Recovery of video f...
 
Notifications
Clear all

Recovery of video fragments

4 Posts
2 Users
0 Likes
1,132 Views
(@harold)
Posts: 2
New Member
Topic starter
 

Hello, thank you for having me.
I have used photorec to recover files from the unallocated space of old Maxtor HDD with FAT32. I found that some recovered files listed –for example– as .sqlite, or as .torrent had inside some chunks of video. I can see some of these chunks of video using mencoder/mplayer/ffmpeg. I am pretty convinced that there are many other small fragments of these videos that I cannot view with these tools, hidden in other small files that are also listed as .sqlite, .torrent, etc (or maybe not recovered at all by photorec).
Do you have any suggestions on software that I can try to recover those bits as well? Either on the file recovered by photorec, or software to perform a better recovery, or tricks that I can use to improve the recovery of "standard tools" (e.g., maybe I can use a reference video to see what kind of header to look for?)

Thank you for your help.

Additional info.
The command I use with mencoder is "mencoder -idx FILE -ovc copy -oac copy -o OUTPUT.avi"
For ffmpeg "ffmpeg -analyzeduration 2147483647 -probesize 2147483647 -i INPUT -vcodec copy -acodec copy output.avi"

 
Posted : 13/09/2019 6:13 pm
jaclaz
(@jaclaz)
Posts: 5133
Illustrious Member
 

Photorec - generically speaking - is a recovery oriented (and automated) carver, it tries to recover files that it can recognize but tells you nothing on where the files are.

You need to use a software that can - besides (hopefully) being able to recover the same (or more) files than Photorec does - provides nfo on the extents occupied by the files.

Besides a few more targeted to video tools (Commercial) you can try using what I call "negative approach", i.e. once you have recovered a file (or the part of it) you can try 00ing the area where what was recovered was, this way only a restricted number of non-00's areas would remain, that you can try examining (or attempt combining) with the same or other tools.

Personally (though I am not in any way connected to the software) I like a lot DMDE
https://dmde.com/
which you can try extensively before acquiring a license for (the limitations on the Free editions are on quantity of files and on nature of the recovery, i.e. for personal use only after a reasonable trial) which anyway is cheap.

jaclaz

 
Posted : 16/09/2019 10:56 am
(@harold)
Posts: 2
New Member
Topic starter
 

Dear jaclaz,
Thank you very much for your reply. I appreciate your explanation and the pointer you provided me with.

1. I will try DMDE as soon as possible.
2. Once photorec recovers a file, how do I know which sectors to zero out on my device? (or, better, in the image that I have obtained by ddrescue - ing my drive)?

3. In the meantime I am trying CnW (https://www.cnwrecovery.com/). it is recovering many chunks of the same files discovered by photorec, and many chunks that photorec had completely missed. This time, however, the chunks are very small (few kB), and they are partial (with bottom noise bands) or extremely noisy in the whole frame. Surprisingly, so far, CnW was not able to recover the biggest chunks found by photorec, that could play for at least a handful of seconds.

This is evidence that at least there's more to be carved. Do you think some other tool will be able to recover the files without all such noise? In addition, if you know some other, non free, tools, please do not hesitate to share their names with me. I would gladly spend a few hundred bucks to recover my files, rather than attempting time consuming approaches like the one you mention of zeroing the sectors.

Thank you.

 
Posted : 16/09/2019 5:42 pm
jaclaz
(@jaclaz)
Posts: 5133
Illustrious Member
 

Dear jaclaz,
Thank you very much for your reply. I appreciate your explanation and the pointer you provided me with.

1. I will try DMDE as soon as possible.
2. Once photorec recovers a file, how do I know which sectors to zero out on my device? (or, better, in the image that I have obtained by ddrescue - ing my drive)?

3. In the meantime I am trying CnW (https://www.cnwrecovery.com/). it is recovering many chunks of the same files discovered by photorec, and many chunks that photorec had completely missed. This time, however, the chunks are very small (few kB), and they are partial (with bottom noise bands) or extremely noisy in the whole frame. Surprisingly, so far, CnW was not able to recover the biggest chunks found by photorec, that could play for at least a handful of seconds.

This is evidence that at least there's more to be carved. Do you think some other tool will be able to recover the files without all such noise? In addition, if you know some other, non free, tools, please do not hesitate to share their names with me. I would gladly spend a few hundred bucks to recover my files, rather than attempting time consuming approaches like the one you mention of zeroing the sectors.

Thank you.

Yep the point is exactly that Photorec doesn't tell you where the files are, hence the try with DMDE, which may find/recover the same (or more, or less) files as Photorec does but it can actually tell you the extents where the files (or parts of them are).

CNWrecovery is an excellent tool, particularly for images and video, but of course each tool has its own way to "recognize" files or parts of them so in the real world there is not a single "perfect" tool, depending on the importance of the data one needs to throw at the stupid disk (image) each and every tool (+1).

BTW the Author of CNWrecovery is a member (mscotgrove) of this forum, so if he sees your thread he may be able to explain you the matter with more detail, loosely video files are among the most difficult to recover because they tend to be very big (and thus more prone to fragmentation) and usually contiguous files can be recovered just fine whilst fragmented one can only be recovered by "special" tools (like CNWrecovery) that anyway may still "miss" some file (of chunks of them).

jaclaz

 
Posted : 16/09/2019 6:49 pm
Share: