The following photos give a simple guide to recovery of deleted video files from the GoPro camera
The program is started by running the icon blue GPR in the start menu
GoPro recovery works either with the original SD memory chip, or a Image file copy of the memory chip. ie it does not attempt to recover files from deleted NTFS or FAT32 drives. (The reason is that the memory chip does not store files sequentially, while hard drives, typically store the files as a single data run. The SD memory chip is 100% scanned before recovery, not a sensible approach for a 3TB hard drive).
The easiest way to connect the memory chip is with a micro to standard SD card adaptor, and then either read it with a USB adaptor, or the PC/Laptop internal card reader.
The drop down box will give the option of a image file, or memory chip (up to 256GB in size). Select which one you want to use, typically the memory chip. Recovery from a connected GoPro camera is not possible - it is essential to reach all sectors, not possible when connected as a camera.
The format of the image file is standard DD - the program can create such a file that could be for a backup, or to be sent to someone else.
Once the input drive/media has been selected it is now time to select where the videos will be saved. The save location can be any logical drive, local or networked. NB no data must every be saved back to the memory chip, and the programs tries to ensure that is always locked out, and a warning message will be displayed if such a an operation is attempted.
One optimising option is to stop the scan on blank. The recovery program, by default will scan the whole memory chip to locate all video frames etc. This can take a considerable time, and not required if the chip has only been partially used. Thus, if the option to stop scan on blank is selected, the recovery may be quicker. NB, if the chip is being examined as part of a forensic investigation, this option should be used with caution incase there is video stored after a long blank section.
The save image file will create a complete image of the raw memory chip. This may be used as a backup, or transfer to another system. For any forensic investigation it is a very sensible option. NB, the file will be the sane size as the original memory chip, eg 32GB.
This final stage will perform the recovery process. The process is in 5 stages listed below. At stage 4 & 5 thumbnails of recovered (or recoverable) videos will be displayed. Until stage 4, the display will be updating it’s status on elements found.
This box shows the number of each element that has been detected. It is normal to the the same. or similar number of ftyp, moov and mdat atoms. JPGs all depend on how the camera has been used - some are automatically generated to be thumbnails
Videos indicates the number of videos found
FAT32/exFAT shows what type of memory chip file system has been detected
The cluster is the the value (in hex) of the cluster size in sectors on the memory chip. Typically, ox40 for FAT32 and 0x100 for exFAT
This status box counts down unprocessed atoms. A perfect recovery would result in zero for all the boxes. Typically, there my be a few non zero values if the chip has been used more than once and old atoms still remain