Hi,

I recorded an online video conference using CamStudio. Unfortunately when it reached 4 GB CamStudio suddenly warned me it couldn't save the file (because of its size or something) any more, then crashed with unhandled exception. It created the temporary file before recording and had been writing into it, but deleted it when the error occured. I tried a few data recovery software suites (GetDataBack, Restoration, Recuva, File Scavenger) to get the file back, but none of them showed me the file. Then I used google to find a solution and on a few forums they said it's unable to restore a file with this size. Unfortunately the same was proven by the applications I used.

On the flip side as well, CamStudio doesn't write an AVI header into its temporary file. So the only available information for me is that the video was encoded with the Lossless RGBA Compression codec, which I think is identical to Huffyuv. I would like to have an application which can recognize Huffyuv data patterns and extract them from stored blocks. I guess there is a distinct data pattern of Huffyuv, moreover I found a constant byte sequence with which a Huffyuv stream generally seems to start. Here you can see it in HEX and ASCII format ("00db" in ASCII):



I know the width and height of the video, also the color depth.
There must be a data recovery tool or method which could help in my situation. The question is, who knows any?

The file system is NTFS.

This is really urgent for me, and the recording is important. If you have any idea, please share it with me.

Thank you

I am not at all familiar with Camstudio or the files it creates,
but

what I'd try to do is run R-Studio raw search, after you create a custom file type. For this, you will need current file's top and bottom signatures.
You can find instruction about how to do this with very good details on R-Studio's website.

I have tried this once and it worked pretty good.

But to make sure you've set everything right, try it first on some other media which contains such files and see if your settings work.

Good luck.

_________________
http://www.northwind.gr
SandForce SSD Recovery
Ransomware Reverse Engineering - NoMoreRansom! partners