Conference PaperPDF Available

Analytical Approach to the Recovery of Data from CCTV File Systems

  • July 2016
DOI: 10.13140/RG.2.2.31446.65601
  • Conference: The 15th European Conference on Cyber Warfare and Security (ECCWS 2016)
  • At: Munich, Germany
Authors:
Nhien-An Le-Khac at University College Dublin
Nhien-An Le-Khac
Richard Gomm
Richard Gomm
Mark Scanlon at University College Dublin
Mark Scanlon
Tahar Kechadi at University College Dublin
Tahar Kechadi
Download full-text PDFDownload full-text PDF
Read full-text
Download citation

Figures

Ganz internal hard disk drive-MBR (Sector 0) The ASCII text AVTECH and FSS16A became relevant when it was established that the internal components of the Ganz DVR unit were manufactured with the brand AvTech. We conduct a search on both the branded company, Ganz and also the maker of the internal components AvTech. We realise that Ganz is a product brand of CBC America Corp. It would appear that the Ganz DVR unit model C-­-MPDVR-­-16 is an old product and as such there was very little information available on the unit. The only notable information is that the unit records with a MPEG format (http://en.cbc-­-cctv.com/uploads/tx_n21products/05_tab_088_01.gif). Of particular importance to this paper is a thread on the CCTVforums.com website (CCTVforums.com), which discusses retrieving data from AvTech based units. This thread identified that AvTech devices use a proprietary file system which has not been decoded, however AvTech had released a program to assist in the interrogation of such DVR hard drives. The program is called Disk Tools.exe and a download link was provided. We also use this tool to compare forensic results with our approach. Significantly the AvTech website also provides a warning that data may be destroyed if the DVR internal hard disk drive was connected to a PC and accessed. This would likely be due to Microsoft Windows trying to write a new recognised Master Boot Record to the hard disk drive on its initialization. In fact, our paper relates to a forensic examination with the use of a disk image created through a read only device. The actual Ganz DVR internal hard disk drive was never connected directly to any computer. 4. Forensic acquisition and analysis of Ganz CCTV: A Case study 4.1 Acquisition The forensic process we used in this section is adopted from the Ariffin's model (Ariffin et al 2013). In our experiment, we perform forensic acquisition and analysis of a Ganz DVR Unit. The first step is identification where a Ganz C-­-MPDVR-­-16 DVR was photographed. We also take the photos at various stages of the examination. Figure 2 shows the internal view of this Ganz DVR Unit. The next step is preservation. Within the law enforcement environment it is imperative that any data is recovered in a forensically-­-sound method. The general accepted criterion is that no changes are made to the original data source, and that any copies made are identical to the original data source. In our experiment, the Ganz DVR unit was seized from the working environment by law enforcement agents on the 4 th of April 2013
Ganz internal hard disk drive-MBR (Sector 0) The ASCII text AVTECH and FSS16A became relevant when it was established that the internal components of the Ganz DVR unit were manufactured with the brand AvTech. We conduct a search on both the branded company, Ganz and also the maker of the internal components AvTech. We realise that Ganz is a product brand of CBC America Corp. It would appear that the Ganz DVR unit model C-­-MPDVR-­-16 is an old product and as such there was very little information available on the unit. The only notable information is that the unit records with a MPEG format (http://en.cbc-­-cctv.com/uploads/tx_n21products/05_tab_088_01.gif). Of particular importance to this paper is a thread on the CCTVforums.com website (CCTVforums.com), which discusses retrieving data from AvTech based units. This thread identified that AvTech devices use a proprietary file system which has not been decoded, however AvTech had released a program to assist in the interrogation of such DVR hard drives. The program is called Disk Tools.exe and a download link was provided. We also use this tool to compare forensic results with our approach. Significantly the AvTech website also provides a warning that data may be destroyed if the DVR internal hard disk drive was connected to a PC and accessed. This would likely be due to Microsoft Windows trying to write a new recognised Master Boot Record to the hard disk drive on its initialization. In fact, our paper relates to a forensic examination with the use of a disk image created through a read only device. The actual Ganz DVR internal hard disk drive was never connected directly to any computer. 4. Forensic acquisition and analysis of Ganz CCTV: A Case study 4.1 Acquisition The forensic process we used in this section is adopted from the Ariffin's model (Ariffin et al 2013). In our experiment, we perform forensic acquisition and analysis of a Ganz DVR Unit. The first step is identification where a Ganz C-­-MPDVR-­-16 DVR was photographed. We also take the photos at various stages of the examination. Figure 2 shows the internal view of this Ganz DVR Unit. The next step is preservation. Within the law enforcement environment it is imperative that any data is recovered in a forensically-­-sound method. The general accepted criterion is that no changes are made to the original data source, and that any copies made are identical to the original data source. In our experiment, the Ganz DVR unit was seized from the working environment by law enforcement agents on the 4 th of April 2013
… 
Internal view of the Ganz C-­‐MPDVR-­‐16 DVR unit.
Internal view of the Ganz C-­‐MPDVR-­‐16 DVR unit.
… 
Overview of the AvTech Proprietary File System 4.2 Analysis The analysis took place on the clone hard disk drive, examining the information at the storage level to identify any recognised file signature. The key challenge with a proprietary file format is to locate the video streams without the assistance of predefined storage methods (FAT, NTFS etc.) 4.2.1 Initial Actions The cloned hard disk drive was opened within X-­‐Ways Forensics, EnCase and WinHex none of which were able to recognise the file system or any video file. So, we examine the first sector of a hard disk drive (Master Boot
Overview of the AvTech Proprietary File System 4.2 Analysis The analysis took place on the clone hard disk drive, examining the information at the storage level to identify any recognised file signature. The key challenge with a proprietary file format is to locate the video streams without the assistance of predefined storage methods (FAT, NTFS etc.) 4.2.1 Initial Actions The cloned hard disk drive was opened within X-­‐Ways Forensics, EnCase and WinHex none of which were able to recognise the file system or any video file. So, we examine the first sector of a hard disk drive (Master Boot
… 
Figures - uploaded by Mark Scanlon
Author content
All figure content in this area was uploaded by Mark Scanlon
Content may be subject to copyright.
AnalyticalApproachToTheRecoveryOfDataFromCCTVFileSystems (
1).pdf
Content uploaded by Mark Scanlon
Author content
All content in this area was uploaded by Mark Scanlon on Aug 26, 2016
Content may be subject to copyright.
ECCWS_An Analytical Approach to the Recovery of Data CCTV
FS.pdf
Content uploaded by Nhien-An Le-Khac
Author content
All content in this area was uploaded by Nhien-An Le-Khac on May 17, 2016
Content may be subject to copyright.
! !
!"#!"$%&'()$%#!**+,$)-#',#'-.#/.),0.+&#,1#2$'$#1+,3#4+5#6$+'&#6+,*+(.'$+&#7789#:(%.#;&<'.3<#
"#$%&'(!)*++,!-%#./01/!2.03%&$,!4&'5!6$&/7*/!&/(!408&%&'!3.$%&(#!
6$%**7!*9!:*+;<=.'!6$#./$.,!>/#?.'@#=A!:*77.B.!C<D7#/,!C<D7#/!E,!F'.7&/(!
'#$%&'(GB*++HB+&#7G$*+!
&/G7.5%&$H<$(G#.!
+&'5G@$&/7*/H<$(G#.!
=&%&'G5.$%&(#H<$(G#.!
!=<'+$)'>!1$$*'(#/B! =*! '.$./=!;'.(#$=#*/@,! =%.! B7*D&7! ?#(.*! @<'?.#77&/$.! +&'5.=! #@! .I;.$=.(! =*! '.&$%! JEKGLM!
D#77#*/! &//<&77A! DA! KLKLG! 8%.! +&'5.=! #@! .I='.+.7A! 9'&B+./=.(! N#=%! */7A! &'*</(! ELO! *9! =%.! +&'5.=! D.#/B!
&$$*</=.(! 9*'! DA! =%.! PQ! =*;! ?#(.*! @<'?.#77&/$.! .R<#;+./=! @<;;7#.'@! &@! #/!&/! &//<&7! '.;*'=! #@@<.(! DA! F46!
".@.&'$%G!8%.!'.+&#/#/B!+&'5.=!@%&'.!N&@!@;7#=!&+*/B@=!=%.!/<+.'*<@!*=%.'!@+&77.'!$*+;&/#.@!N%*!;'*?#(.!
::8S!@*7<=#*/@,!<@<&77A!&=!7*N.'!;'#$.@!=%&/!=%.#'!D'&/(!/&+.!$*</=.';&'=@G!8%#@!$*@=!$<==#/B!B./.'&77A!'.@<7=@!
#/! &! 7*N.'! @;.$#9#$&=#*/! *9! $*+;*/./=@G! ".$./=7A,! &/! #/?.@=#B&=#*/! N&@! </(.'=&5./! #/! '.7&=#*/! =*! &! @.'#*<@!
$'#+#/&7!*99./$.,!*9!N%#$%!@#B/#9#$&/=!?#(.*!9**=&B.!%&(!D../!$&;=<'.(!*/!&!::8S!C#B#=&7!S#(.*!".$*'(.'!TCS"UG!!
8%.! </#=! N&@! @.=<;! =*! @&?.! =%.! 7&@=! VP! (&A@! *9! 9**=&B.! =*! &/! #/=.'/&7! %&'(! ('#?.G! W*N.?.',! (.@;#=.! =%.!
'.9.'./$.(! 9**=&B.! D.#/B! N#=%#/! =%#@! =#+.9'&+ .,! #=! $*<7(! /*=! D.! 7*$&=.(G! ! 8%.! CS"! </#=! N&@! @<D+#==.(! 9*'!
9*'./@#$!.I&+#/&=#*/! &/(! (&=&!'.='#.?&7! *9! @;.$#9#.(! ?#(.*!9**=&B.! N%#$%,! &$$*'(#/B! =*!=%.! ;'*;'#.=&'A!?#(.*!
D&$5<;! &;;7#$&=#*/,! N&@! /*=! '.='#.?&D7.G! F/! =%#@! ;&;.',! N.! ;'.@./=! =%.! ;'*$.@@! &/(! +.=%*(! *9! =%.! 9*'./ @#$!
'.='#.?&7! *9! ?#(.*! 9**=&B.! 9'*+! &! CS"G! 8% .! *DX.$=#?.! *9! =%#@! +.=%*(! #@! =*! '.='#.?.! =%.! *7(.@=! ?#(.*! 9**=&B.!
;*@@#D7.!9'*+! &! ;'*;'#.=&'A! (.@#B/.(! 9#7.!@=*'&B.! @A@=.+G! Y.! &7@*!.?&7<&=.! *<'! &;;'*&$%!N#=%!&!)&/Z!::8S!
CS"!@A@=.+!+*(.7!:04[CS"0PM!=*!@%*N!=%&=!=%.!9#7.!@A@=.+!*9!&!CS"!%&@!D../!'.?.'@.(!./B#/..'#/B!N#=%!/*!
#/#=#&7!5/*N7.(B.,!&;;7#$&=#*/!*'!(*$<+./=&=#*/!&?&#7&D7.G!
!
?.&@,+5<>!::8S!9*'./@#$@,!::8S0CS"!9#7.!@A@=.+@!&/&7A@#@,!?#(.*!9#7.!$&'?#/B,!'.?.'@.0./B#/..'#/B!
!
AB#C"'+,5D)'(,"#
8%.!$7*@.(0$#'$<#=!=.7.?#@#*/!T::8SU!#@!&!?#(.*!@<'?.#77&/$.!@A@=.+!=%&=!$&/!D.!<@.(!9*'!&/A!=A;.!*9!+*/#=*'#/BG!!
F/!=%.!KLPK!&//<&7! '.;*'=! #@@<.(! DA! F46! ".@.&'$%,!&/!#/(.;./(./=!@<;;7#.'!*9! +&'5.=!'.@.&'$%,!#=! .@=#+&=.(!
=%&=!=%.!?#(.*! @<'?.#77&/$.! .R<#;+./=! +&'5.=! N&@! N*'=%! *?.'!J\!D#77#*/!#/!KLPLG! ].=! */7A! &'*</(!ELO!*9!=%.!
+&'5.=! N&@! &$$*</=.(! 9*'! DA! =%.! PQ!=*;! ?#(.*! @<'?.#77&/$.! .R<#;+./=! @<;;7#.'@! TF46!".@.&'$%! KLPKUG! 8%.!
'.+&#/#/B! +&'5.=! @%&'.! N&@! @;7#=! &+*/B@=! =%.! /<+.'*<@! *=%.'! @+&77.'! $*+;&/#.@! N%*! ;'*?#(.! ::8S!
@*7<=#*/@,!<@<&77A!&=! 7*N.'! ;'#$.@! '.@<7=#/B! 9'*+! &!7*N.'!@;.$#9#$&=#*/!*9!$*+;*/./=@G!8%.!&(?&/$.(! 9*'+@! *9!
::8S! /*'+&77A! <@.! C#B#=&7! S#(.*!".$*'(.'! TCS"U!=%&=! &77*N@! ::8S! ?#(.*! #+&B.@! &'.! '.$*'(.(!&/(! &'$%#?.(!
$*/=#/<*<@7A!9'*+!&77!$&+.'&@!9*'!\L!(&A@!*'!+*'.,!N#=%!&!?&'#.=A!*9!R<&7#=AG!8%.!::8S0CS"!(.?#$.@!&'.!N#(.7A!
<@.(!9*'! @<'?.#77&/$.! #/! &'.&@! =%&=!+&A!/..(!+*/#=*'#/B!@<$%! &@!D&/5@,!&#';*'=@,!+#7#=&'A! #/@=&77&=#*/@,! @=*'.@,!
.=$G!
!
".$./=7A,!&/!#/?.@=#B&=#*/!N&@! </(.'=&5./!#/!'.7&=#*/!=*!&!@.'#*<@! $'#+#/&7!*99./$.,!*9!N%#$%!@#B/#9#$&/=!?#(.*!
9**=&B.!%&(!D../! $&;=<'.(! */! &! )&/Z! ::8S! C#B#=&7!S#(.*!".$*'(.'!TCS"U!+*(.7!:04[CS"0PMG!!8%.!</#=!N&@!
@.=<;!=*!@&?.!=%.! 7&@=! VP! (&A@! *9! 9**=&B.! =*! &/! #/=.'/&7!%&'(!('#?.,!%*N.?.'! (.@;#=.! =%.! '.9.'./$.(! 9**=&B.!
D.#/B!N#=%#/!=%#@!=#+.9'&+.!#=!$*<7(!/*=!D.!7*$&=.(G!8%.!)&/Z!CS"!</#=!N&@!@<D+#==.(!9*'!9*'./@#$!.I&+#/&=#*/!
&/(!'.='#.?&7!*9!@;.$#9#.(!?#(.*!9**=&B.!N%#$%,!&$$*'(#/B!=*!=%.!;'*;'#.=&'A!?#(.*!D&$5<;!&;;7#$&=#*/,!N&@!/*=!
'.='#.?&D7.G!F/#=#&7! .I&+#/&=#*/! *9! =%. ! )&/Z! CS"! </#=,! </(.'! 9*'./@#$! $*/(#=#*/@,! '.?.&7.(! &! ; '*;'#.=&'A! 9#7.!
@A@=.+!#G.G!&!9#7.!@=*'&B.!@A@=.+!/*=!'.$*B/#@.(!&@!&/!#/(<@='A!@=&/(&'(G!!F/!=%&=!9&@%#*/!=%.!@=&/(&'(!=**7@!7#5.!
^/:&@.!T%==;@_``NNNGB<#(&/$.@*9=N&'.G$*+`U,!a0Y&A@!T%==;@_``NNNGI0N&A@G/.=`U!.=$G!N.'.!</&D7.!=*!'.$*?.'!
&/A! ?#(.*! 9**=&B.G!F/! 9&$=,! CS"b@! $*+.! 9'*+! &! +<7=#=<(.! *9! +&/<9&$=<'.'@,! .&$%! <@#/B! =%.#'! *N/! </#R<.!
?&'#&/=@!*9!D*=%!.R<#;+./=!&/(!@*9=N&'.G!F/!@*+.!$&@.!=%#@!;'.@./=@!&@!&/!#/(<@='A!@=&/(&'(!*;.'&=#/B!@A@=.+,!
@<$%!&@!2#/<I,!N%#$%!;'.@./=@!&@!&/!.&@A!9*'./@#$!'.='#.?&7!<@#/B!@=&/(&'(!=**7@G! ! W*N.?.'! #/! =%.! +&X*'#=A! *9!
$&@.@!=%.!9*'./@#$! #/?.@=#B&=*'! N#77! ./$*</=.'! &! ;'*;'#.=&'A! *'! ('&@=#$&77A!$*DD7.(0=*B.=%.'! *;.'&=#/B! @A@=.+!
N%#$%!;'*?#(.@!&!@#B/#9#$&/=!$%&77./B.!=*!(.$*(.G!8%.!7&==.'!#@!=%.!9*$<@!*9!=%#@!;&;.'G!!
!
8%.!=*;#$!*9!=%#@!;&;.'!&'.!=%.!::8S!@A@=.+@!(.@$'#D.(!#/!=%.!;'.?#*<@!;&'&B'&;%!&/(!#/!;&'=#$<7&'!=%.!9*'./@#$!
.I&+#/&=#*/! *9! &! )&/Z! ::8S! CS"! +*(.7! :04[CS"0PMG! 8%.! '.@.&'$%! ;'*D7.+! N&@! .@=&D7#@%.(! =*! '.?.'@.!
./B#/..'!T[**7.! .=! &7G! KLLc,! d.7=@.'!KLPLU! =%.! ;'*;'#.=&'A!9#7.! @A@=.+! &/(! .@=&D7#@%! =%.!(.=&#7@! *9! =%.!*7(.@=!
'.$*'(.(! ?#(.*! 9**=&B.! &?&#7&D7.! 9*'! '.='#.?&7G!1! @.$*/(&'A! *DX.$=#?.! N&@! @.=! #/! D.#/B! &D7.! =*! $&'?.! ?#(.*!
9**=&B.!9'*+!=%.!)&/Z!CS"!</#=b@!#/=.'/&7!%&'(!(#@5!('#?.!#/=*!&!;7&A&D7.!9*'+&=G!
!
!
!
e<'!;&;.'! #@!@.=!*<=! &@!9*77*N@_!6.$=#*/! K!@%*N@!'.7&=.(!N*'5!*9!::8S0CS"!9*'./@#$@G!Y.!(#@$<@@!*/!9*'./@#$!
=.$%/#R<.@! &;;7#.(! 9*'! ::8S0CS"!#/?.@=#B&=#*/@!&@! N.77! &@! 9*'./@#$!$%&77./B.@!#/! 6.$=#*/! VG! Y.! (.@$'#D.! &/(!
(#@$<@@!&!$&@.!@=<(A!*9!9*'./@#$!&$R<#@#=#*/! &/(! &/&7A@#@! *9! )&/Z!::8S! CS"!+*(.7!:04[CS"0PM!#/!6.$=#*/! EG!
f#/&77A,!N.!$*/$7<(.!&/(!(#@$<@@!*/!9<=<'.!N*'5!#/!6.$=#*/!QG!!
!
EB#/.%$'.5#@,+F#
!
1'#99#/!.=! &7! TKLPVU! (.@$'#D.!&! 9*'./@#$! =.$%/#R<.! =*! $&'?.! ?#(.*! 9#7.@!N#=%! =#+.@=&+;@G! Y#=%#/! =%#@! ;&;.',!
&<=%*'@!&7@*!;'*;*@.(!&/!.I=./@#*/!=*!=%.!(#B#=&7!9*'./@#$!9'&+.N*'5!.@=&D7#@%.(!DA!T4$3.++#@%,!"G!P\\\U,!
N%#$%!%&(!9*<'!@=.;@_!T#U!F(./=#9#$&=#*/,!T##U!;'.@.'?&=#*/,!T###U!&/&7A@#@!&/(!T#?U!;'.@./=&=#*/G!F=!#@!N#=%#/!6=.;!V_!
1/&7A@#@! =%&=! &<=%*'@!@;.$#9#$&77A! '.9.'./$.! =%.! #@@<.@! N#=%! ;'*;'#.=&'A! 9#7.! @A@=.+@G! C<.! =*! =%.! &+*</=! *9!
?&'#&D7.@! &/(! </5/*N/! @A@=.+@! &?&#7&D7.! #=! N*<7(! /*=! D.! 9.&@#D7.! =*! ;'*(<$.! &! =.$%/#$&7! B<#(.! =*! '.?.'@.!
./B#/..'#/B!&!;'*;'#.=&'A!9#7.!@A@=.+G!F/@=.&(!&!(.=&#7.(!&/&7A@#@!*9!=%.!'.R<#'.(!@=.;@!N&@!B#?./g!#/!@<++&'A!
=%.!9*77*N#/B! N&@! .@=&D7#@%.(_!T#U! f#'@=! =%.! DA=.! @=*'&B.! +.=%*(! +<@=!D.! (.=.'+#/.(! T7#==7.!`!D#B! ./(#&/Ug!T##U!
f#7.!@#B/&=<'.@!$&/!=%./!D.!(.'#?.(!&/(!<@.(!=*!$*''.7&=.!.&$%!9#7.!@#B/&=<'.!=*!=%.!$%&//.7!?#(.*!=%&=!$&;=<'.(!
=%.!@$./.!N#=%!=#+.@=&+;@!&/(!T###U!S#(.*! $*(.(! +<@=! D.! 7*$&=.(! &/(! #/@=&77.(G!F/! =%#@! ;&;.',! N.! ;'*?#(.@!
(.=&#7@!*9!=%.!&/&7A@#@!*9!=%.!)&/Z!CS"!</#=!$*/(<$=.(!#/!&$$*'(&/$.!N#=%!=%.!9'&+.N*'5!*<=7#/.(!DA!T1'#99#/!.=!
&7! KLPVUG!1/*=%.'! '.@.&'$%! N&@! ;.'9*'+.(! DA! C*/B./! TKLLcU! */! &! 6&+@</B! ::8S! @A@=.+G! ! 8%#@! '.@.&'$%!
9*$<@.@!%*N.?.'!*/!&!N.7705/*N/!9#7.!@A@=.+_!ext3G!F/!Y&/B!TKLL\U,!&<=%*'!9*$<@.(!*/!C#B#=&7!S#(.*!f*'./@#$@!
=%&=!$*<7(!&;;7A!#/!=%.!$*/=.I=!*9!::8S!9*'./@#$@G!
!
W&/! .=! &7! TKLPQU!;'.@./=! =%.!9*'./@#$! &/&7A@#@! *9! &! ::8S0CS"! *9! N%#$%! =%.! %&'(! (#@5! <@#/B! &! WF3SF6Fe-!9#7.!
@A@=.+G!1<=%*'@! &7@*!+./=#*/.(!#=!#@!&/! </5/*N/!9#7.!@A@=.+G!F/!=%#@!'.@.&'$%,!=%.A!#(./=#9A!=%.!@='<$=<'.!&/(!
+.$%&/#@+!*9!&!WF3SF6Fe-!9#7.!@A@=.+G!1<=%*'@!@%*N!+*'.*?.'!=%&=!=%.!;'*$.(<'.!#/!=%.!$&@.!&/&7A@#@!$&/!D.!
<@.9<7!=*!$*</=.'!&/=#09*'./@#$!&$=#?#=#.@G!8%#@!;&;.'!*/7A!%*N.?.'!9*$<@.@!*/!WF3SF6Fe-!9#7.!@A@=.+!=%&=!#@!/*=!
;*;<7&'!#/!?#(.*!@<'?.#77&/$.!(.?#$.@!#/!N.@=.'/!$*</='#.@G!!
!
".$./=7A,! 8*D#/! .=! &7G! TKLPEU!$*/(<$=.(! &! ::8S0CS"!9*'./@#$@G! 1<=%*'@! ;'*(<$.(! &! @%*'=! '.;*'=! #/=*! %#@!
.I&+#/&=#*/!*9!=%.! 9#7.! @A@=.+!<@.(!*/!=%.!)&/Z!#/=.'/&7! %&'(!(#@5!('#?.G!! 8%#@!'.;*'=!N&@!/*/0=.$%/#$&7!&/(!
&#+.(!9*'! =%.!7.B&7!#/?.@=#B&=#?.!9</$=#*/G!1<=%*'@!9*</(!=%&=! =%.!)&/Z!#/=.'/&7!%&'(!(#@5!('#?.! N&@!@;7#=!#/=*!
=%'..!'.B#*/@,!.&$%!*9!N%#$%!%&(!&!@;.$#9#$!&$=#*/_!T#U!".B#*/!P!h!(&=.!P!D7*$5,!T##U!".B#*/!K!h!!(&=.!K!D7*$5,!T###U!
".B#*/!V! h!!?#(.*! (&=&G! 8*! (&=.!=%.'.! #@! &/A!=.$%/#$&7! ;&;.'! =%&=! %&@! D../!;<D7#@%.(!DA!&<=%*'@!*/! %*N! =%.!
9#/(#/B@!N.'.!'.&$%.(g!#=!#@!D.7#.?.(!=%.A!<@.(!&!@*9=N&'.!=**7!=*!N&=$%!=%.!(#@5!&$$.@@!N%#7@=!<@#/B!=%.!1?8.$%!
;'*;'#.=&'A!&;;7#$&=#*/,!C#@58**7@G.I.,!=*!&$$.@@!&!$*;A!*9!=%.!)&/Z!#/=.'/&7!%&'(!(#@5!('#?.G!!8%#@!;'*$.@@!%&@!&!
(#@=#/$=!(#@&(?&/=&B.!&@!A*<!&'.!'.7#&/=!*/!=%.!C#@58**7@G.I.!;'*B'&++#/B,!N%#$%!#@!;'*?./!7&=.'!#/!=%#@!;&;.'!
=*!/*=!;'*?#(.!9<77!(.=&#7@!*9!=%.!*7(.@=!?#(.*!9**=&B.!&?&#7&D7.!9'*+!=%.!)&/Z!CS"!#/=.'/&7!%&'(!(#@5!('#?.G!!!
!
4B#7789G29/#1,+."<()<#
!
f*77*N#/B! =%.! 7#=.'&=<'.! @<'?.A! #/! 6.$=#*/! K,! N.! /*=#$.! =%&=! =%.'.! #@!?.'A! 7#==7.! #/9*'+&=#*/! &?&#7&D7.! */! =%.!
;'*;'#.=&'A!9#7.!@A@=.+!<@.(!DA!=%.!)&/Z!CS"!</#=,!*'!=%.!@;.$#9#.(!1?8.$%!%&'(!(#@5!('#?.!@A@=.+G!Y%#7@=!::8S!
9**=&B.! $&/! &/(!@%*<7(! D.! *D=&#/.(! =%'*<B%! =%.! ;'*;'#.=&'A! &;;7#$&=#*/!@%#;;.(! N#=%! .&$%! </#=,! =%#@!7.&?.@!
?.'A!7#==7.!'**+!9*'!9*'./@#$!.I&+#/&=#*/!&/(!7.&?.@!=%.!#/?.@=#B&=*'!&=!=%.!+.'$A!*9!;'*;'#.=&'A!;'*B'&++.'@G!
1((#=#*/&77A!=%.'.!+&A!'.+&#/!'.+/&/=@!*9!?#(.*!9**=&B.!N%#$%!&'.!/*=!$*+;7.=.!&/(!=%.'.9*'.!/*=!&?&#7&D7.!
=%'*<B%!&/A!@<$%!;'*;'#.=&'A!@A@=.+G!
!!
iA!'.?.'@.!./B#/..'#/B!=%.!1?8.$%!9#7.!@A@=.+!=%.!#/?.@=#B&=*'!*D=&#/@!9<77!&$$.@@!=*!&77!#/9*'+&=#*/!*/!=%.!CS"!
%&'(!(#@5!('#?.G!1((#=#*/&77A!=%#@!$&/!D.!(*/.!#/!&!9*'./@#$!+&//.'!&/(!N#=%*<=!=%.!/..(!=*!'.7A!*/!=%.!&D#7#=A!
*9!&/! </5/*N/! V'(! ;&'=A!;'*B'&++.'G!f*77*N#/B!=%.! 9*'./@#$!&$R<#@#=#*/!&!@&+;7.! *9! ?#(.*!9**=&B.!+<@=!D.!
.I='&$=.(! 9'*+! =%.! CS"! %&'(! (#@5! ('#?.! &/(! $*/?.'=.(! 9*'! ;7&AD&$5G! 8%#@! N#77! '.R<#'.! $*(.$,! %.&(.'@! &/(!
./$*(#/B!#(./=#9#$&=#*/G!
!
i.9*'.!7**5#/B! &=!&!$&@.! @=<(A!*/!9*'./@#$!&$R<#@#=#*/!&/(!&/&7A@#@!*9!)&/Z!::8S0CS"!#/!=%.!/.I=!@.$=#*/,! N.!
(#@$<@@!*/! =%.! #(./=#9#$&=#*/!*9!9#7.!@A@=.+@!*9! #/=.'/&7! %&'(! ('#?.!*9!)&/Z!::8S0CS"!T)&/Z!#/=.'/&7!%&'(! (#@5!
('#?.UG!F/!9&$=,!9#7.!@A@=.+@!@<$%!&@!f18PM,!f18VK,!-8f6,!Wf6,!^I=K!&'.!@*+.!.I&+;7.@!*9!#/(<@='A!@=&/(&'(!9#7.!
@A@=.+G! 8%.@.! 9#7.! @A@=.+@! &'.! <@.(! =*! 5..;! ='&$5! *9! N%.'.! (&=&! #@! 7*$&=.(! */! &! (#@5,! ;'*?#(#/B! &! ='..! 7#5.!
@='<$=<'.! $*+;'#@#/B! *9! 9#7.@! &/(! 9*7(.'@G! ^&$%! *9! =%.! #/(<@='A! @=&/(&'(! 9#7.! @A@=.+@! '.9.'./$.(! &D*?.! &'.!
!
!
'.R<#'.(!=*!#(./=#9A!=%.+@.7?.@!N#=%!&!</#R<.!%.I&(.$#+&7!$*(.!#/!=%.!4&@=.'!i**=!".$*'(!&=!=%.!D.B#//#/B!*9!
.&$%!%&'(!(#@5!('#?.G!! 8%#@! </#R<.! %.I&(.$#+&7! $*(.! #@! $*++*/7A! '.9.''.(!=*!&@!&!j4&B#$! 4&'5.'b! *'! j4&B#$!
iA=.b!TW&#(.'!.=!&7G!KLPKUG! W*N.?.',!9*'./@#$!.I&+#/&=#*/!*9!6.$=*'!L,!=%.!4&@=.'!i**=!".$*'(,!*9!=%.!#/=.'/&7!
%&'(!(#@5!('#?.!9'*+!=%.!)&/Z!::8S0CS"!$*/=&#/.(!/*!4&B#$!4&'5.'!&/(!=%.'.9*'.!(#(!/*=!$*/=&#/!*/.!*9!=%.!
#/(<@='A! '.$*B/#@.(! 9#7.! @A@=.+@G! F/! *'(.'! =*! ;'*B'.@@! #=! N*<7(! D.! &! '.R<#'.+./=! =*! '.?.'@.! ./B#/..'! =%.!
</5/*N/!9#7.!@A@=.+!<@.(!*/!=%.!#/=.'/&7!%&'(!('#?.G!F/!*'(.'!=*!(*!=%#@!A*<!+<@=!9#'@=!'.?#.N!%*N!&!9#7.!@A@=.+!
@=*'.@!(&=&G! F/!B./.'&7!D.9*'.!&! 9#7.!@A@=.+!$&/!D.! $'.&=.(!&!;&'=#=#*/! #@!'.R<#'.(!=*!@;.$#9A! %*N!+<$%!*9!=%.!
%&'(!('#?.!#@!=*!D.!<@.(G! !8%.@.!;&'=#=#*/@!.R<&=.!*<=!=*!&!@=&'=!;*#/=!T$A7#/(.'U!*/!=%.!%&'(! ('#?.!&/(! &/!./(!
;*#/=!T$A7#/(.'UG!e/$.!&!;&'=#=#*/!#@!#(./=#9#.(!#=!#@!;*@@#D7.!=*!.@=&D7#@%!=%.!$*/=./=!*9!.&$%!&'.&!&/(!%*N!=%.A!
'.7&=.!=*!.&$%!*?.',!D<#7(#/B!<;!&!;#$=<'.!*9!$*++</#$&=#*/!&@!=%.A!;'*B'.@@G!
!
C.@;#=.!4&@=.'!i**=!".$*'(!&'.&!*9!=%.!)&/Z!#/=.'/&7!%&'(!(#@5!('#?.!$*/=&#/@!/*!+&B#$!+&'5.'!=*!&@@#@=!#/!=%.!
#(./=#9#$&=#*/!*9!=%.!9#7.!@A@=.+,!=%.'.! #@!*=%.'!(&=&!N%#$%!B&?.!&!@=&'=#/B!;*#/=!9*'!'.@.&'$%G!8%.!4&@=.'!i**=!
".$*'(!*9! =%.! )&/Z!#/=.'/&7!%&'(! (#@5!('#?.!N&@!.I&+#/.(! #/! a0Y&A@!f*'./@#$!=**7,! #=! (#@;7&A.(! =%.! 9*77*N#/B!
Tf#B<'.!PU_!
!
!
!
:(HD+.#A>!!)&/Z!#/=.'/&7!%&'(!(#@5!('#?.!h!4i"!T6.$=*'!LU!
!
8%.!16:FF!=.I=!1S8^:W!&/(!f66PM1!D.$&+.!'.7.?&/=!N%./!#=!N&@!.@=&D7#@%.(!=%&=!=%.!#/=.'/&7!$*+;*/./=@!*9!
=%.! )&/Z! CS"! </#=! N.'.! +&/<9&$=<'.(! N#=%! =%.! D'&/(! 1?8.$%G! Y.! $*/(<$=!&! @.&'$%! */! D*=%! =%.! D'&/(.(!
$*+;&/A,! )&/Z! &/(! &7@*! =%.! +&5.'! *9! =%.! #/=.'/&7! $*+;*/./=@! 1?8.$%G! Y.! '.&7#@.! =%&=! )&/Z! #@! &! ;'*(<$=!
D'&/(!*9!:i:!1+.'#$&!:*';G!F=!N*<7(!&;;.&'!=%&=!=%.!)&/Z!CS"!</#=!+*(.7!:04[CS"0PM!#@!&/!*7(!;'*(<$=!&/(!
&@!@<$%!=%.'.!N&@!?.'A!7#==7.!#/9*'+&=#*/!&?&#7&D7.!*/!=%.!</#=G!8%.!*/7A!/*=&D7.! #/9*'+&=#*/!#@!=%&=! =%.! </#=!
'.$*'(@!N#=%!&!4[^)!9*'+&=!T%==;_``./G$D$0$$=?G$*+`<;7*&(@`=Ik/KP;'*(<$=@`LQk=&DkLcckLPGB#9UG!!!
!
e9!;&'=#$<7&'!#+;*'=&/$.!=*!=%#@!;&;.'!#@!&!=%'.&(!*/!=%.! ::8S9*'<+@G$*+!N.D@#=.!T::8S9*'<+@G$*+U,! N%#$%!
(#@$<@@.@!'.='#.?#/B!(&=&!9'*+!1?8.$%!D&@.(!</#=@G!8%#@!=%'.&(!#(./=#9#.(!=%&=!1?8.$%!(.?#$.@!<@.!&!;'*;'#.=&'A!
9#7.!@A@=.+!N%#$%!%&@!/*=!D../!(.$*(.(,!%*N.?.'!1?8.$%!%&(!'.7.&@.(!&!;'*B'&+!=*!&@@#@=!#/!=%.!#/=.''*B&=#*/!
*9!@<$%!CS"!%&'(!('#?.@G!8%.!;'*B'&+!#@!$&77.(!C#@5!8**7@G.I.!&/(!&!(*N/7*&(!7#/5!N&@!;'*?#(.(G!Y.!&7@*!<@.!
=%#@!=**7!=*!$*+;&'.!9*'./@#$!'.@<7=@!N#=%!*<'!&;;'*&$%G!
!
6#B/#9#$&/=7A!=%.!1?8.$%!N.D@#=.!&7@*!;'*?#(.@! &!N&'/#/B!=%&=!(&=&!+&A!D.!(.@='*A.(!#9!=%.!CS"!#/=.'/&7!%&'(!
(#@5!('#?.!N&@!$*//.$=.(!=*!&![:!&/(!&$$.@@.(G!8%#@!N*<7(!7#5.7A!D.!(<.!=*!4#$'*@*9=!Y#/(*N@!='A#/B!=*!N'#=.!&!
/.N!'.$*B/#@.(!4&@=.'!i**=! ".$*'(!=*!=%.!%&'(!(#@5!('#?.!*/!#=@!#/#=#&7#Z&=#*/G!!F/!9&$=,!*<'! ;&;.'!'.7&=.@!=*!&!
9*'./@#$!.I&+#/&=#*/! N#=%! =%.!<@.!*9! &! (#@5! #+&B.! $'.&=.(!=%'*<B%! &! '.&(! */7A! (.?#$.G!8%.! &$=<&7! )&/Z! CS"!
#/=.'/&7!%&'(!(#@5!('#?.!N&@!/.?.'!$*//.$=.(!(#'.$=7A!=*!&/A!$*+;<=.'G!
!
IB#:,+."<()#$)JD(<('(,"#$"5#$"$%&<(<#,1#K$"L#7789>#!#7$<.#<'D5&#
!
IBA#!)JD(<('(,"!
8%.! 9*'./@#$! ;'*$.@@! N.! <@.(! #/! =%#@!@.$=#*/! #@! &(*;=.(! 9'*+! =%.! 1'#99#/b@! +*(.7! T1'#99#/! .=! &7! KLPVUG! F/! *<'!
.I;.'#+./=,!N.! ;.'9*'+! 9*'./@#$! &$R<#@#=#*/! &/(! &/&7A@#@! *9!&! )&/Z! CS"! >/#=G! 8%.! 9#'@=!@=.;! #@! #(./=#9#$&=#*/!
N%.'.! &! )&/Z! :04[CS"0PM! CS"! N&@! ;%*=*B'&;%.(G! Y.! &7@*! =&5.! =%.! ;%*=*@! &=! ?&'#*<@! @=&B.@! *9! =%.!
.I&+#/&=#*/G!f#B<'.!K!@%*N@!=%.!#/=.'/&7!?#.N!*9!=%#@!)&/Z!CS"!>/#=G!
!
8%.! /.I=! @=.;! #@! ;'.@.'?&=#*/G! Y#=%#/! =%.! 7&N! ./9*'$.+./=! ./?#'*/+./=! #=! #@! #+;.'&=#?.! =%&=! &/A! (&=&! #@!
'.$*?.'.(!#/!&!9*'./@#$&77A0@*</(!+.=%*(G!!8%.!B./.'&7!&$$.;=.(! $'#=.'#*/!#@!=%&=!/*! $%&/B.@!&'.!+&(.!=*!=%.!
*'#B#/&7!(&=&!@*<'$.,!&/(!=%&=!&/A!$*;#.@!+&(.!&'.!#(./=#$&7!=*!=%.!*'#B#/&7!(&=&!@*<'$.G!F/!*<'!.I;.'#+./=,!=%.!
)&/Z!CS"!</#=!N&@!@.#Z.(!9'*+!=%.!N*'5#/B!./?#'*/+./=!DA!7&N!./9*'$.+./=!&B./=@!*/! =%.!E=%!*9!1;'#7!KLPV!
!
!
@%*'=7A!&9=.'!Lc_LL%'@G!!1!@='#$=!$%&#/!*9!$<@=*(A!9'*+!@.#Z<'.!=*!.I&+#/&=#*/!N&@!#/!;7&$.!&/(!/*!&$$.@@!=*!=%.!
)&/Z! CS"! >/#=! N&@! ;.'+#==.(G! f*'! =%#@! .I&+#/&=#*/! =%.! CS"@! #/=.'/&7! %&'(! (#@5! ('#?.! N&@! '.+*?.(! &/(!
$*//.$=.(!=*!&!9*'./@#$!(.?#$.!5/*N/!&@!&!N'#=.!D7*$5.'G!-.I=!&!D#=!$*;A!N&@!+&(.!*9!=%.!%&'(!(#@5!('#?.G!8%#@!
#@!&!+.=%*(!=*!./@<'.!=%&=!&/!.I&$=!$*;A!*9!=%.!./=#'.!%&'(!(#@5!('#?.!#@!;'*(<$.(g!#/$7<(#/B!&77!<@.(!&/(!<@.(!
@;&$.G!
!
#
:(HD+.#E>!!F/=.'/&7!?#.N!*9!=%.!)&/Z!:04[CS"0PM!CS"!</#=G!
!
!
!
:(HD+.#4>!e?.'?#.N!*9!=%.!1?8.$%!['*;'#.=&'A!f#7.!6A@=.+!
!
IBE#!"$%&<(<#
8%.!&/&7A@#@!=**5!;7&$.!*/!=%.!$7*/.!%&'(!(#@5!('#?.,!.I&+#/#/B!=%.!#/9*'+&=#*/!&=!=%.!@=*'&B.!7.?.7!=*!#(./=#9A!
&/A!'.$*B/#@.(!9#7.!@#B/&=<'.G!8%.!5.A! $%&77./B.!N#=%!&! ;'*;'#.=&'A! 9#7.! 9*'+&=! #@! =*! 7*$&=.! =%.! ?#(.*! @='.&+@!
N#=%*<=!=%.!&@@#@=&/$.!*9!;'.(.9#/.(!@=*'&B.!+.=%*(@!Tf18,!-8f6!.=$GU!
!
IBEBA C"('($%#!)'(,"<#
8%.!$7*/.(!%&'(!(#@5!('#?.!N&@!*;./.(!N#=%#/!a0Y&A@!f*'./@#$@,!^/:&@.!&/(!Y#/W.I!/*/.!*9!N%#$%!N.'.!&D7.!
=*!'.$*B/#@.!=%.!9#7.!@A@=.+!*'!&/A!?#(.*!9#7.G!6*,!N.!.I&+#/.!=%.!9#'@=!@.$=*'!*9!&!%&'(!(#@5!('#?.!T4&@=.'!i**=!
!
!
".$*'(UG!8%.!*/7A!#(./=#9#&D7.!(&=&!#/!=%.!@.$=*'!L!N&@!=%.!7&D.7!>1?8.$%!&/(!f66PM1G!-*!=.$%/#$&7!#/9*'+&=#*/!
N&@!*D=&#/&D7.,!*=%.'!=%&/!f66PM1!N%#$%!#@!&!;'*;'#.=&'A!9#7.!@A@=.+!*9!1?8.$%G!
#
IBEBE C5."'(1&("H#'-.#5$'$#
f<'=%.'! .I&+#/&=#*/! N&@! $*/(<$=.(! =*! '.?#.N! =%.! =A;.! *9! (&=&! ?#@#D7.G! Y.! 9*</(! =%.'.! &'.! =*=&77A! =%'..!
(#@=#/$=!&'.&@!*/!=%.!%&'(!('#?.g!=%.!9#'@=!$*/=&#/@!./='#.@!N%#$%!;'*?#(.! &!B./.'&7!(&=.!&/(!=#+.!9*'!'.$*'(.(!
9**=&B.!&/(!&!;*#/=.'!=*! =%.!@.$*/(!&'.&G!!8%.!@.$*/(!&'.&!;'*?#(.@!@.;&'&=.!./='#.@! $*/=&#/#/B!'.9#/.(!(&=.!
&/(! =#+.! @=&+;@! 9*'! .&$%! *9! =%.! #/(#?#(<&7! PM! $&+.'&@! ?#(.*! 9**=&B.! '.$*'(.(,! &/(! &! ;*#/=.'! =*! =%.! ?#(.*!
9**=&B.G!8%.!=%#'(!&'.&!$*/=&#/@!=%.!&$=<&7!?#(.*!9**=&B.!Tf#B<'.!VUG!C<.!=*!=%.!7#+#=&=#*/!*9!=%.!;&;.'!@#Z.,!N.!
(*!/*=!;'.@./=!#/!(.=&#7@!=%.!9*'./@#$!;'*$.@@!N.!<@.(!=*!7*$&=.!=%.@.!=%'..!&'.&@G!i.@#(.@,!=%.!+&#/!*DX.$=#?.!
*9!*<'!;&;.'!#@!=*!@%*N!%*N!=*!'.$*?.'!&/(!;7&AD&$5!=%.!'.$*?.'.(!?#(.*!(&=&G!
!
IBEB4#/.'+(.0("H#5$'$#
!
F/! *<'! .I;.'#+./=,!*/.! @.$*/(! ;.'#*(! =#+.9'&+.! '.='#.?&7! N&@! &==.+;=.(,! LE`LE`KLPV!Lc_LL_LL! %'@! =*!
Lc_LL_LP! %'@G! 8%.! (&=&! *9! =%#@! ;.'#*(! #@! 7*$&=.(! #/! @.$=*'! Kc,\lc,KLc! `! *99@.=! LVlEQcELlL! =%'<! =*! @.$=*'!
Kc,\lc,KPP!`!*99@.=!LVlEQcElKLG!iA!&/&7A@#@!*9!=%.!%.&(.'@!#/!=%*@.!@.$=*'@!N.!/*=#$.!=%&=!=%.!?#(.*!9**=&B.!
N&@!$&;=<'.(!&=!M!9'&+.@!;.'!@.$*/(G!8%#@!$&'?.(!(&=&!&7@*!'.?.&7.(!(<;7#$&=.!./='#.@!9*'!$&+.'&@!L:,!LC,!L^,!
Lf!*/!=%.!K/(!&/(!Q=%!9'&+.@,!'.;'.@./=.(!DA!DA=.@!P!*9!.&$%!./='A!@%*N#/B!ffG!!8%#@!;&==.'/!$*/=#/<.(!=%'*<B%!
&77!(&=&! &/(! #@!;*@@#D7A!'.$*'(#/B!&/! .''*'G!F/!*'(.'!=*! '.$*?.'! */.!@.$*/(!*9!?#(.*!9**=&B.! 9*'! $&+.'&!LL!TM!
9'&+.@!;.'!@.$*/(U!(&=&!'.R<#'.(!$&'?#/B!9'*+!=%.!9*77*N#/B!@.$=*'@_!
!
!
!
177!(&=&!N&@!$&'?.(!&/(!$*+;#7.(!#/=*!*/.!9#7.g!#=!=*=&77.(!KPGQ5!#/!@#Z.G!
#
IBEBI#7$+0.5#2$'$#C5."'(1()$'(,"#
F/! *'(.'! =*! #(./=#9A! =%.! (&=&! N#=%#/! =%.! $&'?.(! 9#7.,! N.! ='#.(! &! /<+D.'! *9! #/(<@='A! @=&/(&'(!&;;7#$&=#*/@!
#/$7<(#/B!4.(#&F/9*!LGlGM\,!)6;*=!?KGlL&,!S#(.*F/@;.$=*'!KGMGLGPK\G!W*N.?.',!/*/.!*9!=%.!&D*?.!@*9=N&'.!N&@!
&D7.!=*!(.=.$=!=%.!?#(.*!9*'+&=!$*/=&#/.(!#/!=%.!$&'?.(!9#7.,!#/(#$&=#/B!=%&=!#=!N&@!7#5.7A!&!;'*;'#.=&'A!./$*(#/BG!!!
8%.!)&/Z!CS"!@A@=.+!N&@!@<;;7#.(!N#=%!;'*;'#.=&'A!?#.N#/B!@*9=N&'.!$&77.(!S#(.*![7&A.'!4f:,!?.'@#*/!PGPGMGPG!
8%.! &;;7#$&=#*/! @=&=.(! #=! ;7&A.(! =%.! 9*77*N#/B! ;'*;'#.=&'A!9#7.! 9*'+&=@_!GS6E,! GS6^,! GCS",! G1S:,! GCSEG! 6*,! N.!
+&(.!9#?.! $*;#.@!*9!=%.!$&'?.(!(&=&!9#7.!&/(!.&$%! ;'*?#(.(! N#=%!*/.!*9!=%.! 9#?.!9#7.!.I=./@#*/@!&D*?.G! !8%.@.!
N.'.!=%./!7*&(.(!#/=*! S#(.*![7&A.'!4f:G!8%.!*/7A! @<$$.@@9<7!&$$.@@!N#=%#/!=%.! ?#(.*!;7&A.'!N&@!=%.!$*;A! *9!
=%.!$&'?.(!(&=&!B#?./!=%.!GCS"!.I=./@#*/G!8%<@!=%.!?#(.*!;7&A.'!#(./=#9#.(!=%.!$7#;!&@!D.#/B!9'*+!=%.!LE=%!1;'#7!
KLPV!&=! LcLL%'@! &@! .I;.$=.(,! #=! &7@*! (#@;7&A.(!=%&=!=%.! 9**=&B.! N&@! '.$*'(.(! #/! =%.!lKL! I! QlM! ;#I.7! 9*'+&=!
Tf#B<'.!EUG!!
i&@.(!*/! *<'! #/?.@=#B&=#*/,! =%.! )&/Z! CS"!#@! 7#@=.(!&@! '.$*'(#/B!#/!4[^)E!9*'+&=G!1!'.?#.N! *9!=%.!$&'?.(! 9#7.!
<@.(!;'.?#*<@7A!@%*N.(!=%&=!.&$%!@.B+./=!*9!?#(.*!(&=&!@=&'=.(!N#=%!=%.!%.I_!LL!!LL!!^L!!LPG!1$$*'(#/B!=*!=%.!
&D*?.!4[^)! 9#7.!%.&(.'!9*'+&=!T%==;_``+;.BG$%#&'#B7#*/.G*'B`U!&!@=&/(&'(!4[^)!9#7.!N*<7(!@=&'=!N#=%_!LL!!LL!!
LP! ! mmG! Y#=%! =%.! mm!D.#/B! '.;7&$.(! DA! =%.!'.7.?&/=! D#=! &D*?.,! N%#$%! 9*'! &! ?#(.*! @='.&+! N*<7(! D.! ^L! =*! ^f!
(.;./(#/B!*/!=%.!@='.&+G!!6*,!#9!N.!;7&$.!=%.!=N*!@.$=#*/@!*9!%.I!$*(.@!=*B.=%.'!=%.'.!#@!&!$7.&'!@#+#7&'#=A_!
!
:&'?.(!(&=&!9#7.!0!LL!!LL!!LL!!^L!!LP!
4[^)!f*'+&=!0! LL!!LL!!LL!!LP!!^L!T9#'@=!?#(.*!@='.&+U!
!
F=!N&@!;*@@#D7.!=%&=!=%.!)&/Z!CS"!@#+;7A!='&/@;*@.(!DA=.@!V!&/(!EG!!F/!*'(.'!=*!=.@=!=%#@!=%.*'A,!N.!<@.(!&!%.I!
.(#=*'!=*!+*(#9A!&!$*;A!*9!=%.!$&'?.(!(&=&!9#7.!@N&;;#/B!DA=.@! V! &/(! E! #/! .&$%! *9! =%.! @='.&+! %.&(.'@G! ! 8%#@!
+*(#9#.(! (&=&! N&@! @&?.(! &@!$&'?.(G+;B! 9#7.! &/(! &==.+;=.(! =*! D.! *;./.(! #/! &! /<+D.'! *9! +.(#&! ;7&A.'@G!
W*N.?.'! =%.! $&'?.(G+;B! 9#7.! N*<7(! /*=! ;7&AG! 8%.! $&'?.(G+;B! N&@! 9<'=%.'! &/&7A@.(! N#=%! =%.! ;'.?#*<@7A!
'.9.'./$.(! &;;7#$&=#*/! 4.(#&F/9*G! e/! =%#@!*$$&@#*/! 4.(#&F/9*! '.$*B/#@.(! =%.! $&'?.(G+;B! 9#7.! &@! &! 4[^)0[6!
@='.&+,!D<=! #=! '.9<@.(! =*! ;'*?#(.!&/A! (.=&#7@! *9! $*(.$!<@.(!9*'! ./$*(#/BG! F/(..(,!#=! &;;.&'.(! =%&=! =%.! )&/Z!
Sectors 959991976 +3
Sectors 959992277 +26
Sectors 959992461 +5
Sectors 959992544 +3
Sectors 959992616 +3
Sectors 959992704 +3
!
!
CS"!<@.@!&!;'*;'#.=&'A!$*(.$!9*'!./$*(#/B!&/(!@=*'#/B!=%.!?#(.*!@='.&+@!#/!=%.!CS"!9#7.!=A;.G!!f<'=%.'!'.@.&'$%!
N&@!'.R<#'.(!#/=*!=%.!&$=<&7!(&=&!@='.&+@,!#=!N&@!.7.$=.(!=*!&/&7A@.!=%.!9#'@=!VK!DA=.@!*9!=%.!@=&'=!*9!.&$%!?#(.*!
@='.&+!9*'!=N*! @;.$#9#$! $%&//.7@!T$%&//.7!P!n!KU! &=! &!@;.$#9#$!=#+.!TLc_LL%'@U! *?.'! &!E!(&A!;.'#*(!@;&//#/B! &!
+*/=%!$%&/B.!=*!;'*?#(.!&!'.9.'./$.!B<#(.!=*!(.$*(#/B!=%.!9#7.!%.&(.'G!!!
!
!
#
:(HD+.#I>#S#(.*![7&A.'!4f:!@%*N#/B!$&'?.(!(&=&!9#7.#
!
IBEBM#9(5.,#:(%.#N.$5.+#C"0.<'(H$'(,"##
F/! =%#@! .I;.'#+./=,! N.! .I='&$ =! =%.!9#'@=! VK! DA=.@! *9! =%.! ?#(.*! @='.&+! 9*'! $%&//.7! P! n! K! &=! LcLL%'@! */! =%.!
VL`LV`KLPV,!VP`LV`KLPV,!LP`LE`KLPV!&/(!LK`LE`KLPV!Tf#B<'.!QUG!!F/!*'(.'!=*!.@=&D7#@%!N%.=%.'!*99@.=@!VL!&/(!
VP!T=%.!7&@=!=N*!DA=.@_!LL!cLU!;'*?#(.!&!=#+.!@=&+;,!N.!'.='#.?.!(&=&!9'*+!=%.!$&+.'&!P!*/!=%.!VL=%!*9!4&'$%!
KLPV!9*'!.&$%!%*<'!'.$*'(.(!D.=N../!LcLL%'@!*/!=%.!VL=%!</=#7!LLLL%'@!*/!=%.!VP@=G!Y.!=%./!9#/(!=%&=!e99@.=!
VL!&/(!VP!N&@! 7#/5.(! =*! =%.! =#+.,!#=!N&@!$7.&'!=%&=! =%.! )&/Z! CS"! '.$*'(.(! =%.!%*<'!(#'.$=7A!</=#7!#=! '.&$%.(!
PMLL%'@G!1=!=%&=!;*#/=!#=!'.@.=@!*99@.=!VP!=*!LL!D<=!#/$'.&@.(!*99@.=!K\!DA!PG!F/!=%#@!9#'@=! =.@=,!N.!*/7A!9*$<@!*/!
%*<'@_!Lc_LL,!L\_LL,!PL_LL%'@!.=$G!8%.'.!N&@!/*!;'*?#@#*/!9*'!+#/<=.@!*'!@.$*/(@!=*!D.!&$$*</=.(G!F/!*'(.'!=*!
7*$&=.! =%.! +#/<=.! $%&/B.! &((#=#*/&7! (&=&! N&@! '.='#.?.(! @;7#==#/B! *<=! =%.! Lc_LL%'@! =#+.9'&+.! 9*'! =%.! VL=%!*9!
4&'$%!KLPVG!F/! '.?#.N#/B! =%.! '.@<7=@!N.!/*=#$.@!=%&=!*99@.=! VP! (#(! /*=! '.+&#/! &=! cL! &@!.I;.$=.(!#9!#=!N&@! =*!
#/(#$&=.!Lc_LL%'@G!-.#=%.'!N&@!*99@.=!VL!'.+&#/#/B!$*/@=&/=!N#=%!=%.!=#+.!@=&+;!9*'!+#/<=.@G!"&=%.'!*99@.=!VL!
&;;.&'.(! =*! #/#=#&77A! D.! '.$*'(#/B! @.$*/(@! N#=%#/! =%.! 9#'@=! +#/<=.!Lc_LL! h! Lc_LP%'@G! 8%#@! &;;.&'.(! =*! D.! #/!
(#'.$=!%.I!/*=&=#*/,!#G.G!LL!h!Vi!TC.$!LL!=*!Q\UG!!W*N.?.'!&=!=%.!D.B#//#/B!*9!Lc_LP%'@,!*99@.=!VL!D.$&+.!%.I!
ELG!8%./! &=! =%.!D.B#//#/B!*9!Lc_LK%'@,! *99@.=!VL!D.$&+.!%.I!cLG8%./! &=! =%.!D.B#//#/B!*9!Lc_LV%'@,! *99@.=! VL!
'.=<'/.(!=*! %.I!:LG!f#/&77A!&=!Lc_LE%'@!*99@.=!VL! '.@.=!=*! LLG!! F=!N&@!/*=.(!=%&=!*99@.=!VP! #/$'.&@.(!DA! P,!9'*+!
cL!=*!cPG!F/!?#@<&7!9*'+!*99@.=!VL!'.;'.@./=.(_!
!
W.I!LL!h!Vi!o!L!=*!Q\!6.$,!4#/<=.!L!
W.I!EL!h!li!o!L!=*!Q\!6.$,!4#/<=.!P!
W.I!cL!h!ii!o!L!=*!Q\!6.$,!4#/<=.!K!
W.I!:L!h!fi!o!L!=*!Q\!6.$,!4#/<=.!V!
!
8%.!&/&7A@#/B!*9! %.&(.'@! #@!@%*N/!#/!f#B<'.!MG! 8%.! (#99.'./$.!D.=N../!=%.!@=&'=@! *9! .&$%!$A$7.!N&@!/*=.(!&@!
(.$#+&7! MEG! ! TME,! PKc,! P\KUG! 8%.! ?&7<.! #/! @.$*/(@! $*<7(! D.! .@=&D7#@%.(!9'*+! =%.! %.I! $*(.! #/! =%. ! 9*77*N#/B!
+&//.'_!
!
^I&+;7._!*99@.=!VL!o!%.I!fi!o!C.$!KQP!
C.$!KQP!`!ME!T$A$7.U!o!P\K!'!Q\!
C.$!P\K!`!ME!o!V!
8%.'.9*'.!W.I!fi!o!V'(!4#/<=.!$A$7.,!Q\!@.$*/(@!
!
e99@.=!VP!N&@!$7.&'7A!'.$*'(#/B!=N*!@.;&'&=.!;*'=#*/@!*9!(&=&G!i#=!P!N&@!=%.!(#'.$=!%.I!?&7<.!*9!=%.!%*<'G!i#=!K!
N&@!&!'.$*'(!5..;.'!*9!%*N!+&/A!$A$7.@!*99@.=!VL!%&(!$*+;7.=.(!N#=%#/!=%&=!%*<'G!!
!
^I&+;7._!*99@.=!VP!o!%.I!c^!
i#=!P!'.&(@!%.I!c!o!(.$!c,!=%.'.9*'.!LcLL%'@G!i#=!K!'.&(@!%.I!^!o!(.$!PE,!=%.'.!PE!I!E!+#/<=.!$A$7.@!o!QM!
8#+.!@=&+;!N*<7(!'.&(_!!Lc_QM%'@!p!?&7<.!9'*+!*99@.=!VP!
!
!
VL=%!4&'$%!KLPV!h!LcLL%'@!
!
!VP@=!4&'$%!KLPV!h!LcLL%'@!
!
P@=!1;'#7!KLPV!h!LcLL%'@!
!
K/(!1;'#7!KLPV!h!LcLL%'@!
!
:(HD+.#MB#8%.!9#'@=!VK!DA=.@!*9!=%.!?#(.*!@='.&+!9*'!$%&//.7!P!n!K#
!
!
!
!
!
!
!
!
!
!
!
:(HD+.#OB#S#(.*!@='.&+!h!W.&(.'!1/&7A@#@#
!
-.I=,!7**5#/B!&=!&/!*?.'&77!.I&+;7.!N%.'.!N.!.I='&$=!&!?#(.*!%.&(.'!9'*+!6.$=*'!M\M,MMK,PLK!Tf#B<'.!lUG!F9!=%.!
&D*?.! #@! =*! D.! ;'*?./! =%./! =%.! ?#(.*! 9**=&B.! #/! 6.$=*'! M\M,MMK,PLK! @%*<7(! '.7&=.! =*! 9**=&B.! =&5./! &=!
Lc_VK_EK%'@G!6*!N.!'.?.'@.!=%.!7**5<;!+.=%*(!9*'!@.$=*'@!9'*+!(&=.G!Y.!%&?.!@.$=*'!M\M,MMK,PLK!o!W.I!K\!cM!
Vc!QM,!='&/@;*@.(!#/=*!7#==7.!./(#&/!9*'!@.&'$%!o!QM!Vc!cM!K\!;'*(<$.(!Tf#B<'.!cUG!
!
!
!
!
!
!
!
!
!
!
!
:(HD+.#PB#S#(.*!%.&(.'!9'*+!@.$=*'!M\M,MMK,PLK#
Appeared to show 0800 in reverse
format, same as time of clip
concerned.
Appeared to
remain the
same
throughout all
dates.
*99@.=!VP!@%*N@_!
i#=!P!h!%.I!c!o!C.$!Lc!
i#=!K!h!%.I!c!o!C.$!Lc!
!
8%.'.9*'.!=#+.!@=&+;!#@_!LcLL%'@!p!cIE!+#/<=.!$A$7.@!
o!Lc_VK%'@!p!EK!@.$*/(@!T?&7<.!9'*+!*99@.=!VLU!
o!Lc_VK_EK%'@!
*99@.=!VL!@%*N@_!
W.I!K1!o!EK!
EK!`!ME!o!L!'!EK!
8%.'.9*'.!%.I!K1!o!L!+#/<=.@!&/(!EK!@.$*/(@!
!
!
!
:(HD+.#QB#f**=&B.!1/&7A@#@#
!
8%#@!'.@<7=!.@=&D7#@%.(!=%&=!=%.!9**=&B.!#/! @.$=*'! M\M,MMK,PLK! N&@! 9*'! =%.! VL`LV`KLPV! &=! Lc_VK_EK%'@! &@! ;.'!
=%.!.I&+;7.!N*'5#/B@!&D*?.!&/(!(.+*/@='&=.@!=%.!=#+.!9</$=#*/!%&@!D../!$*''.$=7A!(.$#;%.'.(G!-.I=,!N.!&'.!
7**5#/B!&=! =%.!(&=.!@=&+;!&'=.9&$=@G!i&@.(!*/!=%.!=#+.!@=&+;!&/&7A@#@!#=!N&@!.?#(./=!=%&=!=%.!(&=.!@=&+;!N&@!
@*+.%*N! 7#/5.(! N#=%! *99@.=@! Kc! &/(! K\,! &/(! =%&=! PM_LL%'@! ;7&A.(! &! $'<$#&7! '*7.! #/! #/$'.&@#/B! =%.! *99@.=! Kc!
$*</=.'G!F/!*'(.'!=*!.@=&D7#@%!=%.!@A@=.+!<@.(!9*'!=%.!(&=.!@=&+;,!N.!=&5.!=%.!?#(.*!9**=&B.!9'*+!:&+.'&!P!&=!
LLLL%'@!&/(!PMLL%'@!*/!=%.!VL=%!4&'$%,!VP@=!4&'$%,!P@=!*9!1;'#7!&/(!K/(!*9! 1;'#7G!8%#@! @.7.$=#*/!N*<7(! ;'*?#(.!
9*<'!(&A!$%&/B.@!&/(!*/.!+*/=%!$%&/B.G!Tf#B<'.!\U!
!
!
:(HD+.#RB#W.I!(<+;!*9#S#(.*!9**=&B.!*9!9*<'!(&A@#
!
Y.! /*=#$.! =%&=! =%.! %.I&(.$#+&7! ?&7<.! ;'.@./=! #/! *99@.=! Kc! #/$'.&@.@! &=! LLLL%'@! &/(! PMLL%'@! *9! .&$%! (&AG!
W*N.?.'!=%.!(&=&!*9!*99@.=@!Kc,!K\!&/(!VL!(*!/*=!&;;.&'!=*!+&=$%! &/A! *9! =%.! #/(<@='A!(&=.!@=&+;! 9*'+&=@!
T>-Fa,! 460Ce6! .=$GU! &/(! #@! 7#5.7A! &! =#+.! $*</=.'! 9'*+! @*+.! ;*#/=! @.=! DA! =%.! +&/<9&$=<'.'G! f<'=%.'!
.I&+#/&=#*/!N*<7(!D.!'.R<#'.(!=*!.@=&D7#@%!=%.!(&=.!@=&+;!./$*(#/B!+.=%*(G!!
!
IB4#6+,*+(.'$+&#!**%()$'(,"#0<#:,+."<()#ST$3("$'(,"#
!
F/!=%#@!@.$=#*/,!N.!<@.!C#@58**7@G.I.!=*! .I&+#/.!=%.! )&/Z! CS"!</#=! #/=.'/&7! %&'(! (#@5! ('#?.!=*! $*+;&'.! N#=%!
*<'!9*'./@#$!'.@<7=@G!8%.!C#@58**7@G.I.!&;;7#$&=#*/!@=&=.(!=%&=!=%.!.&'7#.@=!&?&#7&D7.!?#(.*!9**=&B.!'.$*?.'&D7.!
N&@!9'*+!=%.!Pc=%!*9!4&'$%!KLPV!&=!LL_Ec_L\!%'@G!Tf#B<'.!PLU!
!
:(HD+.#AU>#C#@58**7@G.I.#!
!
!
6*! *<'! 9*'./@#$! &/&7A@#@!N&@! $*/(<$=.(! 9*'! =%.! (&=.! `! =#+.! @=&+;! LC! LV! PK! LL! VL! L\G!8%.! 9#'@=! '.9.'./$.!
&;;.&'.(!&=! 6.$=*'! MV,VEV! N%#$%! ;*#/=.(!=*! 6.$=*'! KV,\EV,LMc! &/(! 9#/&77A! =*!6.$=*'! \lV,Llc,QEV! N%.'.! =%.!
?#(.*!(&=&!N&@!7*$&=.(G!8%.!%.I!$*(.!9*'!=%.!=#+.!@=&+;!N&@!.R<&=.(!&@_!
LLLL%'@! p! TPKIEU+#/@! p! \@.$@! o! LL_Ec_L\! %'@,! N%#$%! N &@! #(./=#$&7! =*! =%.! =#+.@=&+;! .I;.$=.(G! 8%.! 9**=&B.!
@<BB.@=.(!DA!C#@58**7@G.I.!N&@! ?.'#9#.(G! F/! *'(.'! =*! =.@=! =%.! C#@58**7@G.I.! &$$<'&$A! =%.! ;'.?#*<@! =#+.@=&+;!
9'*+!6.$=*'!MV,VEV!N&@!=&5./!&/(!=%.!;*#/=.'@!9*77*N.(_!
!
!!
!
8%#@!;*#/=.(!=*!6.$=*'!KV,\VV,VVV_!
!
!!!!!!
!
8%#@!;*#/=.(!=*!6.$=*'!\lP,VLV,\cK!
!
!
!
8%#@!%&(!?#(.*!9**=&B.!;'.@./=,!N#=%!&!=#+.@=&+;!'.97.$=#/B!LL_LL%'@G! F/! *'(.'! =*! ?#.N! N%.=%.'! =%.! 9**=&B.!
N&@! =%.! $*''.$=! 9**=&B.! =%.! (&=&! N&@! .I='&$=.(! &/(! $*/?.'=.(! <@#/B! =%.! +.=%*(@! N#=%#/! =%#@! ;&;.'G! 8%.!
@.$=*'@!$*/$.'/.(!N.'._!6.$=*'!\lPVLV\cK! 0!TPL!@.$=*'@U,! 6.$=*'!\lPVLEPVc! 0!TM!@.$=*'@U,! 6.$=*'!\lPVLEKKL! 0!
TM!@.$=*'@U,!6.$=*'!\lPVLEVKL!0!TQ!@.$=*'@U,!6.$=*'!\lPVLEV\c!0!TQ!@.$=*'@U!&/(!6.$=*'!\lPVLEElQ!0!TQ!@.$=*'@UG!
!
8%.!$&'?.(!(&=&!N&@!@&?.(!=*!=%.!9#7.!LLLL%'@GCS"!&/(!*;./.(!#/!=%.!S#(.*![7&A.'G!!
!
!
:(HD+.#AAB#:&'?.(!(&=&!;7&AD&$5#
!
8%.!S#(.*! [7&A.'! (#@;7&A.(! 9**=&B.! 9'*+! =%.! Pc=%!4&'$%!KLPV!&=! LL_LL%'@G!8%#@!9**=&B.!N&@! /*=! '.='#.?&D7.!
=%'*<B%!=%.!C#@58**7@G.I.!&;;7#$&=#*/G!F/!*'(.'!=*!.@=&D7#@%!=%.!*7(.@=!?#(.*!9**=&B.!&?&#7&D7.!&!='#&7!&/(!.''*'!
@A@=.+!N&@!(.;7*A.(,!@=&'=#/B!N#=%!=%.!&==.+;=!=*!'.='#.?.!9**=&B.!9'*+!KVLL%'@!*/!=%.!Pl=%!4&'$%!KLPVG!!
!
6.$=*'!KV\KPKLQ!$*/=&#/.(!=%.!;*#/=.'!9*'!LC!LV!PP!Pl!LL!LL!*'!#/!/*'+&7!=.'+@!Pl=%!4&'$%!KLPV!&=!KVLL%'@G!!
6.$=*'!KV\KPKLQ!;*#/=.(!=*!6.$=*'!\M\LcV\KKG!6.$=*'!\M\LcV\KK!$*/=&#/.(!?#(.*!(&=&!N#=%!=%.!%.&(.'!*9_!
!
!
!
8%#@!%.&(.'!#/(#$&=.@!=%&=!=%.!9**=&B.!#@!9*'!KV_LL%'@!TLL!lL!N#=%!=%.!pPM%'@!9'*+!^VUG!8%.!/.I=!='#&7!&/(!.''*'!
@.&'$%!N&@!$*/(<$=.(!9*'!=%.!PM=%!*9!4&'$%!KLPV!&=!KVLL%'@G!6.$=*'!KVMVLPL\!$*/=&#/.(!=%.!;*#/=.'!9*'!LC!LV!
PL! Pl! LL! LL! &/(! ;*#/=.(! =*N&'(@! 6.$=#*/! \PMEQ\PMPG! W*N.?.'! 6.$=*'! \PMEQ\PMP! $*/=&#/.(! ?#(.*! (&=&!
N#=%*<=!&!%.&(.'_!
!
!
!
!
!
8%#@!(&=&!#@!$7.&'7A!/*=!&!@=&'=!*9!&!?#(.*!@='.&+!&@!=%.!LL!LL!^L!LP!@=&'=#/B!DA=.@!&'.!+#@@#/BG!f<'=%.'!'.&(#/B!
@%*N.(!=%&=!6.$=*'! \PMEQ\PMP!$*/=&#/.(! ?#(.*! (&=&! 9'*+!&!@='.&+!=%&=!@=&'=.(!#/! 6.$=*'! \PMEQ\PQl,! N%#$%!
$*/=&#/.(! &! =#+.@=&+;! 9*'! PK_QV_QP! %'@G!:*/=#/<#/B! =%.! ='#&7! &/(! .''*'! +.=%*(! .@=&D7#@%.(! =%&=! =%.! *7(.@=!
9**=&B.!&?&#7&D7.!N&@! 9'*+!KL_LL%'@!*/!=%.! Pl=%!*9!4&'$%!KLPVG!8%.'.9*'.!&/!&((#=#*/&7!E%'@!&/(! Ec!+#/<=.@!
*9!9**=&B.!N&@! &?&#7&D7.! =%'*<B%! +&/<&7! .I&+#/&=#*/! *9! =%.!)&/Z! CS"! %&'(! ('#?.,! $*+;&'.(!=*! =%.! *99#$#&7!
C#@58**7@G.I.! &;;7#$&=#*/G! F/! $'#+#/&7! #/?.@=#B&=#*/@! &/A! &((#=#*/&7! =#+.! '.$*?.'&D7.! +&A! '.@<7=! #/! $'<$#&7!
.?#(./$.,! N%#$%! #9! '.7#&/=! */! =%.! *99#$#&7! &;;7#$&=#*/! N*<7(! /*=! %&?.! D../! '.$*?.'.(G! Y%A! =%.! *99#$#&7! =**7!
+#@@.(!=%.@.!E%'@!&/(!Ec!+#/<=.@!N&@!$*/$.'/#/B!@*!9<'=%.'!#/?.@=#B&=#*/!N&@!$*/(<$=.(G!!
!
MB#7,")%D<(,"#$"5#:D'D+.#@,+F#
!
F/!=%#@!;&;.'!N.!;'*;*@.(!&! /.N!+.=%*(!*9!'.?.'@.!./B#/..'#/B!=%.!;'*;'#.=&'A!9#7.!@A@=.+!*9!&!::8S!C#B#=&7!
S#(.*! ".$*'(.'G! iA! $*/(<$=#/B! =%.! .I&+#/&=#*/! &@! @%*N/!#/! =%#@! ;&;.'!=%.! 9#7.! @A@=.+! %&@! D../! '.?.'@.(!
./B#/..'.(! N#=%! /*! #/#=#&7! 5/*N7.(B.,! &;;7#$&=#*/@! *'! (#'.$=#*/@! &?&#7&D7.G! f<'=%.'! #=! %&@! D../! '.?.'@.(!
./B#/..'.(! =*! &! @<99#$#./=! (.B'..! =*! &77*N! 9*'! =%.! #(./=#9#$&=#*/! &/(! '.='#.?&7! *9! ?#(.*! 9**=&B.! 9'*+! &/A!
@;.$#9#.(!$&+.'&! 9*'!&/A!@;.$#9#.(! (&=.!'.$*'(.(!N#=%*<=!=%.!<@.!*9!&/A! ;'*;'#.=&'A!&;;7#$&=#*/@G!! Y%#7@=!=%#@!
;&;.'!N&@!</&D7.!=*!.?#(./$.!%*N!=*!(.$*(.!=%.!(&=.!@=&+;!9'*+!N#=%#/!=%.!&$=<&7!?#(.*!9**=&B.!(&=&,!=%#@!#@!
&!'.(</(&/=!@=.;!&@!=%.!(&=.!&/(!=#+.!@=&+;@!&'.!&?&#7&D7.!9'*+!=%.!9#'@=!=N*!7*$&=*'@!&@!'.9.'./$.(!#/!6.$=#*/!
EG!!f<'=%.'!'.@.&'$%!#/=*!=%.!&$=<&7!?#(.*!(&=&!@='.&+!+&A!'.?.&7!%*N!=%.!(&=.!@=&+;!#@!'.$*'(.(,!=%#@!N*<7(!
&@@#@=! N%./! ;'.@./=.(! N#=%! &! '&N! ;&'=#&7! (&=&! @='.&+! N&@! ;'*?#(.(!9*'! .I&+#/&=#*/! #G.G! /*! 7*$&=*'! (&=&! #@!
&?&#7&D7.!(<.!=*!(&+&B.(!%&'(!('#?.!.=$G!!e?.'&77!=%.!'.@<7=@!&'.!(#'.$=7A!='&/@9.'&D7.!=*!&/A!::8S!C#B#=&7!S#(.*!
".$*'(.'!@A@=.+! =%&=! <@.@! =%.! 1?8.$%!9#7.!@A@=.+G!! Y#=%! +#/*'! &7=.'&=#*/@!=%.!;'*$.@@!$*/=&#/.(! N#=%#/! =%#@!
;&;.'!$&/!D.!<=#7#@.(!N#=%!&/A!;'*;'#.=&'A!9#7.!@A@=.+G!Y.!&'.!&7@*!7**5#/B!&=!$*+D#/#/B!@#+#7&'!&;;'*&$%.@!#/!
S.%#$7.! f*'./@#$@! Tq&$*D@! KLPMU! &/(! 4*D#7.! C.?#$.! f*'./@#$@! Tf&%..+! KLPQ,! 6B&'&@! KLPQU! =*! #+;'*?.! *<'!
+.=%*(G!!
!
/.1.+.").<#
!
1'#99#/,! 1G,! 67&A,! qG,! :%**,! 303G!TKLPVU,! C&=&! ".$*?.'A!9'*+! ['*;'#.=&'A! f*'+&==.(! ::8S!W&'(! C#@5@!C#B#=&7!
f*'./@#$@,!:%&;=.'! #/!1(?&/$.@!#/!C#B#=&7! f*'./@#$@!Fa,!S*7<+.! EPL! *9!=%.!@.'#.@!FfF[! 1(?&/$.@!#/!F/9*'+&=#*/!
&/(!:*++</#$&=#*/!8.$%/*7*BA!;;G!KPV0KKV!
[**7.,!-G"G,! d%*<,!rG!&/(! 1D&=#@,![G!!TKLLcU,!1/&7A@#@!*9!::8S! (#B#=&7! ?#(.*!'.$*'(.'!%&'(!(#@5! @=*'&B.! @A@=.+,!
C#B#=&7!F/?.@=#B&=#*/,!?*7GQ,!/*GP,!;;G!cQ0\K,!4&A!KLLcG!
4$3.++#@%!"G!TP\\\U!Y%&=!#@!9*'./@#$!$*+;<=#/Bm8'./(@!n!F@@<.@!#/!:'#+.!&/(!:'#+#/&7!q<@=#$.!P\\\gPPc_P0MG!
C*/B./,!YG!6G!S! TKLLcU!:&@.! 6=<(A_! f*'./@#$! 1/&7A@#@! *9! &! 6&+@</B! (#B#=&7! ?#(.*! '.$*'(.',! q*<'/&7! *9! C#B#=&7!
F/?.@=#B&=#*/,!?*7G!Q,!;;G!P\0Kc,!KLLcG!
Y&/B,!YG!TKLL\U,!C#B#=&7!S#(.*!f*'./@#$@,![%CG!8%.@#@,!C&'=%+*<=%!:*77.B.,!-.N!W&+;@%#'.,!>61,!q</.!KLL\!
W&/,! qG,! q.*/B,!CG!&/(! 2..,! 6G! TKLPQU! 1/&7A@#@! *9! =%.!WF3SF6Fe-! CS"! f#7.! 6A@=.+,! C#B#=&7! f*'./@#$@! &/(! :AD.'!
:'#+._!l=%!F/=.'/&=#*/&7!:*/9.'./$.,!F:CfK:!KLPQ!
8*D#/,! 2G,! 6%*@%&,! 1G,! )7&(A@%.?,! [G,! TKLPEU! ".?.'@.! ./B#/..'#/B! &! ::8S! @A@=.+,! &! $&@.! @=<(A,! C#B#=&7!
F/?.@=#B&=#*/!?*7GPPTVU!!;;G!Pl\0PcM!
W&#(.',!C'G!,!1703%&=..D!4G,!TKLPKU!1/&7AZ#/B!=%.!4&@=.'!i**=!".$*'(,!Y.D@;&$.,!KLPK!
::8S9*'<+@G$*+!%==;_``NNNG$$=?9*'<+G$*+`?#.N=*;#$G;%;m9oQMn=oKElPl!
F46!".@.&'$%!TKLPKU,!8'./(@!9*'!KLPK!
d.7=@.',! 2G! TKLLPU! s".?.'@.! ^/B#/..'#/B! 4&7N&'.t! %==;@_``Z.7=@.'G$*+`'.?.'@.0./B#/..'#/B0+&7N&'.0
+.=%*(*7*BA`!
q&$*D@!TKLPMU!q&$*D@,! CG,!2.03%&$G!-01G,!S.%#$7.!^/=.'=&#/+./=!6A@=.+!f*'./@#$@_!1!:&@.!6=<(A!*9!S*75@N&B./!
1<=*+*D#7.,! 8N.79=%! 1//<&7! FfF[! Y)! PPG\! F/=.'/&=#*/&7! :*/9.'./$.! */! C#B#=&7! f*'./@#$@,! -.N! C.7%#,! F/(#&,!
q&/<&'A!KLPM!
f&%..+! TKLPQU! f&%..+,! 4G,! 3.$%&(#! 4G,! 2.03%&$,! -01G,! 8%.! 6=&=.! *9! =%.! 1'=! f*'./@#$! 8.$%/#R<.@! #/! 4*D#7.!
:7*<(! ^/?#'*/+./=_! 1! 6<'?.A,! :%&77./B.@! &/(! :<''./=! 8'./(@,! F/=.'/&=#*/&7! q*<'/&7! *9! C#B#=&7! :'#+.! &/(!
f*'./@#$@!TFqC:fU,!S*7!lTKU!;GP0P\!
6B&'&@!TKLPQU,!6B&'&@!:G,! 3.$%&(#,!408G,!2.03%&$,! -01G!f*'./@#$@!1$R<#@#=#*/!&/(! 1/&7A@#@!*9!F/@=&/=!4.@@&B#/B!
&/(!S*F[!1;;7#$&=#*/@,!:*+;<=&=#*/&7!f*'./@#$@,!6;'#/B.'!F/=.'/&=#*/&7![<D7#@%#/B,!KLPQ!;GPcc0P\\!
... Retrieving evidence from CCTV storage is a difficult task. Interested readers are referred to [8] for an approach for carving the deleted video footprint in a proprietary CCTV filesystem. ...
Internet of Things Forensics – Challenges and a Case Study: 14th IFIP WG 11.9 International Conference, New Delhi, India, January 3-5, 2018, Revised Selected Papers
Chapter
  • Aug 2018
During this era of the Internet of Things, millions of devices such as automobiles, smoke detectors, watches, glasses and webcams are being connected to the Internet. The number of devices with the ability of monitor and collect data is continuously increasing. The Internet of Things enhances human comfort and convenience, but it raises serious questions related to security and privacy. It also creates significant challenges for digital investigators when they encounter Internet of Things devices in criminal scenes. In fact, current research focuses on security and privacy in Internet of Things environments as opposed to forensic acquisition and analysis techniques for Internet of Things devices. This chapter focuses on the major challenges with regard to Internet of Things forensics. A forensic approach for Internet of Things devices is presented using a smartwatch as a case study. Forensic artifacts retrieved from the smartwatch are analyzed and the evidence found is discussed with respect to the challenges facing Internet of Things forensics.
View
... Retrieving properly artifacts from CCTV's storage devices is still a challenges. We also show in [21] a new approach to carve the deleted video footprint a proprietary designed file storage system. ...
Internet of things forensics: Challenges and Case Study
Article
  • Jan 2018
Today is the era of Internet of Things (IoT), millions of machines such as cars, smoke detectors, watches, glasses, webcams, etc. are being connected to the Internet. The number of machines that possess the ability of remote access to monitor and collect data is continuously increasing. This development makes, on one hand, the human life more comfort- able, convenient, but it also raises on other hand issues on security and privacy. However, this development also raises challenges for the digital investigator when IoT devices involve in criminal scenes. Indeed, current research in the literature focuses on security and privacy for IoT environments rather than methods or techniques of forensic acquisition and analysis for IoT devices. Therefore, in this paper, we discuss firstly different aspects related to IoT forensics and then focus on the cur- rent challenges. We also describe forensic approaches for a IoT device smartwatch as a case study. We analyze forensic artifacts retrieved from smartwatch devices and discuss on evidence found aligned with challenges in IoT forensics
View
Identifying Desired Timestamps in Carved Digital Video Recorder Footage
Chapter
  • Jul 2022
Closed-circuit television cameras conduct round-the-clock surveillance to capture video evidence of illegal activities and suspects. The camera outputs are processed and stored on hard drives in standalone digital video recorders. As closed-circuit television cameras operate continuously, video files are constantly stored on the hard drives, with the new files periodically overwriting older files. The partially-overwritten files, which are present in slack space, can be recovered via data carving. However, the majority of the recovered video files are often fragmented. Unlike a normal video stream, a recovered video stream comprises frames that are not in chronological order. As a result, it is very tedious for a digital forensic professional to manually locate frames of interest. This chapter describes a method for identifying timestamps in carved digital video recorder footage. Experimental results using a Python implementation demonstrate the efficiency of timestamp identification and its effectiveness at recreating video footage.
View
CCTV Forensics in the Big Data Era: Challenges and Approaches
Chapter
  • Jul 2020
The video security market has seen rapid expansion over the last few years, expanding from the old analogue into new and emerging IP systems whilst running on multiple platform digital video recorders (DVR) of both Open and Proprietary format. Accordingly to the 2017 video surveillance report from IFSEC Global (https://www.ifsecglobal.com/video-surveillance-report-2017), for example, proprietary formats accounted for 56% of their surveyed responses. It is primarily within these proprietary formats that numerous challenges arise with the forensic acquisition and analysis of the closed circuit television camera (CCTV) data. Such challenges are expanded when consideration is given to the volume of data and the complexity of data due to the different manufacturers, data formats, file systems, volume storage methods, etc. In this paper, we review current approach on CCTV forensics in literature, and identify challenges of CCTV forensics in the context of big data forensics. Then, we describe a new forensic process/workflow for acquiring and analysing artefacts from large amounts data from CCTV devices of different models/manufacturers, prior to presenting and analysing three real world case studies.
View
View
View
Data Recovery from Proprietary Formatted Cctv Hard Disks
Conference Paper
Full-text available
  • Jan 2013
Digital video recorders (DVRs) for closed-circuit television (CCTV) commonly have an in-built capability to export stored video files to optical storage media. In the event that a DVR is damaged, its contents cannot be easily exported. This renders the forensically-sound recovery of proprietary-formatted video files with their timestamps from a DVR hard disk an expensive and challenging exercise. This paper presents and validates a technique that enables digital forensic practitioners to carve video files with timestamps without referring to the DVR hard disk filesystem. © IFIP International Federation for Information Processing 2013.
View
The State of the Art Forensic Techniques in Mobile Cloud Environment: A Survey, Challenges and Current Trend
Article
Full-text available
  • Apr 2015
Smartphones have become popular in recent days due to the accessibility of a wide range of applications. These sophisticated applications demand more computing resources in a resource constraint smartphone. Cloud computing is the motivating factor for the progress of these applications. The emerging mobile cloud computing introduces a new architecture to offload smartphone and utilize cloud computing technology to solve resource requirements. The popularity of mobile cloud computing is an opportunity for misuse and unlawful activities. Therefore, it is a challenging platform for digital forensic investigations due to the nonavailability of methodologies, tools and techniques. The aim of this work is to analyze the forensic tools and methodologies for crime investigation in a mobile cloud platform as it poses challenges in proving the evidence
View
Reverse engineering a CCTV system, a case study
Article
Given a disk image of a CCTV system with a non-standard file system, how is the data interpreted? Work has been done in the past detailing the reverse engineering of proprietary file systems and on the process of recovering data from CCTV systems. However, if given a disk image without the CCTV system itself, or if under time constraints, the task becomes much more difficult. This paper explains a different approach to recovering the data and how to make sense of data on a CCTV disk. The method does not require extensive reverse engineering of the CCTV system, or even to have access to the CCTV system itself.
View
Reverse Engineering Malware
Article
This document discusses tools and techniques useful for understanding inner workings of malware such as viruses, worms, and trojans. We describe an approach to setting up inexpensive and flexible laboratory environment using virtual workstation software such as VMware, and demonstrate the process of reverse engineering a trojan using a range of system monitoring tools in conjunction with a disassembler and a debugger. Portions of this document are based on the paper that we submitted to GIAC as part of a practical assignment for obtaining a GCIH Certification. For more information see http://www zeltser com
View
Analysis of CCTV digital video recorder hard disk storage system
Article
A commercial closed circuit television digital video recorder was investigated to determine if it was possible to extract useful video data from its storage media without access to the manufacturer's application software. After an initial test period the storage disk was removed, imaged and analysed. The file structure of the storage disk was deduced and the features necessary to locate a sequence of video evidence identified.The format of video data from the device was considered and shown to be based upon standard compression technologies. The observed format was fully documented to enable further development. With a little extra effort in processing the raw video data it was shown how video sequences could be extracted for use as evidence even in cases where the recording device is no longer functional, the turnkey software not available, or data partly corrupted. With careful application standard media players can be employed to view the resulting video sequences.Conclusions are that, while based on proprietary file systems and video formats, data from digital video recorder systems is amenable to analysis using commonly available computer tools. In return for investigative work there is a reasonable probability of being able to recover usable video from systems. There is also scope for the development of more specialised software tools to facilitate this process.
View
Case study: Forensic analysis of a Samsung digital video recorder
Article
In May 2007, a case of potential child abuse was reported to the hospital where the victim was under observation. The child had been in the hospital for several months and there was hope that a digital video recorder (DVR) may have recorded the maltreatment of a hospitalized child. Unfortunately the recordings could not be found on the device by hospital security employees. The DVR was given to digital forensic examiners in an effort to recover footage. This article details how the system was examined, describing the steps that were taken to obtain information and how the information was interpreted. The methods described in this article can be applied to other similar devices.
View
What is forensic computing?Trends & Issues in Crime and Criminal Justice
  • Jan 1999
  • 1-6
  • R Mckemmish
McKemmish R. (1999) What is forensic computing?Trends & Issues in Crime and Criminal Justice 1999;118:1--6.
Analyzing the Master Boot Record
  • Jan 2012
  • Dr Haider
  • M Al--Khateeb
Haider, Dr., Al--Khateeb M., (2012) Analyzing the Master Boot Record, Webspace, 2012