Case:
Customers use a miscellaneous card monitoring. Due to the requirements for evidence collection, the customer connected it to the PC. Because they do not understand how to extract the data, the customer mistakenly initializes the hard disk and formatted the partition.
Solution:
First use Winhex to take part of the sector to analyze and study. After verification, the determined file area header and channel information indicate bytes.So handwritten recovery procedures. Due to the use of the original written monitoring recovery procedures to modify, the workload was not large, and it was completed quickly. The recovery of the video began, and most of the data was successfully recovered.