Forensic analysis of video data deletion and recovery in Honeywell surveillance file system

Computer Science > Cryptography and Security [Submitted on 8 May 2026] Forensic analysis of video data deletion and recovery in Honeywell surveillance file system Jinhee Yoon, Sungjae Hwang Real-time video surveillance systems store recorded video using digital video recorders (DVRs) and network video recorders (NVRs). To support continuous high-volume video storage, these devices employ specialized, nonstandard file systems that are often proprietary and undocumented. This lack of documentation significantly increases the time and effort required for forensic analysis. In this study, we analyze an undocumented proprietary file system used by Honeywell video surveillance devices-one that, to the best of our knowledge, has not been examined in prior work-and investigate its deletion mechanisms and demonstrate the feasibility of video recovery after deletion. We perform a file system analysis using a binary diffing technique and evaluate three deletion methods supported by the target device: 1) formatting-based deletion, 2) data expiration, and 3) overwrite. For each method, we investigate changes in file system metadata and on-disk data structures and demonstrate the feasibility of video data recovery. Our findings aim to support more efficient and accurate forensic investigations of Honeywell surveillance products and provide foundational insights into the analysis of proprietary file systems used in video recording devices. Comments: The paper has been accepted by The 26th Annual Digital Forensics Research Conference USA (DFRWS USA 2026) Subjects: Cryptography and Security (cs.CR); Multimedia (cs.MM) Cite as: arXiv:2605.07430 [cs.CR]   (or arXiv:2605.07430v1 [cs.CR] for this version)   https://doi.org/10.48550/arXiv.2605.07430 Focus to learn more Submission history From: Sungjae Hwang [view email] [v1] Fri, 8 May 2026 08:31:12 UTC (872 KB) Access Paper: HTML (experimental) view license Current browse context: cs.CR < prev   |   next > new | recent | 2026-05 Change to browse by: cs cs.MM References & Citations NASA ADS Google Scholar Semantic Scholar Export BibTeX Citation Bookmark Bibliographic Tools Bibliographic and Citation Tools Bibliographic Explorer Toggle Bibliographic Explorer (What is the Explorer?) Connected Papers Toggle Connected Papers (What is Connected Papers?) Litmaps Toggle Litmaps (What is Litmaps?) scite.ai Toggle scite Smart Citations (What are Smart Citations?) Code, Data, Media Demos Related Papers About arXivLabs Which authors of this paper are endorsers? | Disable MathJax (What is MathJax?)