Raysharp-Based DVR Footage RecoveryOne Manufacturer Behind Swann, Lorex, Q-See and a Dozen Other Badges
A large share of the budget DVR kits sold in the 2010s came from one factory in Zhuhai, and the badge on the front never said so. Those recorders are now old, their apps are retired and their drives hold years of footage in a layout a PC cannot read. This guide lists the brands, shows how to spot a Raysharp unit and explains how deleted or formatted footage comes off its drive.
Raysharp built the recorders sold under Swann, Lorex, KGuard, Defender, Q-See, Zmodo and other names through the 2010s. Their drives share one layout: a hidden video partition Windows cannot see, filled with blocks of about 1 GB and no file extensions. Deleted footage stays in those blocks until the recorder reuses them. Power off, pull the drive, connect it to a Windows PC, skip the initialise step and scan it with software that knows the Raysharp layout. No login needed.
Zhuhai Raysharp Technology is the manufacturer behind a large share of the DIY surveillance kits sold in Western shops over the last fifteen years, and almost none of them carry its name. Security researchers found that out the hard way. Rapid7 unpacked Swann firmware in 2013, found the raysharp_dvr binary inside and listed nineteen brands shipping the same code; a 2016 CERT advisory on a hard-coded password confirmed Swann and named Lorex, KGuard and others. For an owner with a dead or wiped recorder that history is good news, because it means a single recovery approach covers a long list of badges.
Which brands sold Raysharp-built recorders?
The documented list comes from security advisories rather than from the brands themselves, so the confidence varies.
| Brand | Evidence | Confidence |
|---|---|---|
| Swann (2011 to 2018 SwannView era) | Rapid7 2013 firmware analysis; CERT 2016, Swann confirmed Raysharp code | High |
| Lorex, KGuard, Defender, URMET, Zmodo, SVAT, Atlantis, COP-USA, Hi-View | Rapid7 2013 brand list; CERT and Risk Based Security 2016 | High for the years covered |
| Q-See | Named in the 2016 Raysharp firmware vendor list | High for some models; Q-See also used Dahua and TVT |
| Night Owl, Xvision, Everfocus Vanguard, Partizan, Revo, Amcrest (some) | IPVM forum identification, MAC address lookups | Medium |
| Samsung SNK, SDR, SDH consumer kits | IPVM forum member attribution | Medium |
Brands move between manufacturers by model and year. Swann, Lorex and Amcrest all appear on Hikvision or Dahua lists for other product lines, so the recorder in front of you may not be a Raysharp unit even if the brand is on this table. The Swann and Lorex recovery guides cover those brands across all their platforms.
How do you tell a Raysharp recorder from the outside?
- The apps. SwannView Link, SwannView Plus, Lorex Client and DefenderHD all belong to the Raysharp-era platform. IPVM members used exactly this test to identify a Night Owl HDA unit.
- The passwords. Swann's own support page for its 2011 to 2018 recorders lists admin and 123456 as the default and master codes such as 519070 for a locked unit. The same 519070 code appears in the 2016 security advisory as Raysharp's hard-coded root password, which is why those recorders should never be exposed to the internet.
- The exports. Raysharp-era units back up to .264 files that need the bundled Playback application, or on later firmware to AVI and MP4. Swann's articles on playing and converting .264 files describe this platform.
- The error wording. Notice! Hard disk not found!, Unformat error and Status Abnormal are Swann's on-screen messages for this platform.
What is on a Raysharp drive?
A partition the PC does not list. An owner who docked the drive from an Atlantis DVR in 2024 described what Linux file tools showed: a ton of 1 GB files with no extensions. Another thread on Lorex and Atlantis drives reported video written to a partition absent from the partition table, with headers beginning RSFm and H.264 frames inside, and noted that a commercial forensic tool labelled it a RAYSHARP file system. Windows sees none of it, reports the drive as unallocated and offers to initialise it. Those 1 GB blocks are the recordings, each one a run of raw H.264 for one camera over one stretch of time, and the recorder's index tells it which block is which. Delete a clip and the index entry goes. Format the drive in the recorder and the index goes. The blocks stay until new video is written over them.
How do you recover footage from a Raysharp-based DVR?
- Cut the power. These recorders overwrite from the oldest block once the drive is full, and a drive that was formatted starts refilling from the beginning.
- Remove the drive. Most Raysharp DIY units hold a single 3.5 inch drive under the lid.
- Dock it to a Windows PC. Decline the initialise prompt. Use a write blocker if the footage may be used against anyone.
- Read the Raysharp layout. Load the drive in DVRXaminer, which finds the hidden partition and block headers, builds a timeline for every camera and marks the blocks the recorder had released.
- Export MP4 away from the drive. Preview, select and save to the PC or a USB stick with the timestamps kept.
What if the recorder is locked or dead?
Neither matters for the drive. A locked Raysharp-era Swann unit answers to the master codes Swann publishes for its 2011 to 2018 recorders, and later models accept a reset code derived from the MAC address; Night Owl's online tool emails a secure code against the unit ID and the date on screen. The Swann and Night Owl password guides go through those. A recorder that has died, which is common for units now ten or more years old, hands over its drive like any other. The dead DVR guide covers the diagnosis.
What are the odds on a Raysharp drive?
| Situation | Outlook |
|---|---|
| Clip deleted from the menu | Good until the block is reused |
| Unformat error, drive formatted to clear it | Good if the recorder was stopped soon after |
| Recorder locked, codes unknown | No effect, drive is read directly |
| Recorder dead after years of service | Full, if the drive still spins |
| Old drive, clicking or slow | Image once, then scan the image |
| Overwrite ran for weeks after the event | Low for that event |
In short
- Raysharp built recorders for Swann, Lorex, KGuard, Defender, Q-See, Zmodo and many others through the 2010s, documented by security advisories.
- The drive holds a hidden partition of 1 GB extensionless video blocks that Windows cannot see.
- Deleting or formatting removes index entries; the blocks remain until reused.
- Power off, dock the drive without initialising and read it with software that recognises the Raysharp layout.
Common questions
Which DVR brands were made by Raysharp?
Security advisories name Swann, Lorex, KGuard, Defender, URMET, Zmodo, SVAT, Atlantis, COP-USA, Hi-View and Q-See among brands shipping Raysharp firmware between 2013 and 2016, and Swann confirmed that some of its models use Raysharp code. IPVM forum members add Night Owl, Xvision, Everfocus Vanguard, Partizan and the Samsung SDR consumer line with medium confidence.
Can I recover deleted footage from an old Swann or Lorex DVR?
Yes, if the drive still spins and the footage has not been overwritten. Raysharp-era recorders keep video in a hidden partition of 1 GB blocks, and deleting or formatting removes index entries rather than the blocks. Power off, pull the drive, connect it to a Windows PC, skip the initialise step and scan it with software that knows the Raysharp layout.
Why is the Raysharp DVR drive unallocated in Windows?
Because the video sits in a partition that is not listed in the partition table and holds no Windows file system. Owners using Linux tools report a hidden partition full of 1 GB files with no extensions. Windows reports the drive as unallocated and offers to initialise it, which must be declined.
What is the default password on a Raysharp DVR?
Swann documents admin and 123456 for its 2011 to 2018 SwannView recorders, with master codes such as 519070 for locked units. The 2016 CERT advisory identified 519070 as a hard-coded Raysharp root password, so these units should never face the internet. Recovery from the drive needs no password.
Does the .264 export from an old Swann DVR play on a PC?
Only in the bundled Playback application or after conversion. Swann publishes articles on playing .264 files with its player and converting them to AVI. Later firmware exports AVI and MP4 that play in VLC. Clips pulled from the drive by recovery software arrive as MP4 without that step.
My Swann DVR says Unformat error. Is the footage gone?
No. Swann's fix for Unformat error is Format HDD, which erases all recordings, but until that format runs the video is intact. Even after it, the blocks remain until the recorder records over them. Scan the drive on a PC before you agree to the format.
Read the drive from an old DIY recorder
DVRXaminer recognises the Raysharp drive layout behind Swann, Lorex, KGuard, Defender, Q-See and other 2010s recorders, puts each camera's recordings on a timeline, marks released blocks and saves MP4 with timestamps. Scanning and preview are free of charge in the trial.
Sources
- Rapid7 blog, Ray Sharp CCTV DVR password retrieval and remote root (28 January 2013), with the list of affected rebranded products
- CERT Coordination Center vulnerability note VU#899080 (2016) and Risk Based Security reporting on the hard-coded RaySharp password
- IPVM discussions: Raysharp OEM and Night Owl DVR identification; ipcamtalk threads on Atlantis and Lorex drives with a Raysharp layout
- Swann support: SwannView recorder default passwords and master codes, DVRx .264 playback and conversion, SwannView Link export formats, Hard disk not found and Unformat error articles
- Zhuhai Raysharp Technology company profile (SZSE 301042)