REC files

Using PhotoRec to recover lost data
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
bigredbutton
Posts: 4
Joined: 28 Nov 2013, 21:57

REC files

#1 Post by bigredbutton »

I accidentally wrote a linux partition over the first 700 MB of my mac's media drive. Luckily Photorec was able to recognize the old file system behind the wall.

Now I'm trying to recover my tv recordings (rec files from PVR). They are mpeg2 ts streams with Topfield header. I made a signature file, but Photorec recognizes the video and as a result the header and ts parts get separated.
The header begins with "TFrc". It contains the recording date, the program name and some other data. The ts stream begins after the header at 0xE80.

Here's the beginning of the header:

Code: Select all

00000000  54 46 72 63 50 00 00 00  00 03 00 00 00 00 00 00  |TFrcP...........|
00000010  04 30 00 11 01 00 02 00  02 00 82 8b 54 56 31 00  |.0..........TV1.|
00000020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000030  00 00 00 00 00 04 2e 50  1a f4 00 01 a5 09 03 00  |.......P........|
00000040  80 00 00 32 00 00 00 f2  d5 55 06 0f d5 55 07 05  |...2.....U...U..|
00000050  04 11 00 05 53 79 64 e4  6e 20 70 61 69 6b 61 6c  |....Syd.n paikal|
00000060  6c 61 61 6e 05 54 6f 73  69 20 6b 79 73 79 6d 79  |laan.Tosi kysymy|
00000070  6b 73 65 73 73 e4 2e 20  41 6e 6e 61 6e 20 76 61  |ksess.. Annan va|
00000080  75 76 61 6c 6c 61 20 74  6f 64 65 74 61 61 6e 20  |uvalla todetaan |
Is it possible to tie the header to the ts stream and extract the date and name to file info?

Or better still, is it possible to bring the hfs+ partition back with Testdisk?


-sam

bigredbutton
Posts: 4
Joined: 28 Nov 2013, 21:57

Re: REC files

#2 Post by bigredbutton »

I'm amazed. Photorec ran overnight and in a few hours it filled my backup drive. Another recovery app I tested was able to find only 12% of my files in 24 hours. No more black paint!

The ts files it found were usually in two or more pieces. I could successfully combine one movie with cat and there was only a small error in the seam. While this is acceptable, it would save a lot of work if the files were in one piece. Also, some pieces were missing.
Could it be transmission errors in the original mpeg streams? Would it help if Photorec was told to keep the broken files?

There were also lots of small black mpg files, not more than a couple of hundred KB each. Where do they come from? Are they from dvd rip files (vobs were saved as mpg)?

-sam

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: REC files

#3 Post by cgrenier »

Try the recovery with mpg disabled in FileOpts. Do you get better results ?

In Options, set paranoid to No, start a recovery, stop it after a few ts are recovered, check you the video is "better": the recovered file will be larger but there is the risk to get a large file instead of several video files...

Please tell me which solution is the best (default settings, mpg disabled or paranoid=No)

bigredbutton
Posts: 4
Joined: 28 Nov 2013, 21:57

Re: REC files

#4 Post by bigredbutton »

I tested some settings.

If I disable mpg, I get a video in 2-3 parts, some videos in one part if I'm lucky. The reason might be occasional tv transmission errors which have corrupted the ts packets inside the file. Turning paranoid off and on had a very small effect, the video was only 1MB bigger when turned off (2,36GB total size).
Paranoid=no and mpg=enabled split the test video in 10 parts and 7 small mpg files. On the other hand, if I combine the file from ts & mpg I can reconstruct video with no glitches in the seams.

Maybe one round with mpg disabled and a second with ts disabled. I will continue as soon I get a bigger backup hard drive.

Merci,
-sam

Locked