TVT-Based DVR and NVR Footage RecoveryProvision-ISR, Novus, Satvision, JFL and 70 Other Badges, One Drive Layout
Shenzhen TVT is the manufacturer behind a long list of regional CCTV brands, from Provision-ISR and Novus in Europe to Satvision in India and JFL in Brazil. Owners rarely know it until a clip is lost and the brand's support turns out to be a reseller. This guide explains how to recognise a TVT-built recorder, what its drive holds and how deleted or formatted footage comes off it.
TVT of Shenzhen builds the recorders behind Provision-ISR, Novus, Satvision, JFL, TeleEye, Questek and dozens of other badges. Footage deleted on any of them can be brought back until new recording covers it. The drive carries TVT's own layout, which Windows reports as an empty disk. Power the recorder off, remove the drive, dock it to a Windows PC, refuse the offer to initialise and have software that knows the TVT layout scan it. No admin password is involved.
In 2016 IPVM published a list of 79 companies selling TVT-built DVRs, and a security researcher found the same TVT firmware flaw across more than 70 vendor names in the same year. The brands range from Provision-ISR in Israel and Novus in Poland to Satvision and Optivision in India, JFL in Brazil and Meriva in Mexico, with Q-See and CP Plus among the names that have used TVT for some product lines. The badge changes; the disk layout and the recovery route do not.
Which brands sell TVT-built recorders?
IPVM's 2016 list is the public reference and names 78 companies. The ones most often seen in recovery work are below. Brands switch manufacturer by model, so a brand on this list may also sell Dahua, Hikvision or Raysharp units; Q-See and Hi-View appear on both the TVT and Raysharp lists.
| Region | TVT-badged brands on the IPVM list |
|---|---|
| Europe and Israel | Provision-ISR, Novus, Elvox, Technomate, Skilleye, Lince, Goldmaster |
| India and Asia | Satvision, Optivision, CP Plus (some lines), Hi-View, Magtec, TeleEye |
| Americas | JFL Alarmes, TecVoz, Meriva Security, Q-See (some models), Gazer, ADI house brands |
| Other | Questek and others among the 78 names |
How do you recognise a TVT recorder?
- Model codes. TVT's own units carry TD- prefixes, such as TD-3004H1-4P or the 64-channel TD-3364H16 with sixteen bays and RAID. OEM units keep the brand's own numbering.
- The login. The default is admin with 123456, or a blank password on some firmware, on the default address 192.168.1.10. The Provision-ISR manual confirms admin and 123456 and resets the password back to 123456 through the security question on the login screen.
- The exports. TVT firmware backs up in AVI or in a private format that needs the RPAS player, which the recorder copies to the USB stick as an RPAS package. Provision-ISR's manual describes exactly that pair.
- The disk labels. TVT firmware describes drives as No disk, Unavailable disk, RW available disk or Disk normal and raises a disk I/O error alarm.
- The software. NVMS-1000 and NVMS-2000 are TVT's management clients, and NVMS9000 is a TVT recorder line.
What does a TVT recorder write to its drive?
Less is published about TVT's disk layout than about Hikvision's or Dahua's. There is no public forensic paper, and the Provision-ISR manual says only that the drive must be formatted in the recorder before use, which is the recorder laying down its own structures. What that means in practice is the same as for every other surveillance platform: the drive carries no Windows file system, Disk Management shows it as unallocated or RAW and Explorer offers to initialise it. The recordings are written as raw video under the recorder's index, a delete removes the index entry and a format rewrites the index, and the video stays on the platters until new recording covers it. DVRXaminer identifies the TVT layout from the drive itself, so the owner does not need to know its internals.
How do you recover footage from a TVT-based DVR or NVR?
- Power off. Stop the overwrite cycle before anything else.
- Remove the drive or drives. Small OEM units hold one; TVT's larger NVRs hold up to sixteen in RAID, which is a separate job covered in the RAID NVR guide.
- Dock to a Windows PC, no initialising. Cancel the Windows prompt. Add a write blocker where the recording may be evidence.
- Scan with DVRXaminer. It identifies the TVT layout, builds a per-channel timeline and highlights the segments the recorder had dropped.
- Export MP4 to another disk. Preview, select and save with the timestamps kept. The RPAS player and the private export format never enter into it.
What if the TVT recorder password is lost?
It does not block the drive. For the recorder, newer TVT firmware resets through the security question set at activation, which returns the password to 123456; if the answer is forgotten, the manual's advice is to contact the dealer. Older H.264 units took a master password that had to be entered at the local monitor rather than remotely, after which the unit rebooted to factory defaults. Whatever the route, a reset touches the configuration and not the recordings, and a reset that fails leaves the drive exactly where it was. The general approach is in the locked-out DVR guide.
What do No disk and Unavailable disk mean?
No disk is the recorder failing to see a drive at all, which points at power, the SATA lead or a drive that will not spin up. Unavailable disk is a drive the recorder sees but will not use, typically one from another device or one above the model's limit; Provision-ISR's NVR5 series takes drives up to 6 TB per port and TVT's TD-3004 and TD-3108 go to 10 TB. The cure the recorder offers for an unavailable disk is a format, and that is the one step to avoid while the drive holds footage you need. The No HDD guide walks through the hardware checks.
Why do these recorders need to come off the internet?
Because TVT firmware has a long record of remote flaws. The 2016 research that mapped TVT's OEM footprint did so by finding a remote root flaw shared across all of them, and in April 2025 GreyNoise reported Mirai botnet exploitation of TVT NVMS9000 recorders through an information disclosure bug, with more than 6,600 attacking addresses in a month. None of this touches the footage on the drive, but a recorder that has been part of a botnet is a recorder whose logs and settings cannot be trusted, which is one more reason to read the drive directly.
In short
- TVT builds recorders for Provision-ISR, Novus, Satvision, JFL, TeleEye, Questek and more than 70 other badges.
- Admin and 123456, an RPAS export player and No disk or Disk normal labels mark a TVT unit.
- The drive carries TVT's own layout; Windows shows it as empty and offers to initialise, which must be declined.
- Power off, dock the drive and scan it; the software identifies the layout and lists deleted recordings for export.
Common questions
Which CCTV brands are made by TVT?
IPVM published a list of 78 companies selling TVT-built DVRs in 2016, including Provision-ISR, Novus, Satvision, Optivision, JFL Alarmes, TeleEye, Questek, Meriva Security, Technomate, Hi-View, Magtec and some Q-See and CP Plus lines. Brands switch manufacturers by model, so check the login, exports and disk labels on your unit.
Is deleted footage on a Provision-ISR or Novus DVR recoverable?
Yes, until the recorder loops over it. These are TVT-built units whose drives carry TVT's own layout. Power the recorder off, remove the drive, dock it to a Windows PC, turn down the initialise prompt and have software that knows the TVT layout scan it, list the recordings and export them as MP4.
What is the default password on a TVT DVR?
Admin with 123456, or a blank password on some firmware, on the default address 192.168.1.10. The Provision-ISR manual confirms admin and 123456 and resets a forgotten password back to 123456 through the security question on the login screen. Recovery from the drive needs no password.
How do I play a TVT private format backup?
With the RPAS player the recorder copies to the USB stick alongside the backup; extract the RPAS package and run RPAS.exe. Backups made in AVI play in any standard player. Clips recovered from the drive arrive as MP4 and need neither.
What does Unavailable disk mean on a TVT recorder?
The recorder sees the drive but will not use it, usually because it came from another device or exceeds the model's limit, which is 6 TB per port on the Provision-ISR NVR5 series and 10 TB on TVT TD-3004 and TD-3108 units. The recorder offers a format as the fix. Read the drive on a PC first if it holds footage you need.
Are TVT DVRs safe to leave on the internet?
They have a poor record. A 2016 remote root flaw was found across more than 70 TVT-badged brands, and in April 2025 GreyNoise reported Mirai exploitation of TVT NVMS9000 recorders with over 6,600 attacking addresses in a month. Keep them off the open internet, and treat the logs of a compromised unit with suspicion.
Read the drive behind the badge
DVRXaminer identifies the TVT drive layout behind Provision-ISR, Novus, Satvision, JFL and other TVT-built recorders, builds a per-channel timeline, highlights dropped segments and writes MP4 with timestamps. The trial scan and preview carry no charge.
Sources
- IPVM, A list of TVT's 79 DVR OEMs (25 March 2016); IPVM interview with researcher Rotem Kerner; Help Net Security report on the TVT RCE across 70 vendors (March 2016)
- Provision-ISR NVR5-4100X user manual (default login, security question reset, AVI and private backup with RPAS, disk status labels, 6 TB per SATA port)
- TVT default login reference (videoexpertsgroup); securitycamcenter guide to the TVT H.264 master password reset
- Security Wholesalers listings for TVT TD-3004H1-4P, TD-3108H1-8P (10 TB) and TD-3364H16 (16 bays, RAID)
- GreyNoise, surge in exploitation attempts against TVT NVMS9000 DVRs (April 2025); Shenzhen TVT Digital Technology company profile (SZSE 002835)