RF Detector?

Do your cameras cover all the ways to access you house?
If so, try to watch a playback according to the suspicious log entries in the NVR.
First 4 cameras cover the backyard gate entrance, the driveway SW, driveway NW and front door
 
Attached are some screenshots of odd activity
 

Attachments

  • NVR1.jpg
    NVR1.jpg
    262.7 KB · Views: 13
  • NVR2.jpg
    NVR2.jpg
    230.4 KB · Views: 11
  • NVR3.jpg
    NVR3.jpg
    364.5 KB · Views: 11
  • NVR4.jpg
    NVR4.jpg
    281.6 KB · Views: 12
  • NVR5.jpg
    NVR5.jpg
    346.2 KB · Views: 12
  • NVR6.jpg
    NVR6.jpg
    362.9 KB · Views: 13
What is COVERT?

1780334758282.png

Is Video Loss : 9 a camera? Could someone have unplugged the cam and plugged in a laptop? What was happening at 7:05 this morning?

I have always wondered if access could be made using the ethernet cable from a cam. I have always maintained that my cam system was not accessible from outside since it is not physically connected to the internet. But using the cam's cable, one could get into the network that way.
 
What is COVERT?

View attachment 244397

Is Video Loss : 9 a camera? Could someone have unplugged the cam and plugged in a laptop? What was happening at 7:05 this morning?
Yes, channel 9 is a regular PTZ camera. Unless that someone is on a ladder 14 feet in the air, I doubt that's how they are accessing the NVR. I just think there's a failing connection at the camera since the camera pole mount is rusted. And there's another camera right below that PTZ that definitely would have captured the perp

Have NO idea what "Covert" means
 

Attachments

  • Pole Mount1a.jpg
    Pole Mount1a.jpg
    170.4 KB · Views: 3
Looked at the system logs on the NVR, there's a lot of activity I don't recognize. And there's an admin and user account. I tried deleting the user account and it will not let me. Even though user account has no "system" permissions, it has "Playback" and "Covert" permissions for all channels which I cannot deselect and save the changes. And remember this NVR is NOT connected to the net, so how is someone accessing it?

I think the "cannot delete reserved group" with "admin" and "user" groups is quite normal. Just sloppy phrasing by Dahua. Have any actual users appeared, and if so, what are they called exactly?

I have never heard of covert before. I wonder if it could be to do with the function where a live feed for a camera is hidden on the NVR monitor when no users are logged in. This basically: Hide cameras on a Dahua NVR when it is logged out - Learn CCTV.com. An easy way to test would be to find that setting, toggle it on / off for a few cams, save, and check the log, see if it generates the same entry.

The "Playback" event at 10:07 - was this you, or part of the mystery? Also, 5:38 actually!

What is the photo if the "Detailed Information - Record Search" - did this come up by itself? Or is the record search the oddity?

Finally, apologies if already mentioned but is the NVR a PoE model or not? Are the cams connected directly or via a switch?
 
I think the "cannot delete reserved group" with "admin" and "user" groups is quite normal. Just sloppy phrasing by Dahua. Have any actual users appeared, and if so, what are they called exactly?

I have never heard of covert before. I wonder if it could be to do with the function where a live feed for a camera is hidden on the NVR monitor when no users are logged in. This basically: Hide cameras on a Dahua NVR when it is logged out - Learn CCTV.com. An easy way to test would be to find that setting, toggle it on / off for a few cams, save, and check the log, see if it generates the same entry.

The "Playback" event at 10:07 - was this you, or part of the mystery? Also, 5:38 actually!

What is the photo if the "Detailed Information - Record Search" - did this come up by itself? Or is the record search the oddity?

Finally, apologies if already mentioned but is the NVR a PoE model or not? Are the cams connected directly or via a switch?
The Record search events you mention were NOT me. The one at 5:38 happened while I was still sleeping and the one at 10:07 happened when I was away from the house doing my morning errands.

If you look at the details screen, you can see:

Record search details

Device: HDD

IP Address: Login Local

Group Name: user

User: default

I believe someone created or modified the "default" user group account so that they can gain access to the NVR. While they have no system permissions, the user group either automatically has access to Playback and Covert permissions, or someone has created access. Either way, the record search screen is activated by someone outside this household with the NVR not connected to the internet. Scary thought

And yes, this is a POE model NVR so the cameras are connected directly to it.
 
Last edited: