Recover Deleted Honeywell DVR and NVR FootageThree Platforms Under One Badge, and What the 2026 Forensic Study Found
Honeywell puts its name on recorders built by Hikvision, by Dahua and by itself. A 2026 forensic paper on the newest of those found something useful for every owner: none of the recorder's deletion methods touch the video data region, and footage survives even a format. This guide explains how to tell which Honeywell platform you have and how the recordings come off the drive.
Deleted Honeywell DVR or NVR footage is recoverable until the recorder overwrites it. A 2026 forensic study of a Honeywell NVR found that none of its deletion methods erase the video data region and that recordings survive even a format. Honeywell recorders span Hikvision-built, Dahua-built and Honeywell's own 35 Series layouts, so identify the unit first. In every case the drive comes out, goes into a Windows PC unformatted and is read by software that recognises the layout.
Honeywell sells recorders into offices, banks and campuses under one badge and several different platforms underneath. The Performance Series HRG DVRs were sourced from Hikvision, the HQA and many low-cost NVRs from Dahua, the MAXPRO range runs on Windows and the newer 35 Series NVRs carry Honeywell's own disk layout. Recovery on a Honeywell drive starts with working out which of those you hold, and this page covers all of them.
Which platform is your Honeywell recorder built on?
- HRG and HRGX Performance Series DVRs. IPVM integrators identify the older HRGx line as Hikvision-built, with the 960H HRGX series launched in 2014. Hikvision's drive layout applies: a master sector, a tree index and video in blocks of about 1 GB. The Hikvision recovery guide is the companion page.
- HQA and Performance Series NVR kits. IPVM reported in 2014 that Honeywell released Performance Series NVR kits from Dahua, and an integrator described the HQA line as Dahua. Those drives carry the Dahua DHFS layout covered in the Dahua recovery guide. The HEN Performance Series NVRs take two drives up to 6 TB each and run embedded Linux.
- 35 Series NVRs (HN35). Honeywell's NDAA-compliant line, made in Vietnam, with its own disk layout described in the DFRWS paper below.
- MAXPRO NVR. A Windows 10 IoT machine with SQL Server and hardware RAID. Its drives are NTFS volumes and a different kind of job altogether.
What did the forensic study of the Honeywell 35 Series find?
Jinhee Yoon and Sungjae Hwang of Sungkyunkwan University presented a paper at DFRWS USA 2026 titled Forensic analysis of video data deletion and recovery in Honeywell surveillance file system, built around an HN35080200 NVR with eight Honeywell cameras. The drive uses a GPT layout with a machine data record at sector 34. Partition one is the proprietary video store: a header in the first 16 KB, a video block list, a channel list, a record state table and the video data region starting at offset 0x80000000. Partition two is a fixed 10 GB ext4 file system that has nothing to do with video, and about 2 GB at the end of the drive is unpartitioned. Frames carry a 20-byte custom header and streams are separated by 20 zero bytes.
The paper's findings on deletion are the ones that matter. Formatting deletes all stored video and does not support partial deletion. It changes the partition GUIDs, resets the header, removes the indexes and starts new recording at the beginning of the video data region. And yet, in the authors' words, none of the deletion methods explicitly erase video data in the video data region, and deleted video can be recovered even when the header has been completely erased by formatting. They rated recoverability medium after a format and high after expiry or overwrite-mode deletion.
What are the recovery steps for a Honeywell drive?
- Power the recorder off. After a format the HN35 starts recording from the start of the video region, straight over the oldest footage. Other platforms do the same in their own way.
- Remove the drive or drives. HEN and HN35 units take two drives; label the bays.
- Dock to a Windows PC without initialising. Windows cannot read any of the three layouts and will offer to initialise. Cancel. The MAXPRO NTFS volumes are the exception and mount normally.
- Identify and read the layout. Open the drive in DVRXaminer. It recognises the Hikvision, Dahua and Honeywell 35 Series layouts, lists recordings by channel and time and marks deleted segments.
- Export MP4 to a separate disk. Preview the clips and save the ones you need with their timestamps.
Why will a Honeywell export not play?
It depends on the platform. Honeywell's recommended export format on Performance Series NVRs is MP4, and that plays anywhere. MAXPRO exports MPVC and SMPVC clips for its own standalone Clip Player, with WMV and ASF as portable alternatives. Hikvision-built HRG units write the Hikvision wrapper that needs VSPlayer, covered in Hikvision MP4 will not play, and Dahua-built units produce .dav. Footage recovered from the drive arrives as standard MP4 regardless of which platform wrote it.
What if the Honeywell password is lost?
Recovery from the drive runs without it. For the recorder, Honeywell's routes vary by model and are thin on documentation. HRSD DVRs have a recessed reset button near the alarm block, held with a paper clip for ten to fifteen seconds during boot, which returns the unit to admin and 123456 and clears all settings. HEN owners who lost access after a power cut report no documented hard reset and slow responses from support. Honeywell support asks for proof of ownership, a serial number and a receipt, before helping with a lockout. Hikvision-built units may answer to Hikvision's own GUID or security-question routes, but Honeywell has not published that, so treat it as a possibility rather than a procedure. The locked-out DVR guide covers the general case.
What are the odds on a Honeywell drive?
| Recorder | Layout | Deleted or formatted footage |
|---|---|---|
| HN35 35 Series NVR | Honeywell proprietary partition + ext4 system partition | Recoverable; video region not erased by any deletion method (DFRWS 2026) |
| HRG, HRGX DVR | Hikvision | Recoverable until overwritten; index cleared, blocks remain |
| HQA, HEN, Performance Series NVR kits | Dahua DHFS | Recoverable until overwritten |
| MAXPRO NVR | Windows NTFS, SQL database, RAID | Standard Windows and RAID recovery, different tooling |
| Any, recorder dead | Unchanged | Everything on the drive is readable |
In short
- Honeywell recorders sit on Hikvision, Dahua or Honeywell's own 35 Series layout, plus Windows-based MAXPRO; identify the unit first.
- The DFRWS USA 2026 study found no Honeywell deletion method erases the video data region, and formatted drives remain recoverable.
- Power off, pull the drives, keep them uninitialised on the PC and let layout-aware software read them.
- A lost password does not block recovery; Honeywell's reset routes are model-specific and lightly documented.
Common questions
Is deleted Honeywell NVR footage recoverable?
Yes. A DFRWS USA 2026 study of a Honeywell HN35 NVR found that none of the recorder's deletion methods erase the video data region and that recordings can be recovered even after a format wipes the header. Take the drive out, plug it into a Windows PC, refuse the initialise offer and let software that recognises the Honeywell layout read it.
Who makes Honeywell DVRs and NVRs?
Several companies. IPVM integrators identify the older HRG and HRGX Performance Series DVRs as Hikvision-built and the HQA line and many low-cost NVR kits as Dahua-built. The 35 Series NVRs use Honeywell's own disk layout and are made in Vietnam. MAXPRO NVRs are Windows machines with SQL Server and hardware RAID.
Does formatting a Honeywell NVR erase the recordings?
It removes them from the recorder. The DFRWS 2026 paper found that formatting the HN35 changes the partition GUIDs, resets the header and removes the indexes while leaving the video data region untouched, and rated recoverability after a format as medium. New recording starts at the beginning of the video region, so stop the recorder at once.
How do I reset a Honeywell DVR password?
It depends on the model and Honeywell documents little. HRSD DVRs reset with a recessed button held for ten to fifteen seconds during boot, returning to admin and 123456 and clearing settings. HEN owners report no documented reset and must go through support with a serial number and receipt. Reading the drive needs no password at all.
What format does a Honeywell NVR export?
Honeywell recommends MP4 on Performance Series NVRs. MAXPRO exports MPVC and SMPVC clips for its own Clip Player, plus WMV and ASF. Hikvision-built HRG units write the Hikvision wrapper that needs VSPlayer. Footage recovered from the drive is exported as standard MP4 whatever the platform.
Can I read a Honeywell NVR hard drive on a PC?
Not with Windows alone. The HN35 drive has a proprietary video partition and a 10 GB ext4 system partition, Hikvision-built units use the Hikvision layout and Dahua-built units use DHFS. Windows offers to initialise all of them, which must be declined. DVR recovery software reads each layout and lists the recordings.
Read the Honeywell drive, whichever platform built it
DVRXaminer recognises the Hikvision, Dahua and Honeywell 35 Series layouts found on Honeywell DVR and NVR drives, lists recordings by channel and time, marks deleted segments and writes MP4 with timestamps. Scan and preview cost nothing in the trial.
Sources
- Yoon and Hwang, Forensic analysis of video data deletion and recovery in Honeywell surveillance file system, DFRWS USA 2026 (arXiv 2605.07430)
- IPVM discussions: Honeywell cannot pick an OEM (2014), Honeywell surveillance solutions (2016), who OEMs Hikvision (2017); IPVM report on Honeywell HQA sourcing (2015)
- Honeywell HEN Performance Series NVR datasheet; Honeywell HN35 35 Series NVR product page and datasheet; MAXPRO NVR SE datasheet
- SecurityInfoWatch announcement of the HRGX Performance Series DVR (2014)
- Third-party guides on HRSD reset and Honeywell support requirements; ipcamtalk thread on HEN08102 password reset