Portable user guide, video repair and error concealment workflow
- cited in 2 questions
Casey, Eoghan
Digital Evidence and Computer Crime, 3rd Edition (Academic Press, 2011), Chapter on Physical Acquisition vs Logical Export
- cited in 2 questions
NIST
Special Publication 800-86, Guide to Integrating Forensic Techniques into Incident Response, hashing section
Open source - cited in 2 questions
- cited in 2 questions
ISO/IEC 14496-12
ISO Base Media File Format, moov and mdat box semantics and recovery
- cited in 2 questions
- cited in 1 question
Nelson, Bill; Phillips, Amelia; Steuart, Christopher
Guide to Computer Forensics and Investigations, 6th Edition (Cengage), Chapter on Temporal Analysis and Clock Skew
- cited in 1 question
Tomaso Bruno v. State of UP
(2015) 7 SCC 178, Supreme Court of India, judgment dated 20 January 2015
- cited in 1 question
Bharatiya Sakshya Adhiniyam 2023 and Indian Evidence Act 1872
Section 63 BSA 2023 and Section 65B IEA 1872, certificate for electronic records
Open source - cited in 1 question
Arjun Panditrao Khotkar v. Kailash Kushanrao Gorantyal
(2020) 7 SCC 1, Supreme Court of India, three-judge bench on Section 65B IEA 1872
- cited in 1 question
Bharatiya Nagarik Suraksha Sanhita 2023
Section 185, search by police officer; replaces Section 165 CrPC 1973
Open source
How our mocks are built
Questions are written and edited by the ForensicSpot team and cited from peer-reviewed forensic textbooks, official syllabi and primary case law. Each one is verified before publishing. Detailed explanations show after you submit, so the test stays a real test. See a mistake? Tell us.
Common questions
What does the Digital Forensics: DVR and NVR Surveillance Investigation Scenarios mock cover?+
Applied scenarios in DVR and NVR forensics for the FACT digital forensics paper, pitched at medium difficulty. The mock walks through real laboratory situations: parsing Hikvision HIKBT_FS and Dahua DHFS proprietary layouts to locate indexed video; reconstructing a four-disk RAID 5 array from three surviving disks given stripe size and bay order; carving H.264 NAL units when the partition table is wiped; pulling the SPS and PPS that an isolated IDR slice depends on; correcting DVR clock drift ag
How many questions and how long is the test?+
30 multiple-choice questions, 30 minutes total. Difficulty: medium. Tier: Premium.
Who is this mock for?+
Forensic science students and aspirants who want timed, exam-style practice with explanations and verified source citations on Digital Forensics, FACT. Useful for postgraduate entrance preparation and for BSc / MSc forensic students testing their recall under time.
Are the questions reviewed?+
Each question carries a verified source citation. Faculty review for individual questions is in progress.
Do I need an account to take this mock?+
Yes, a free ForensicSpot account is required to start a timed attempt — this lets you save progress, see per-question explanations after submission, and track your topic-level performance over time.