# Using VR-EXPERT to examine DVRs. A comparison with foreign counterparts Sergey Eremin · LAN PROJECT MOSCOW FORENSICS DAY ’25 · Day 1 — Thursday, 11 September 2025: digital forensics day · Scheduled 15:00–15:30 · In the recording 02:18:34–03:00:16 Talk summary · https://2025.moscow-forensics-day.workers.dev/en/summary/07-eremin Transcript: https://2025.moscow-forensics-day.workers.dev/en/transcript/07-eremin · Slides: https://2025.moscow-forensics-day.workers.dev/en/slides/06-eremin-vr-expert · Watch from 02:18:34: https://youtu.be/4V7Wez3L_58?t=8314 --- ## In brief A product presentation of VR-Expert (LAN PROJECT, in the Russian software registry since 2025): extracting video from stationary and in-car recorders, release plans, a comparison with counterparts. The key part: stationary recorders have no file system in the usual sense, and initializing the disk in Windows 10/11 destroys the data. The second half is the AI module. The comparison promised in the title is a slide of vendor claims; a lot of time goes to plans, the prize drawing and the lab. ## Key points 1. The company is 25 years old and supplies "all law enforcement and security agencies"; it has been doing recorders for two years and, by its own claim, no equivalents existed in Russia. 2. When a disk is connected, Windows offers to initialize it, the officer agrees — "the information becomes inaccessible": Windows 10/11 write into roughly the first 40 MB, which hold the service data and the stream allocation table. 3. There is no file system as such, every manufacturer's structure is its own and it changes. In the week before the talk, TSFS (LAN PROJECT's own classification) was found on Tantos and TESAM built on VFS/VFS2 — support in the next release. LAN PROJECT, per the speaker, are the only ones who work with Dozor (patrol police, FSIN), including password bypass. 4. The sources are the disk and images (E01 was added); first the data present explicitly, then carving: a terabyte takes about 3 weeks, and "we can't speed up the process yet". Plus a signature search for the video stream — good on initialized disks. 5. The result is sorted by camera, by date and time; a viewer, export, a frame-by-frame breakdown, a report, HEX, logging; the interface was simplified so that an investigator themselves "could, with no specialist, conduct an inspection". New: manually specifying the file system, and FAT32 for car dash cams — a disk moved over from a PC was laid out by the recorder starting at about sector 40, the automatic mode missed it, the manual mode "picked up" the file system. 6. The AI module takes any video and images (JPEG, BMP "and all the formats"); the output is fragments plus an SQLite database. Classes: people, bicycles, cars, motorcycles, buses, trucks; license plates — Russian ones only so far. PyTorch models and their own; a 30-minute video with one object takes 25 minutes on the CPU against roughly 3 minutes on a graphics card. 7. Plans: electric vehicles and "weapons", filtering by color, face search, image categorization, date and time from the screen; a Linux/Windows engine by the end of the year (for now "through workarounds"); RAID in recorders. 8. Car dash cams: 90% of the tasks come after a road traffic accident with the last file's recording unfinished (the stream is written before the metadata). Recovery is done "manually" for most file systems, there is no automation; for now it goes to the company's lab. 9. The comparison (per the speaker): extraction, recovery, speed — parity; "the Korean program" does not always handle password-locked recorders; MD-VIDEO has no explicit support for proprietary formats; the version of DVR Examiner available in Russia has no AI; HEX, the Russian interface and the registry entry are VR-Expert's alone. 10. Delivery is a hardware-software kit: software, hardware (the requirements are still being defined), disk imagers, write blockers, storage media; optionally ACE Lab and foreign software (SalvationData, MD-VIDEO from GMDSOFT). A case: a garage cooperative spent a week without surveillance while the video was being pulled. In 2025 — an educational license, a lab, a Telegram channel. ## Tools, artifacts, technologies - **VR-Expert** (LAN PROJECT) — the product of the talk; proprietary file systems, among the new ones **TSFS** (Tantos) and **TESAM** (VFS/VFS2), plus **Dozor** (patrol police, FSIN). - **The AI module** — PyTorch, GPU, their own models and other people's; six classes, Russian license plates, zones, object tracking, SQLite; it does not go into archives. - Counterparts: **DVR Examiner**, **MD-VIDEO** (GMDSOFT, "Hancom is now called GMDSOFT"), **SalvationData**; **ACE Lab** — equipment for "worn-out" disks. - Mentioned: **VD-Expert** (unsharp masking), **Amped FIVE**, **Photoshop**, **GIMP**, **DTP-Expert (OT-Kontakt)**, **Safe City** (Moscow's network, not everywhere in the regions), **RAID in recorders** (in development). ## Legal and organizational context No laws, articles or methodologies were mentioned. The Russian software registry is an argument for government supply; the program is "being piloted in several agencies", and the operating systems are tested against the list for the internal affairs agencies. An "inspection" of the disk by an investigator with no specialist is what the speaker calls "perfectly safe". Sanctions: supplies of foreign software are "difficult", but foreign software stays in the alternative configuration. ## Questions from the audience 1. The AI module — any source, a phone extraction, an archive? → Any video recording; "for now it doesn't go into the archive itself", the file has to be pulled out. In the transcript the turns are merged. 2. An object's speed? → "No, we're not, and we don't plan to" — that is DTP-Expert (OT-Kontakt), a joint supply is possible. 3. Searching by the detected objects? → By type; everything is "stored in SQL" and is found with queries. 4. A gyroscope, a G-sensor? → Not yet, "we'll see". GPS? → They have not worked on it, "that's a good idea"; they plan to recognize the date and time from the screen and compare it with the file creation times. The paragraph is unmarked; whether it is one person asking has not been established. ## The speaker's position A vendor presentation with no polemics: do not connect recorder disks to Windows without specialized software, the data present explicitly first — carving afterwards, ship the software with hardware and write blockers, keep several products, foreign ones included. He names the limitations himself. ## Quotes - "…yeah, initialize it — what happens after that? The information becomes inaccessible." - "…a one-terabyte disk takes us about three weeks to process, unfortunately." - "…since it's perfectly safe, you can look at the contents yourself." - "There are no miracles: if little information was captured in the video…"