Hi folks,

I've been working on another video recovery project, this time involving a WolfBox dashcam that records three separate video streams, with audio present on only one.

What started as a recovery job turned into a fairly interesting reverse-engineering exercise. The recorder uses HEVC/H.265 video with proprietary structures, including tbgp metadata and interleaved media wrappers. One of the challenges was that conventional file carving and filesystem-based recovery couldn't reliably reconstruct recordings once the original allocation information was missing or damaged. There is also additional GPS data scattered around which really messes up carvers.

I ended up writing a native Windows C application to work directly against the physical media.

- Scans raw disk images for WolfBox recording structures.
- Identifies moov atoms, tbgp structures and physical media units.
- Reconstructs logical HEVC sample sequences from physical offsets, sample sizes and timing information.
- Handles the three video streams independently, without expecting AAC audio on every stream.
- Recovers video without requiring a working FAT filesystem.
- Can reconstruct usable video from orphaned physical fragments even when the original recording index is unavailable.
- Recovers JPEG images, which may provide additional clues about recordings.
- Exports playable MP4 video where sufficient data survives.

The current implementation is specific to the WolfBox recording structures we've studied, and results will depend on what physical data survives. It also cannot reconstruct bytes that have genuinely been overwritten.

I'm making the WolfBox tool and source available on GitHub for anyone interested in using it:
https://github.com/mkinderwater/wolfboxrecovery

Many thanks! This is getting to be a habit.

_________________
A backup a day keeps DR away.

... said the thousands of people YOU helped before my time...