Recovery of unfinalised GoPro videos

The GoPro range of cameras are designed for action.  Sometimes things go wrong and there may be an accident, or maybe the camera just gets dropped.  When this happens the video may not be completed or finalised.  The result is that the video file may appear to be on the memory chip, but will not play.

The forensic version of the software (currently under final development, Jan 2016) will recover the videos into a playable format.

Issues with unfinalised videos

       To understand the issue with unfinalized videos it is important to know how the camera records the video, and builds it up into the final version.  There are two elements, the file system (FAT32, or exFAT) and the video file.

File system

The file system has three elements

Any writing to the memory chip takes time

The directory is fairly short and contains the file name, the length, and the start location.  The when the data is being written, the length will occasionally be updated.  It is therefore very likely that in the case of an accident, the saved length may not be up to date.  The operating system will look at the saved length, and so may think the file is shorter than it is.  99% of the video file is a stream of video and audio frames.  These frames are written continuously to the memory chip.  The process is relatively slow and so writing will start very quickly.  Also, the memory required to buffer the video data runs out very quickly.  Thus the data is written very soon after recording, but the FAT and directory are easily buffered, and only updated occasionally.

With the GoPro camera, the files are not stored sequentially.  The details of each cluster are stored in the File Allocation Table, (FAT).  To save memory writes, this will only be updated occasionally - probably at the same time as the directory entry.  Thus, as above, there may be more data on the memory chip than is reported.

If there is a camera failure - for any reason, it is there essential that nothing is changed on the memory chip, ie no test shots etc.  If anything is written, even a short test video, the camera will think that the length indicated by the directory and FAT is correct, and so will write over any data that has not yet been registered by the directory or FAT.  Overwritten data cannot be recovered and so is lost for ever.

GoPro Recovery does not use the file system to read the card, and so can access data not registered by the file system.  This way extra video can sometimes be found.  How much data - this is impossible to say, it might be a single frame, or a few seconds.  The amount of extra data recovered depends on the timing of the malfunction in relation to the updating of the directory.  If there is any thought that the video may be required for any type of investigation, the memory chip should be removed from the camera, and if possible write protected.  No 'repair' routine should be run on the original data.  An ideal approach is to create an image file of the original memory chip, a function the GoPro Recovery software can do.

Video file

As seen from above, the video data may be on the memory chip, but is totally unplayable.  To make the video playable there are two main stages

To extract the video data, the memory chip is examined and each cluster of data is analysed.  The data blocks are then stored in sequence for each original video, allowing for the high and low resolution blocks that can be physically interleaved (or multiplexed)

The second stage involves analysing the video stream to isolate each video and audio frame.  After this has been done a new MP4 compatible header is created and so the video may be played as an original video.  In normal operation, the header will be built up in memory, and only written once the file is complete.  Thus for an interupted video, there may be no header information at all on the memory chip.

Recovery service

If problems are encountered CnW Recovery will always offer support, and if required a service to help recover data.