Аңдатпа
Video footage from proprietary surveillance systems is central to criminal investigations, yet its forensic recovery remains poorly supported. Conventional carving fails on Dahua systems because the proprietary DHFS4.1 file system uses frame encapsulation, header-footer validation pairs and embedded checksums. This paper addresses two open questions: how each of the four DHFS4.1 validation levels affects the false discovery rate (FDR) and recovery rate, and how quick formatting and partial bulk zero-fill overwriting differ in their impact on recovery. The technique combines dual-signature frame validation, frame-size and checksum consistency checking, and adaptive time sequencing, extending our earlier pipeline; the principal contribution is the validation-level ablation, the paired comparison against three independent tools, and the partial-overwrite study. All methods were executed on forensic images of eleven Dahua NVR hard drives acquired behind a hardware write blocker, so every comparison is paired within drive. The proposed method achieved a recovery rate (RR) of 88.0%, a temporal accuracy (TA) of 89.0% and a file-level FDR of 4.0%; four-level validation reduced the frame-level FDR 13.5-fold, from 27.0% (single signature) to 2.0%, at the cost of a 3.2-percentage-point drop in RR. The RR advantage over each compared tool was statistically significant (paired-samples t-test, n = 11, p < 0.05) and confirmed by the Wilcoxon signed-rank test. Quick formatting still permitted 76% recovery, whereas bulk zero-fill reduced it to 34% and raised the file-level FDR to 41%; a collision analysis shows that this increase stems from payload fragmentation rather than chance signature matches. Within the tested scope, the methodology performs comparably to commercial tools and, because every decision rule is published, is re-implementable and transparent. The findings offer practical guidance for prioritising evidence collection from Dahua surveillance systems.