Which file carver does more in-depth analysis?
October 7th, 2024, 13:47
I'm working on a damaged Sandisk microSD. 6% damage in total, Ex-fat fragments are scattered around but not enough to rebuild filesystem. Customer wants his jpg and mp4-files, the rest is of no importance.
From the rescued dump I have tried R-Studio, DMDE and Photorec but they all give the same kind of carving results. That is, they say the files are rescued but of the 5000 files I've peeked through none is completely rescued. Instead, the only thing that's rescued is the beginning at the file. The rest of the contents have been saved in a different block, so the results in these three softwares is completely useless.
VNR has something called a File assembler and it seems to be something like that I'm looking for. The problem with using VNR in this case, where the damages are many, is that it takes about 12 hours scanning one block (out of 0xF6 in total). That means the software is completely locked up while scanning and I cannot do any other NAND-work in the meantime. Therefore I am looking for some other kind of software with similiar functions to "File assembler", that I can run on an otherwise unused computer so it doesn't affect my work.
Is there a carver software with this feature? Customer got a large budget so the software cost is no issue.
From the rescued dump I have tried R-Studio, DMDE and Photorec but they all give the same kind of carving results. That is, they say the files are rescued but of the 5000 files I've peeked through none is completely rescued. Instead, the only thing that's rescued is the beginning at the file. The rest of the contents have been saved in a different block, so the results in these three softwares is completely useless.
VNR has something called a File assembler and it seems to be something like that I'm looking for. The problem with using VNR in this case, where the damages are many, is that it takes about 12 hours scanning one block (out of 0xF6 in total). That means the software is completely locked up while scanning and I cannot do any other NAND-work in the meantime. Therefore I am looking for some other kind of software with similiar functions to "File assembler", that I can run on an otherwise unused computer so it doesn't affect my work.
Is there a carver software with this feature? Customer got a large budget so the software cost is no issue.
- Attachments
-
- Untitled.png (12.39 KiB) Viewed 12692 times
Re: Which file carver does more in-depth analysis?
October 7th, 2024, 21:46
Klennet Carver can reassemble fragmented files, but I don't know how it copes with bad/missing sectors.
Re: Which file carver does more in-depth analysis?
October 8th, 2024, 21:23
People too often assume fragmentation while real cause may be something else. Like bit errors. Today I got this:
Card imaged over USB, then (left) recovered using R-Studio/UFS (Not sure that was what this lab used last time). I ran Klennet against same disk image (middle), even worse although in this case it does not really matter. JpegDigger recovered most of the file in a repairable state (right), lines can be repaired using content aware fill + bit of clone-stamping.
JpegDigger 'repair' option enabled to deal with issues, that are in turn caused by bit errors so that best part of a file at least displays.
Don't get me wrong, I love Klennet Carver. Just saying, do not assume fragmented files are only thing that produce files like these.
Card imaged over USB, then (left) recovered using R-Studio/UFS (Not sure that was what this lab used last time). I ran Klennet against same disk image (middle), even worse although in this case it does not really matter. JpegDigger recovered most of the file in a repairable state (right), lines can be repaired using content aware fill + bit of clone-stamping.
JpegDigger 'repair' option enabled to deal with issues, that are in turn caused by bit errors so that best part of a file at least displays.
Don't get me wrong, I love Klennet Carver. Just saying, do not assume fragmented files are only thing that produce files like these.
Powered by phpBB © phpBB Group.