All times are UTC - 5 hours [ DST ]




Post new topic Reply to topic  [ 8 posts ] 
Author Message
 Post subject: .MOV in RAW research
PostPosted: August 24th, 2020, 19:06 
Offline

Joined: November 21st, 2009, 10:38
Posts: 69
Location: Europe
I need to recover some video (.MOV) from a formatted Hard Drive.

Pretty all common software can do it by RAW research, but problem is result:
instead of original videos in full lenght I just can obtain a tons of little parts.
Thousands of short videos and fragments.

Someone can advice me a software with specific carving algoritm for .MOV video files?


Top
 Profile  
 
 Post subject: Re: .MOV in RAW research
PostPosted: August 24th, 2020, 22:44 
Offline
User avatar

Joined: August 15th, 2006, 3:01
Posts: 2963
Location: CDRLabs @ Chandigarh [ India ]
Well,
I do not see that amount of fragmentation in .mov files on hdds using rstudio ,although the recovery in raw by this tool is also conventional methods

_________________
Regards
Amarbir S Dhillon , Chandigarh Data Recovery Labs
Logical,Semi Physical And Physical Data Recovery
Website-> http://www.chandigarhdatarecovery.com


Top
 Profile  
 
 Post subject: Re: .MOV in RAW research
PostPosted: August 25th, 2020, 9:06 
Offline

Joined: May 13th, 2019, 7:50
Posts: 184
Location: Nederland
What file system originally?

_________________
www.disktuna.com - photo repair service


Top
 Profile  
 
 Post subject: Re: .MOV in RAW research
PostPosted: August 25th, 2020, 9:10 
Offline

Joined: November 21st, 2009, 10:38
Posts: 69
Location: Europe
Arch Stanton wrote:
What file system originally?


NTFS formatted NTFS again.
Is not possible to rebuild because is probably a bit overwritten


Top
 Profile  
 
 Post subject: Re: .MOV in RAW research
PostPosted: August 25th, 2020, 9:32 
Offline

Joined: May 13th, 2019, 7:50
Posts: 184
Location: Nederland
Alkemist wrote:
Arch Stanton wrote:
What file system originally?


NTFS formatted NTFS again.
Is not possible to rebuild because is probably a bit overwritten


Volume was written to since it was reformatted? So they're not detected by filename? Using whatever, R-Studio, UFS, ReclaiMe etc.? If filenames do appear in your file recovery software, do run lists look okay? And if so and yet recovered files are corrupt then it's very likely portions of the file have been overwritten. No specialized carver can solve that.

ISTM then you can not even be certain portions of the videos haven't been overwritten themselves if file recovery software does not even find MFT entries for them. Which makes it hard to judge if the little chunks you did recover are best possible result or not.

Anyway. Tools do exist that carve for and try to reconstruct fragmented video, however these were primarily designed to scan memory cards. Some even for one specific device that was used to record video. MOV is quite flexible and so atoms, the parts that make up the file, may appear in very different orders which makes it kind of hard to figure out which part belongs to what file. So a tool 'knowing' how a specific GoPro formats the video helps recovery while another tool designed for a different device may fail recovering GoPro video.

Typical fragmentation of video files are result of a combination of factors: The file system they're written to (so some flavor or FAT probably) and the nature of recording video, where in advance it is unknown how large file will be. However once you copied such a file to a hard drive, this fragmentation will be largely resolved as OS driver now has the chance to look for a chunk of clusters large enough to accommodate the file.

The carver can still fuck up because it may apply very simple rules for end of file detection, and assume a certain layout of atoms. If you'd take one intact file shot with same device and examine order of atoms, you may be able to carve using a disk editor.

These make specialized MP4/MOV carvers:

https://soft.512byte.ua/
https://www.klennet.com/
https://www.cnwrecovery.com/

Again, all written with memory cards in mind. On hard drives they make make days to complete, if they even do.

_________________
www.disktuna.com - photo repair service


Top
 Profile  
 
 Post subject: Re: .MOV in RAW research
PostPosted: August 29th, 2020, 23:48 
Offline

Joined: August 29th, 2020, 22:23
Posts: 3
Location: New York City
I've used 'foremost' for this purpose. It's not a GUI program, nor does it run under Windows. It was written by two special agents in US Air Force intellgence to recover data as files, regardless of format, partitioning, or fragmentation. Even if the partition table is destroyed, it works fine. But you don't get filenames back, even if they're there. And it's fast, 1-2 hours for a 100GB partition.

It's primarily for use by military and law enforcement in forensic recovery work, usually on partition image files. But it can be used directly on the original source.

It reads a configuration file that lists header and footer bytes for each type of file. You simply uncomment the file types to recover, set the maximum size of files to recover within each type you wish to recover, and foremost carves them out.

I've recovered >300MB video files from drives that were used for days, weeks or months before the user asked for help. There's also 'photorec' which recovers files from repartitioned, reformated media.

If chunks are missing from a video file, 'ffmpeg' can smooth out the transitions. I think it's available for Windows. Windows does not permit some useful DR functions, because of concerns over using them for copyright violation.

Foremost works as long as the drive is working properly. For failing drives, 'ddrescue' is phenomenal. I had a dvd that looked like someone put it under their tire for traction to get out of a snow drift. Ddrescue recovered the whole disk in about 12 hours.


Top
 Profile  
 
 Post subject: Re: .MOV in RAW research
PostPosted: August 30th, 2020, 7:06 
Offline

Joined: May 13th, 2019, 7:50
Posts: 184
Location: Nederland
Wooooohhh! Special Agents! https://www.youtube.com/watch?v=hAAlDoAtV7Y

As far as I know the tools you mention don't do anything more advanced than carving as implemented in generic file recovery tools. So trying these will probably not add a lot other than wasted time.

You being able to carve 300+ MB has nothing to do with special agent tricks but with luck.

_________________
www.disktuna.com - photo repair service


Top
 Profile  
 
 Post subject: Re: .MOV in RAW research
PostPosted: September 2nd, 2020, 10:31 
Offline

Joined: June 12th, 2017, 5:42
Posts: 23
Location: Nottingham
What exact camera / resolution are we talking?

You can send me an original sample here if you like: lctech.myairbridge.com

And I'll let you know if any of our raw scans can get them? We have built in a fragmented scan to our SanDisk RescuePRO and Videorecovery..

_________________
https://lc-tech.co.uk/


Top
 Profile  
 
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 8 posts ] 

All times are UTC - 5 hours [ DST ]


Who is online

Users browsing this forum: No registered users and 4 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group