Case studies
CnW Recovery undertakes jobs to recover videos. Some throw up interesting apsects of recovery. This page will describe a few jobs we have done. This list will grow!!
Nokia Phone N86.
The inquiry came from a potential customer wanting to purchase software. Like many he was concerned about will it work before investing money in it. The first attempt is to run the demo, but this did not show any files. The next stage was to send me an image of the memory chip, an 8GB FAT32. On receipt of this we established the same problem.
Investigation showed two issues. First it was using an MP4V/MP4A codec. This was not supported in GPR. The second very interesting problem was that the clusters appeared to be in reverse order. It is very common for a video file not to be fully sequential - and this is the reason that so many other data recovery software packages fail. This camera though had every block stored at an address before the previous block. A normal camera would have a block sequence such as 20, 21, 22, 23 . This camera was 23, 22, 21, 20. The next problem was that videos were in this reverse order, but others were not
Development was required, but the result is V2.18 which can now process this type of phone (camera), Nokia N86.
Voltec 189866
This camera saves on the face of it standard MP4 videos in a ftyp-moov-mdat structure. However, not all videos were being recovered correctly. The memory chip was a FAT32 with a 0x80 sector cluster size, 64KB. However, many of the files appeared be aligned on a 0x40 sector boundary. Once the option to set cluster size to 64 (0x40) the recovery was extremely good. My speculation is that the chip had been reformatted with a different cluster size. Because GPR very largely ignores the file system, recovery was possible. Fortunately this type of error is easy to detect and advise the user to use different settings.
GoPro recovery after a physical crash
We have helped with a few video recoveries after the camera was involved in a serious physical crash. When this happens the camera stops recording and the data is not finalised in anyway. It is therefor necessary to trace all video fragments, piece them together and recreate the moov atom. Sometimes this does involve a bit of extra tweaking that CnW Recovery are happy to do. Typically the camera does not record instantly, so the final few seconds may not have been written to the memory card, but otherwise events up to the crash are recoverable.
GoPro files overwritten.
This is a nightmare situation. Having tried many software packages that did not work, the user then copied the corrupted files back to the original memory chip. The result was a chip with a mixture of file runs. The result, as seen using the Chip Allocation function was a large amount of duplicated data. This means that approx 20% of the chip was missing.
The standard routine still did a fairly good job of finding many playabale files. However, much space was not processed. For this the forensic option 'Process fragments' was enabled and more files were then recovered. Not 100% but 1000% more than other software programs produced. Without this damage, recovery would have been much better.
Canon EOS 1 D 4K
This was an interesting case on two accounts. Firstly the recording was in 4K resolution. For this Canon uses Motion JPEG as a codec, rather than the more common H.265 (or H.264) found in most cameras. Thus GPR software was upgraded to support Motion JPEG.
The second issue was that chip had been reformatted twice. Once acccidently by the user, and secondly by a data recovery company who obviously had no idea how to recover data. This version of EOS records the metadata section (ftyp and moov) at the start of the memory chip, and then all the video data further down the chip. One of the formats overwrote half of the critical ftyp and mdat records. This meant that recovery, by recovering the elements, was only possible for half the data. For the other half a more complex procedure was required. This involved determining in tye video stream the start and length of every video and audio frame. This information was then use to reconstruct the moov atom and produce a playable video.
GoPro delete and reformat, lost 1st file
We recently had two cameras with the same problem. After a format all videos could be recovered using GPR, except for the first one. The problem was that the first few bytes of thefile had been overwritten by a 'system' file, and so the vidoes could not be played. For the customer, a quick fix was performed by adding (by hand) the first critical 50 or so bytes at the front of file. The forensic version would find sections of file, but not the continuous 25 minute run from the Hero 11 camera. Development is underway to make such a recovery automatic