mov files saves only 24 bytes
Posted: 02 May 2019, 17:22
running photorec 7.0.3 on Debian 32-bit, I have used dd to copy the sd card with deleted mov files.
I can see the files in mc, viewing raw in hex, at several offsets.
When I run photorec, relevant lines output:
Disk MOBIUS.dd - 31 GB / 28 GiB (RO)
Partition Start End Size in sectors
1 * FAT32 LBA 0 130 3 3774 124 62 60628992 [MOBIUS]
134 files saved in /usr/share/audvid/recovery/recup_dir directory.
but all 134 mov files it recovers are all only 24 bytes in length. Looks like only the header gets saved.
Comparing to undeleted mov files written by the same camera,
$ fidentify 20190404_1420_rec18064.mov
20190404_1420_rec18064.mov: mov
$ hexdump -C 20190404_1420_rec18064.mov | head
So it appears this file type Should already be known. Comparing byte by byte, the first 4 bytes of the frea atom differ of course, being the size of the frea block. Same for thma. etc.
Any ideas why photorec fails to recover this?
Are there any tools to see the FAT? (Something like Norton Disk Doctor 20 years ago) To verify the next sector or block in the chain of blocks is still intact, all the way to the end where the moov atom and footer is at.
Maybe the footer is what's not recognized? That last block starts with udta and is 52 bytes long. Ends with the camera name HDDVR-Mobius
Thank you
I can see the files in mc, viewing raw in hex, at several offsets.
When I run photorec, relevant lines output:
Disk MOBIUS.dd - 31 GB / 28 GiB (RO)
Partition Start End Size in sectors
1 * FAT32 LBA 0 130 3 3774 124 62 60628992 [MOBIUS]
134 files saved in /usr/share/audvid/recovery/recup_dir directory.
but all 134 mov files it recovers are all only 24 bytes in length. Looks like only the header gets saved.
Comparing to undeleted mov files written by the same camera,
$ fidentify 20190404_1420_rec18064.mov
20190404_1420_rec18064.mov: mov
$ hexdump -C 20190404_1420_rec18064.mov | head
Code: Select all
00000000 00 00 00 18 66 74 79 70 71 74 20 20 00 00 00 00 |....ftypqt ....|
00000010 71 74 20 20 00 00 00 00 00 02 10 b4 66 72 65 61 |qt ........frea|
00000020 00 00 00 0c 74 69 6d 61 00 00 00 b5 00 00 3a 08 |....tima......:.|
00000030 74 68 6d 61 ff d8 ff db 00 84 00 08 06 06 07 06 |thma............|
00000040 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c |................|
00000050 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e |............. $.|
00000060 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 |' ",#..(7),01444|
00000070 1f 27 39 3d 38 32 3c 2e 33 34 32 01 09 09 09 0c |.'9=82<.342.....|
00000080 0b 0c 18 0d 0d 18 32 21 1c 21 32 32 32 32 32 32 |......2!.!222222|
00000090 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 |2222222222222222|
Any ideas why photorec fails to recover this?
Are there any tools to see the FAT? (Something like Norton Disk Doctor 20 years ago) To verify the next sector or block in the chain of blocks is still intact, all the way to the end where the moov atom and footer is at.
Maybe the footer is what's not recognized? That last block starts with udta and is 52 bytes long. Ends with the camera name HDDVR-Mobius
Thank you