CARVE: Recovering and reconstructing deleted H.264/H.265 video from honeywell surveillance systems

Abstract

Digital video surveillance is an important source of forensic evidence, but recovering deleted footage from network video recorder (NVR) systems remains challenging because many devices use proprietary file systems, undocumented metadata structures, and non-standard storage layouts.

This paper presents carve, a forensic framework for recovering and reconstructing deleted H.264/H.265 video from Honeywell surveillance systems. carve identifies codec-specific structures in raw video data region to carve residual fragments, separates deleted footage from current recordings using embedded timestamps, groups fragments by source camera, and reconstructs video timelines. carve supports two complementary reconstruction settings. When visual overlays are available, it applies custom frame preprocessing and uses PaddleOCR-VL-1.5 to extract camera labels and timestamps. Compared with directly applying PaddleOCR-VL-1.5 to raw frames, this preprocessing increases overlay detection accuracy by approximately 26% for H.264 and 50% for H.265 recordings. When overlays are unavailable, carve clusters fragments by source using PRNU-based sensor-noise fingerprints, and orders them using embedded timestamps. In both settings, carve further revisits fragments that are not assigned during initial grouping and uses them to fill detected internal temporal gaps during timeline reconstruction phase. We evaluate carve on a Honeywell NVR using a baseline disk image and three deletion scenarios: data-expiration, overwrite deletion, and format-deletion. Across all scenarios, carve achieves an average recovery rate of 99.89% and reconstructs internal temporal gaps with 100% precision. Additionally, integrity and reproducibility tests confirmed that carve preserves the original video data and produces consistent results across repeated executions, supporting the forensic soundness of the recovery process.