Answering my own question (just shows you have to do things yourself usually).
I managed to get the /etc/passwd file from this DVR, it's web interface is flawed in that you can grab most things from the filesystem by using relative paths.
So I managed to grab the root password, ran through John the Ripper and got the root password (I won't post it here)
In the /mnt/mtd/Config folder is two password files Account1 and Account2 (which I suppose it a backup).
For resetting the admin password I used SED to substitute the password I had used for a blank one.
eg.
Make a backup:
cp Account1 Account1-
cp Account2 Account2-
sed /s/oldhashedpassword/tlJwpbo6 Account1
sed /s/oldhashedpassword/tlJwpbo6 Account2
Resulting structure:
"Group" : "admin",
"Memo" : "admin 's account",
"Name" : "admin",
"Password" : "tlJwpbo6",
"Reserved" : true,
"Sharable" : true
Reboot and you can log in with blank password again.
(I'm no hacker, but this was a bit too easy).