The invention provides a data extraction method for an embedded security protection device, and belongs to the field of data recovery. The classification analysis is performed according to normal data files, lost data files and overwritten data files when each partition is read by adopting a method for one-by-one reading according to partitions of a disk. When the normal data files are read, a file allocation record table of the partition is analyzed, used block records are analyzed from the table, and video data in the block records is read; and when the lost data files are read, the file allocation record table of the partition is analyzed, unused block records are analyzed from the table, video data in the block records is read, whether the video data is null or not is judged, and if the video data is not null, effective video data is extracted according to a video data structure of an embedded monitoring device. Based on the method, whether disk data is in a monitoring video data format of TIANDY or not can be quickly judged and effective video data files in the disk data can be extracted.