GPR - GoPro Recovery 

Introduction


GoPro Recovery is a program designed to just recover deleted, and corrupted videos from GoPro camera SD memory chips - and it works!


NB, the program will not read the camera directly, but only the memory chip.


GoPro cameras save the MP4 files in a way that means almost all other recovery programs fail.  CnW Recovery have developed ways to recover that numerous fragments that make up a file and save them in the correct order. The process is simple, and automatic.  This program is a concise subset of the CnW Recovery program and just works with GoPro cameras.  There are two versions, standard and forensic.  Both will perform the same basic recovery.  The forensic version has enhanced logs and file hashing and will also (under development) recover unfinalised file and video extracts.


The software only processes memory chips, or an copy of a memory chip (DD file in Unix terms). The current maximum size of memory chip handled is 128GB, matching the current maximum size of GoPro SD memory chips. The program does have a mode to produce such DD image files.




Getting started


The process is very simple, select memory chip, and output location, and then select Recover all files.


Memory chip selection


The GoPro Recovery is designed to work just with memory chips.  ie it is not designed to recover files that have been deleted from a hard drive.  For this reason, the disk scan will only show drives with a capacity of 128GB or less.  The program can also process image files of the memory chip.  These should be straight sector by sector copies (Unix DD format).


Save Location

The save location can be any valid drive, local or networked on the PC.  The program does ensure that you cannot select the memory chip as a save location.  Nothing must ever be written to the memory chip until the full recovery has been completed (and then it best to wait a week to be sure).


Recover all files

When the Recover all files is selected the recovery process starts.  There are two options related to this function, Stop scan on blank and Save image file.  The Stop scan on blank will truncate the initial scan if the program finds a long area of blank sectors.  Many cameras have 64GB chips, but maybe only 10GB is used.  This option will speed the recovery process up.  The second option is to create a disk image of the memory chip on the initial scan. This can be security, but may also speed up the second second stage of recovery slightly.  Obviously, the hard disk drive must have enough space  to save an image file, and the recovered videos


Five stages of recovery


These stages are displayed as part of the status bar.  The sector number should keep changing - it is displayed mainly to indicate that the program is processing data.


In many parts of the above sequence the progress bar will move, and also the sector number change value.  The sector number just shows the area of disk being worked on and it's main function is to indicate the the program is processing video data.



Status display values


While the program is processing data there are several status messages displayed.  These are described below


Camera type

This displays the type of camera detected.  If the version cannot be found from the meta data an unrecognised message may be displayed.


The camera type can be preset.  This can be useful for some older camera models where the camera type is not stored in the meta data.  It will also assist if a memory chip has been used in different types of camera.  However, for normal use, Auto should be selected by default.  The choices are

       Hero,  Hero 2 / Hero 3, Hero 4


Elements found

The elements found are detected on the initial chip scan.  It will search for all ftyp, moov and mdat atom starts.  The number of these atoms should be the same, though occasionally false mdat atoms may be detected.  JPGs are also counted.


The video count is the number of videos recovered


Cluster size


The program will determine if the chip is FAT32 or exFat, and also the cluster size.  The cluster size is very critical, and if incorrect, videos will not recovered.  Typical values are


FAT32        0x40

exFAT        0x100, 0x200, 0x400


Elements not yet recovered


At the end of the initial scan, elements found, and not yet recovered will be the same.  As video recovery proceeds, the elements not yet recovered will reduce.  With a perfect recovery all values should be zero at the end.  If files have not been finalised, or otherwise corrupted, these atom and frame values may still be positive.  The forensic version of the program will attempt to use these atoms to reconstruct playable videos.

 

Stop on blank

This can be a useful time saver when it is known that the memory chip is only partially used.  NB, if doing a forensic investigation, this option must be used with caution incase there is video further down the chip.  The routine will stop scanning after it has found a 'significant' length of blank sectors.


Save image file

This allows the program to create a complete image file of the memory chip. This could be for security, or to save in the case of a forensic investigation.  It can also be used to send to CnW Recovery if there are problems encountered.  The image file is a sector by sector copy.


Duplicate clusters


When the memory chip is being scans the program checks to see if there are duplicate clusters.  If multiple duplicate clusters are found it is very likely the chip is a fake memory chip.  This will mean that much video might have been lost and there is no way to recover the original data.  The chip should not be used again, and should be returned to the vendor (with a request for compensation).  It is possible for a chip to have duplicate clusters because of the way it was initalised, but this is rare.



Any problems

To help with any possible problems the program produces a 2GB file from the start of the memory chip image.  This is saved in the output directory with the name 2gb_image.img.  See section on support for more details








Copyright CnW Recovery Developments Ltd January 2016