Re: [sleuthkit-users] Processing a Tivo

[DePriest, J. R. <jrd...@gm...>]

On 5/19/06, Detective David Vitkus <> wrote:
> I'm looking for info / advice on processing a TIVO.  It's a child abuse
> case and there's an allegation that the suspect showed the victim a
> pornographic movie prior to / during the assault(s).
>
> Have a good weekend all,
> Have a good weekend all,
>
> --
>
> David Vitkus
> Detective
> Northampton Police Department
> 29 Center St.
> Northampton, MA 01060
> 413-587-1133 (voice)
> 413-587-1137 (fax)
>
> Note: Recently our e-mail servers have been equipped with very aggressive=
 spam filters.  Consequently, valid messages may be inadvertently purged.  =
If you expect a response from me and don't get one, please call.

As for relevance to this site, these are following "facts" that seem
most promising (from http://cbbrowne.com/info/othervars.html):
<quote>
This is a TV "recorder" consisting of:
* Some form of display controller, used to display system messages and
menus as well as TV broadcasts,
* A disk drive, which can record, in "low quality" mode, 1h/GB, which
is used to "record/buffer" programs,
* A modem, used daily to connect to a server at Tivo to download
broadcast schedule information, and
* A PPC CPU, used to control all of the above.

It isn't particularly visible, but the TiVo runs Linux .

Various people have taken interest in trying to expand the
capabilities of their TiVo recorders, particularly to allow additional
storage.
... To do interesting things like upgrading the hard drive, run other
software on the unit, or such...

Interesting properties:
* Tivo units use PPC, not IA-32;
* The partition tables on hard disks use modified Macintosh-style
partition tables;
* The units load a special kernel module in that read/write the
special "Tivo" filesystem;
* Drives are byteswapped.
* With some hacking around, you can mount some of the partitions as
ext2 filesystems, and look at the contents of /var as well as root
partitions.
* Apparently they have figured out how to "bless" a drive so that it
can be used to augment the space available.
</quote>