cgsecurity.org

Hello,
I have used photorec to recover some files from an hard disk. I found that many files that photorec recovers have extensions like sqlite, torrent, plist, etc., but inside they contain video segments (often interleaved with garbage, looking at the file through an hex editor).
I can recover some of these segments via mencoder (mencoder -idx RECOVERED-FILE -ovc copy -oac copy -o OUT-FILE).

Do you have other suggestions that may enable me to recover more video fragments? Perhaps using photorec in combo with other tools (for video repair, e.g., ffmpeg, or other tools like ddrescue, fsck, or even like scalpel or foremost)? Some of these video fragments are from videos taken online (avi, mpeg), while others are taken with a Toshiba Camileo.

ANY suggestion is highly appreciated.

Thank you.

harold wrote: ↑11 Sep 2019, 23:06 Hello,
I have used photorec to recover some files from an hard disk. I found that many files that photorec recovers have extensions like sqlite, torrent, plist, etc., but inside they contain video segments (often interleaved with garbage, looking at the file through an hex editor).
I can recover some of these segments via mencoder (mencoder -idx RECOVERED-FILE -ovc copy -oac copy -o OUT-FILE).

The outcome of Photorec is is just an educated guess using fingerprints. Some fingerprints may not be very specific. Video fragment data could contain data which correspond to a certain fingerprint.
I say that without being able to read the source code of Photorec, just by knowing how certain file system work.

Do you have other suggestions that may enable me to recover more video fragments? Perhaps using photorec in combo with other tools (for video repair, e.g., ffmpeg, or other tools like ddrescue, fsck, or even like scalpel or foremost)? Some of these video fragments are from videos taken online (avi, mpeg), while others are taken with a Toshiba Camileo.

ddrescue is just a fault-tolerant software to copy devices like harddrives. It is not useful for your purpose.
The same applies to fsck.
What you would need is an individual search approach for each file type.
I am not aware of such software because that would involve intelligence.
You would need to judge if the data of the next cluster fits to your current search result.

There is software around to fix errors in files like mp3 and asf. But this is just something you could treat your search results with and it would not increase your search yield.