Recovery of undeleted files

Using PhotoRec to recover lost data
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
uli42
Posts: 3
Joined: 11 Aug 2015, 21:26

Recovery of undeleted files

#1 Post by uli42 »

Hello,

my daugther accidently delete a video on a Galaxy S4mini. I had good experiences with photorec in the past so I ran photorec 7.0 (on Linux) over the SD card and it found all the undeleted mp4 files and one deleted. This is what I had expected.

However, some of recovered undeleted the files show up with a wrong size an cannot be played.
I suspect there's a bug in the exfat/mp4 recovery code.

Here's the list of files, the onses starting with a number are still on the SD card, the ones starting with f are the recovered ones. File with the * are playing fine, the others are not playing; the one with !!! is supposedly the one that got deleted accidently and cannot be played either:

Code: Select all

-rwx------ 1 root root   2404533 Nov 11  2013 20131111_171132.mp4 *
-rw-r--r-- 1 root root   2404533 Aug 11 00:58 f0057344.mp4        *
-rwx------ 1 root root   4531134 Jan 26  2014 20140126_183417.mp4 *
-rw-r--r-- 1 root root   4531134 Aug 11 00:58 f0125184.mp4        *
-rwx------ 1 root root   6740298 Aug 10 21:32 20150810_203237.mp4 *
-rw-r--r-- 1 root root   6740298 Aug 11 01:02 f9666048.mp4        *
-rw-r--r-- 1 root root  20922698 Aug 11 00:58 f0134144.mp4
-rwx------ 1 root root  20929214 Jan 26  2014 20140126_183424.mp4 *
-rw-r--r-- 1 root root  22117029 Aug 11 00:58 f1615872.mp4
-rwx------ 1 root root  22123879 Jun  7  2014 20140607_203545.mp4 *
-rw-r--r-- 1 root root  27007010 Aug 11 00:58 f3269120.mp4
-rwx------ 1 root root  27015135 Mai 31 16:10 20150531_151007.mp4 *
-rwx------ 1 root root  33615337 Dez 27  2014 20141227_175451.mp4 *
-rw-r--r-- 1 root root  33615337 Aug 11 00:59 f5045248.mp4        *
-rw-r--r-- 1 root root  34375630 Aug 11 00:58 f3096576.mp4        *
-rwx------ 1 root root  34385587 Dez 20  2014 20141220_205927.mp4 *
-rw-r--r-- 1 root root  35176114 Aug 11 00:58 f3633920.mp4
-rwx------ 1 root root  35186291 Dez 20  2014 20141220_210221.mp4 *
-rw-r--r-- 1 root root  56109204 Aug 11 00:59 f4839168.mp4
-rwx------ 1 root root  56124805 Jun 22 21:21 20150622_202109.mp4 *
-rwx------ 1 root root 160417886 Jun 22 21:22 20150622_202143.mp4 *
-rw-r--r-- 1 root root 160417886 Aug 11 01:01 f8101376.mp4        *
-rw-r--r-- 1 root root 216201839 Aug 11 01:02 f8914944.mp4        !!!
-rw-r--r-- 1 root root 221220016 Aug 11 00:58 f1585152.mp4
-rwx------ 1 root root 221277736 Sep  6  2014 20140906_150634.mp4 *
-rwx------ 1 root root 238679515 Jun 22 21:26 20150622_202407.mp4 *
-rw-r--r-- 1 root root 238679515 Aug 11 01:01 f8414720.mp4        *
-rw-r--r-- 1 root root 272659472 Aug 11 00:58 f0372736.mp4
-rwx------ 1 root root 272729673 Sep 30  2014 20140930_214918.mp4 *
-rw-r--r-- 1 root root 438980270 Aug 11 00:59 f3765760.mp4
-rwx------ 1 root root 439093603 Dez 20  2014 20141220_210243.mp4 *
When I use vlc to play the corrupted videos I get:

Code: Select all

vlc f3633920.mp4
VLC media player 2.1.6 Rincewind (revision 2.1.6-0-gea01d28)
[0xe0f148] main libvlc: Running vlc with the default interface. Use 'cvlc' to use vlc without interface.
[0x7f6facc01858] mp4 demux error: MP4 plugin discarded (no moov,foov,moof box)
[0x7f6facc01858] es demux error: cannot peek
[0x7f6facc01858] es demux error: cannot peek
[0x7f6facc01858] es demux error: cannot peek
[0x7f6facc01858] es demux error: cannot peek
[0x7f6facc01858] es demux error: cannot peek
[0x7f6facc01858] ps demux error: cannot peek
[0x7f6facc01858] mpgv demux error: cannot peek
[0x7f6facc01858] mjpeg demux error: cannot peek
[0x7f6facc01858] ps demux error: cannot peek
[0x7f6fec001a98] main input error: no suitable demux module for `file/://f3633920.mp4'
So is there an explanation why even the recovery of undeleted files fails? Is there a way to repair those files (including the deleted one)?

Uli

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: Recovery of undeleted files

#2 Post by cgrenier »

Try TestDisk, Advanced, Undelete. You may get better results.

uli42
Posts: 3
Joined: 11 Aug 2015, 21:26

Re: Recovery of undeleted files

#3 Post by uli42 »

testdisk did not find the missing file at all.

Meanwhile I have tested my RAM (ok), used another SD card reader in another computer and the result is the same. Photorec does not correctly reconstruct mp4 files on exfat. The recovered files are the same for the first few MB and then they suddenly differ from the original. I can provide some files if you want.

Uli

geaplanet
Posts: 2
Joined: 14 Aug 2015, 09:50

Re: Recovery of undeleted files

#4 Post by geaplanet »

And with other players?
Mplayer is better if the file is corrupted. If you can play with mplayer you will can transcode it again and restructure it.

uli42
Posts: 3
Joined: 11 Aug 2015, 21:26

Re: Recovery of undeleted files

#5 Post by uli42 »

No, mplayer was also unable to play the files:

Code: Select all

Playing f3633920.mp4.
libavformat version 54.20.4 (external)
Mismatching header version 54.20.3
libavformat file format detected.
[mov,mp4,m4a,3gp,3g2,mj2 @ 0x7f704b1d1600]moov atom not found
LAVF_header: av_open_input_stream() failed
MOV: missing header (moov/cmov) chunk! Maybe broken file...
libavformat file format detected.
[mov,mp4,m4a,3gp,3g2,mj2 @ 0x7f704b1d1600]moov atom not found
LAVF_header: av_open_input_stream() failed


Exiting... (End of file)
The original files play fine with mplayer and vlc. When the files can be read in the undeleted state why can't they be "recovered" properly?

Uli

Locked