What is a Filesystem?
A filesystem is a term that Magnet Forensics uses to refer to a specific family of DVRs. Families are often made up of several different lineages all combined, right? We see DVRs the same way.
We deal with the internal computer components, namely mainboards and chipsets, that come inside the DVRs. Many people are surprised to find out that quite a few DVRs share the same components. If DVRs share the same components, they will likely handle data, and specifically video, in the same way.
For example, we have a filesystem called “60D” that’s used in GE StoreSafe DVRs. This “DVR Family” is very small, as GE was very restrictive about which DVRs could use this filesystem, thus many of the DVRs that use this filesystem will be GE StoreSafe DVRs.
On the other hand, the “KSF_dc” filesystem or “family” is quite large. We’ve found many different brands that share the same components, and thus are part of the same “family”. Swann, NightOwl, and many other brands fall into this family, but not every DVR from Swann or NightOwl is part of this family. Sometimes manufacturers change components for a specific model or style of DVR, or maybe they need it to support a different number of cameras or quality settings. NightOwl for instance has DVRs that we know of specifically that fit into at least 4 different filesystems.
Clarification: A “filesystem” can contain one or more traditional “file systems” like EXT or FAT32. We use the term “filesystem” without a space to try and differentiate the DVR filesystems from the more traditional ones.
Where can I find what filesystem I have?
There are two main ways to find out what filesystem your DVR is. The first is from the “Detection Results – Scan Options” screen, which will populate in DVR Examiner after selecting to scan an image or physical hard drive (If the filesystem is supported).
In this case, the filesystem is DHFS_41.
The other way to get to the file system information requires that your filesystem is fully supported. Once you’ve scanned your data, you’ll arrive at the Home Screen, which includes the (1) Tabs and Ribbons Icons, (2) Case Explorer and Details Panel, (3)Case Summary tab, and (4) Clip List Tab:
From the Home Screen, navigate to the “Case Explorer and Details Panel” (2) and select/highlight the source name. Once the source is selected, navigate to the details panel to and you will see the filesystem name listed:
What do the filesystem names mean?
Honestly? The names are made up. However, most of the time, they do have an identifier that means something to us. Sometimes it’s about the structure of the drive, sometimes it’s a specific hex that’s on the drive, sometimes it’s even readable text written out in hex on the drive. “This is Tango Magic” happens to appear on some drives, hence: TangoMagic! Often, we’ll also add what encoder the DVR is using too, like _MPEG, _JP2, or _264. Mostly the names are just there for the benefit of communication, so don’t worry too much about why anyone’s name exists specifically.
In conclusion…
Filesystems are just Magnet Forensics’ way of naming how the DVR handles files. We must have them to be able to communicate about DVRs with our customers and amongst ourselves. Hopefully, with the extra detail in this post, you can understand why we’re not able to answer you if a specific DVR is supported in most cases. We have a pretty good feel for DVRs and can often guess about what filesystem a certain DVR might be, but we can never know for sure until someone tests it out, so test out those DVRs, and more importantly, let us know what you find! The more you tell us about what you’re running into, the more we can make DVR Examiner work for you!