[Soundy]

We have a PC-based (Windows XP) surveillance DVR in a site that seems to regularly be "missing" video from some cameras. Ongoing troubleshooting has narrowed it down to those cameras conveniently being turned off somehow at "convenient" times, or someone tampering with the DVR.

We're hoping at some point soon to add a hidden camera to watch the DVR, but in the meantime, I'm looking for some sort of covert keylogger/activity logger, preferably freeware or open-source, that I can install on the machine before I take it back to them (I've had a loaner in while testing their original machine, and they're reporting the same symptoms with it).

Has anyone done anything like this before, and does anyone have any suggestions for what to use?

[rainforest123]

S:
I am not a moderator, so I cannot, with authority comment on how your request complies with TGF rules.

No disparagement is intended.

But I think I can say that there are devices you can add to connection between your keyboard & DVR that will record keystrokes.

If you use your search engine, you could probably find some commercial keystroke loggers.

I saw an ad in PC World or PC Magazine a few years ago; Spektor was a PC Mag Editor's choice.

RF123

[dvk01]

I would have thought the best solution would be password protect the dvr software to stop fiddling

That isn't going to stop someone physically unplugging the camera

Experience suggests that a keylogger/monitoring system won't work in this case and I assume the cameras that turn off are monitoring where something that has been stolen or suspicious actions happen

In that sort of situation, a PC based monitoring system isn't the best solution & a stand alone DVR kept in a locked secure cabinet with alarms that sound when a camera is disconnected from outsider of the dvr is one solution

This one sounds like it needs a security consultant to visit the site

PC based monitoring of cameras is never any good with these sorts of situations, unless the PC is locked away & only a single trusted person has access to it

[rainforest123]

dvk01:
Thanks!

2

RF123

[Soundy]

Originally Posted by rainforest123

S:
I am not a moderator, so I cannot, with authority comment on how your request complies with TGF rules.

No disparagement is intended.

None taken... I considered that (especially given how sticky they are here about that sort of thing), but in this case, it's a security-related need for a security-oriented system. And I figured it doesn't hurt to ask

But I think I can say that there are devices you can add to connection between your keyboard & DVR that will record keystrokes.

It's not actually keystrokes that I need to log, but overall system activity, particularly what's being clicked and altered in the DVR software (VideoInsight).

I have actually found one that does exactly what I need (Perfect Keylogger from BlazingTools) - it will take a snapshot of the active window, or of a pre-defined area around the cursor, anytime the mouse is clicked, which is precisely what I need it to do (in case someone is disabling cameras or clicking the "stop recording" menu option).

Originally Posted by dvk01

I would have thought the best solution would be password protect the dvr software to stop fiddling

I'd love to... unfortunately, that's not really possible with this system. Other systems allow you to control function availability on a per-user basis, but this DVR server software doesn't support that level of control. My only other option is to lock out access to the system entirely, and allow only the store manager access, which I've done to a degree using Transparent Screen Lock, but it's getting to the point that there's a suspicion there as well.

That isn't going to stop someone physically unplugging the camera

No, but that possibility is a stretch as well, since the power supply for the cameras is in the ceiling of the office, and the problem cameras are pretty high up and not accessible without a ladder... yet, it IS still a possibility.

The only other thing we can come up with is some bizarre wiring fault, possibly an error by the original installers, that's causing them to turn on and off with other devices (one camera actually seems to lose signal when there's nobody in the room, as if it's being powered off a motion sensor).

Experience suggests that a keylogger/monitoring system won't work in this case and I assume the cameras that turn off are monitoring where something that has been stolen or suspicious actions happen

That appears to be the case... we've still never been given exact details as to what they're looking for on the video, only that there are large gaps in the footage, at just the times they're trying to find evidence of something going on. I first suspected video files may be getting deleted, but in most of these cases the video for an entire day is captured within a single file, and the rest of the day is still there.

In that sort of situation, a PC based monitoring system isn't the best solution & a stand alone DVR kept in a locked secure cabinet with alarms that sound when a camera is disconnected from outsider of the dvr is one solution

I don't think we're going to sell them on a whole new system at this point. One of the benefits of rebuilding this machine, though, is an update to the DVR software itself that includes a feature to send email notices of video loss. I'll be activating that, for sure.

This one sounds like it needs a security consultant to visit the site

Yeah... that's me.

PC based monitoring of cameras is never any good with these sorts of situations, unless the PC is locked away & only a single trusted person has access to it

It's locked in the store office, where presumably only the manager has access to it... thus the need for activity monitoring.

And frankly, NO other sort of recording system is any more reliable in the same situation. Cameras can be just as easily disconnected from a MUX or standalone DVR, a tape can just as easily be removed from a VCR and disposed of, and any equipment can be just as readily unplugged, if it's not in some sort of locked box, or better, a locked cabinet/closet with the power outlets inside it... and yes, I have PC DVRs stashed in locked boxes as well (in fact, generally lock boxes that previously held MUX/DVR systems), as well as locked racks and cabinets and closets.

A lock box may be an option in this case as well, now that there's a problem and a specific suspicion, but even then, the manager would "need" to be able to access and control the system, which would defeat the purpose if the manager is the one under suspicion.

As I say, our hope is to convince the ownership to have us install a hidden camera to record to a different location to watch the DVR itself, but in the interim, this monitoring solution will have to do.

[rainforest123]

s:
I am not an electrician, but the camera are probably on a circuit breaker or fuse that can be disabled.

Is the manager there 24 x 7 x 366? If not, set a time access to the manager's account for the DVR that give the manager access only when the manager is scheduled.

I am not a crime fighter, either.


RF123

[Soundy]

The cameras USED to be powered by a series of wall-warts and inline transformers, plugged into a number of power bars, stuffed in the ceiling of the manager's office (this was NOT one of our installs - we sold the DVR to another sound-and-lighting company that wanted to get into the CCTV biz; they've since decided to get out of it and we're left cleaning up their mess). We originally thought that to be the root of the problem, as the affected cameras (not ALL of them exhibit this video loss issue) all appeared to be on the same power bar.

We then replaced all that mess with a single 12VDC, 16-channel Altronix unit... and the client is still complaining that certain cameras are dropping out at certain times.

[rainforest123]

I am unfamiliar with "wall - warts".

Recently, I tried to help someone establish file & printer sharing with AVG IS installed. I couldn't figure it out. Nothing I checked at AVG's web site worked.

Solution: uninstall AVG IS, establish F & P sharing; re-install AVG IS. Not eloquent, but it worked. Perhaps you need to start over. I wish a had an eloquent solution, Soundy.

Is there someway to provide an independent power supply to the devices involved? Perhaps you need a free standing generator. Perhaps the manager's access needs to be restricted. I will avoid further comments about pesonnel management because that is beyond my scope of expertise, as it relates to this topic.

RF123

[Soundy]

Originally Posted by rainforest123

I am unfamiliar with "wall - warts".

A common colloquialism for transformers that plug directly into the outlet. Like this, for example:


See also: http://en.wikipedia.org/wiki/Wall_wart

Recently, I tried to help someone establish file & printer sharing with AVG IS installed. I couldn't figure it out. Nothing I checked at AVG's web site worked.

Solution: uninstall AVG IS, establish F & P sharing; re-install AVG IS. Not eloquent, but it worked. Perhaps you need to start over. I wish a had an eloquent solution, Soundy.

I wish I could start over, but that would be a rather more expensive proposition. That will be a last resort for the client, methinks. I HAVE rebuilt the DVR from scratch - formatted drive on up - so that's a start.

Is there someway to provide an independent power supply to the devices involved? Perhaps you need a free standing generator.

Well, they're in an attic space that's accessible only from within a locked office using a 6' or taller stepladder... and at this point, all the cameras are on a single Altronix power supply, so the chance of just certain cameras losing power is pretty slim (unless there's something else inline that's interrupting it).

Perhaps the manager's access needs to be restricted. I will avoid further comments about pesonnel management because that is beyond my scope of expertise, as it relates to this topic.

RF123

Heh, well, we'll see where it goes from here. Thanks for all your input

[rainforest123]

S:
Thanks for the education.

Thanks for listening.

Please post your solution.

RF123

[Soundy]

Well, so far, I've got the activity logger that, among other functions, is uploading screenshots of any and all mouse clicks to my webserver, which will tell me if anyone is clicking on anything to stop the recording... and I have it set to email me if there's any video loss on any channels. So we'll see if that yields any fruit.

[rainforest123]

S:
Thanks for the update.

I hope you find the solution to this puzzle.

RF123