GoPro video file structures
This section will give a brief overview of the way that each GoPro camera records the video data.
MP4 File elements
An MP4 file contains three main elements, referred to as atoms
ftyp - a short header block
mdat - contains all video and audio data
moov - meta data and pointers to all the video and sound frames
There are two variations of MP4 files
<ftyp> <moov> <mdat>
<ftyp> <mdat> <moov>
Each camera does use the same basic MP4 structure with H-264 encoding and AAC sound. Each camera does have small variations (useful to help determine camera type) but there are significant differences on how the video file is physically recorded on the memory chip.
Memory chip ordering
There are two important aspects to understand with the GoPro camera, the logical file recording and the physical file recording. Due to buffering memory constraints the video meta data in the moov atom has to be saved to the memory chip last. If the logical order of the file is
<ftyp> <moov> <mdat>
then obviously this is a problem, as the length of the moov meta data is variable. Also the length cannot be determined until the recording is complete. For this reason, the <mdat> is physically recorded first, and then the <ftyp><moov> atoms are added when the video is finalised. Thus the physical order on the disk is
<mdat> <ftyp> <moov> -next video - <mdat> <ftyp> <moov>
Many data recovery programs see a sequence of <ftyp> <moov> <mdat> and think thus is a logical file, but in fact it is associating the second file video, with the first file's <moov>. The result is a file that looks correct on the directory listing, but has zero chance of playing. GoPro Recovery both understands the ordering, but also has sophisticated routines to ensure that the correct video is linked to the correct header.
Each of the main three cameras has it's own variation of the above
Physical <mdat><ftyp><moov> + embedded jpegs
Physical <mdat><mdat><ftyp><moov><ftyp><moov> High and low res interleaved
Logical <ftyp><moov><mdat> <ftyp><moov><mdat>
Physical <ftyp><mdat><ftyp><mdat><moov><moov> High and low res interleaved
Logical <ftyp><mdat><moov> <ftyp><mdat><moov>
High and low resolution multiplexing
Hero3 and Hero 4 cameras can record both high and low resolution videos at the same time. Obviously they both need to be stored on the memory chip at the same time and so these end up being interleaved. Typically just the mdat atoms are interleaved but is is another reason that data carving will not recover these files. Being a complete data stream there are no nice headers at the start of each cluster. The recover function of GoPro recovery has to examine each cluster to see if it is a high or low resolution cluster and then save it in the correct recovered file. For a deleted file this process can make use of the moov atom. For an unfinalised file, the examination needs a different approach to separate the high and low resolution elements. Fortunately it is possible to determine the length of a raw video and audio frame which helps with creating a complete data stream.
We have not seen another camera type that records multiple streams of data this way, though 3D cameras might have a similar issue