MKV Files Won't Recover Properly - Different Files From PhotoRec

Using TestDisk to undelete files
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
Peeko
Posts: 1
Joined: 04 Aug 2020, 05:08

MKV Files Won't Recover Properly - Different Files From PhotoRec

#1 Post by Peeko »

Hello!

I deleted some videos today from my flash drive and my Windows settings had it so it permanently deleted them instead of sending it to the Recycle Bin. I've been messing around with both of the tools for a few hours now in an attempt to get them back, and I'm having little success.

TestDisk can easily find the deleted videos on my flash drive, but they don't seem to recover properly, as seen here:

Can find them fine... - Image

...but most recover as corrupt - Image

I've tried multiple media players and get the following errors:

Windows Media Player - Image

Media Player Classic - Image

VLC just doesn't play the video at all, no messages.

I had high hopes with PhotoRec. It recovered quite a few of the videos I deleted today, but not the specific ones I want back.

• I tried creating my flash drive into an image.dd file and doing PhotoRec and TestDisk on that, but got the same results.
• I tried PhotoRec with the option of getting corrupt files and that just recovered the same exact files.
• I tried something from a form post that had a similar issue I saw that also didn't work (Rebuild BS).

I'm close to giving up, but because I can see the files and recover them (albeit not all the way) in TestDisk, then I figure there's someway I can make PhotoRec try and get those specific files.

Any help would be very appreciated!

Thank you,

Jordan

recuperation
Posts: 2718
Joined: 04 Jan 2019, 09:48
Location: Hannover, Deutschland (Germany, Allemagne)

Re: MKV Files Won't Recover Properly - Different Files From PhotoRec

#2 Post by recuperation »

Your flash drive is using FAT32 as a file system.
When you delete files in there, the cluster the data is using are freed. Once you write on that drive those freed clusters can be overwritten.
Even if you did not write on this drive the clusters of this drive may not be located in a linear manner one after another. This is the reason why Testdisk, Photorec and other software will most likely fail as they assemble the clusters in a linear fashion.

Defragmentation is your enemy when you have lost metadata such as the clusters used for saving the data!

BitterColdSoul
Posts: 50
Joined: 07 Jun 2020, 20:38
Location: France

Re: MKV Files Won't Recover Properly - Different Files From PhotoRec

#3 Post by BitterColdSoul »

Defragmentation is your enemy when you have lost metadata such as the clusters used for saving the data!
Fragmentation, you mean.
Even if you did not write on this drive the clusters of this drive may not be located in a linear manner one after another. This is the reason why Testdisk, Photorec and other software will most likely fail as they assemble the clusters in a linear fashion.
Normally with MKV files even a partial file should be readable (with other video formats that's not possible). If a supposed MKV file is not readable at all, it means that either it's been overwritten from the beginning (there is no longer a valid MKV header), or it wasn't actually a MKV file to begin with (it could be a MP4 with a .mkv extension for instance).
You can know for sure (if you still have those files) by opening them in a hexadecimal editor, like HxD (free) or WinHex (commercial, much more powerful, can be used for free to view files' contents).
A valid MKV file should begin with something like this :

Code: Select all

.Eߣ£B†..B÷..Bò.
.Bó..B‚ˆmatroska
B‡..B…...S€g....
Of course the thing that should NEVER be done is attempting to recover data from a device onto that device itself... (I once tried to help someone remotely who had a similar issue, she was a professional videast working on a documentary, had copied a bunch of videos to her computer and deleted them on the SD card... except she had forgotten an important one, an interview... And before I called her after seeing her request on a classified ads website, she had asked a friend working in IT to try something -- and despite his IT background that moron did exactly that, he tried a bunch of random recovery softwares gathered on teh Internetz, some of which don't display any warning when the target directory for the recovery is located on the same device and same partition as the source, and he recovered them all, not just the one that was needed. So I thought that it would be quick and make a few bucks, but I spent more than an hour on it, only to show her that the file she wanted had been overwritten by one of the other files which had been written since the deletion -- and I never got paid.)

Locked