mov files saves only 24 bytes

Using PhotoRec to recover lost data
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
User avatar
seahorse41
Posts: 1
Joined: 02 May 2019, 15:56
Location: Republic, WA
Contact:

mov files saves only 24 bytes

#1 Post by seahorse41 »

running photorec 7.0.3 on Debian 32-bit, I have used dd to copy the sd card with deleted mov files.
I can see the files in mc, viewing raw in hex, at several offsets.
When I run photorec, relevant lines output:
Disk MOBIUS.dd - 31 GB / 28 GiB (RO)
Partition Start End Size in sectors
1 * FAT32 LBA 0 130 3 3774 124 62 60628992 [MOBIUS]
134 files saved in /usr/share/audvid/recovery/recup_dir directory.

but all 134 mov files it recovers are all only 24 bytes in length. Looks like only the header gets saved.

Comparing to undeleted mov files written by the same camera,
$ fidentify 20190404_1420_rec18064.mov
20190404_1420_rec18064.mov: mov

$ hexdump -C 20190404_1420_rec18064.mov | head

Code: Select all

00000000  00 00 00 18 66 74 79 70  71 74 20 20 00 00 00 00  |....ftypqt  ....|
00000010  71 74 20 20 00 00 00 00  00 02 10 b4 66 72 65 61  |qt  ........frea|
00000020  00 00 00 0c 74 69 6d 61  00 00 00 b5 00 00 3a 08  |....tima......:.|
00000030  74 68 6d 61 ff d8 ff db  00 84 00 08 06 06 07 06  |thma............|
00000040  05 08 07 07 07 09 09 08  0a 0c 14 0d 0c 0b 0b 0c  |................|
00000050  19 12 13 0f 14 1d 1a 1f  1e 1d 1a 1c 1c 20 24 2e  |............. $.|
00000060  27 20 22 2c 23 1c 1c 28  37 29 2c 30 31 34 34 34  |' ",#..(7),01444|
00000070  1f 27 39 3d 38 32 3c 2e  33 34 32 01 09 09 09 0c  |.'9=82<.342.....|
00000080  0b 0c 18 0d 0d 18 32 21  1c 21 32 32 32 32 32 32  |......2!.!222222|
00000090  32 32 32 32 32 32 32 32  32 32 32 32 32 32 32 32  |2222222222222222|
So it appears this file type Should already be known. Comparing byte by byte, the first 4 bytes of the frea atom differ of course, being the size of the frea block. Same for thma. etc.
Any ideas why photorec fails to recover this?

Are there any tools to see the FAT? (Something like Norton Disk Doctor 20 years ago) To verify the next sector or block in the chain of blocks is still intact, all the way to the end where the moov atom and footer is at.
Maybe the footer is what's not recognized? That last block starts with udta and is 52 bytes long. Ends with the camera name HDDVR-Mobius

Thank you

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: mov files saves only 24 bytes

#2 Post by cgrenier »

The problem should be fixed by latest version, Please download the 7.1-WIP binaries from https://www.cgsecurity.org and try it.

recuperation
Posts: 2720
Joined: 04 Jan 2019, 09:48
Location: Hannover, Deutschland (Germany, Allemagne)

Re: mov files saves only 24 bytes

#3 Post by recuperation »

Are there any tools to see the FAT? (Something like Norton Disk Doctor 20 years ago) To verify the next sector or block in the chain of blocks is still intact, all the way to the end where the moov atom and footer is at.
Maybe the footer is what's not recognized? That last block starts with udta and is 52 bytes long. Ends with the camera name HDDVR-Mobius
Runtime DiskExplorer for FAT is such a tool. But your assumption is wrong. Deleting files under FAT32 means cleaning up the FAT. FAT information for the deleted files is not available. Luckily you can always find the first cluster based upon the remaining information from the directory entry with the "deleted status" and move forwards in a linear way ignoring the length information in the directory entry. You can then export as many clusters as you consider necessary using your preferred disk editor.

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: mov files saves only 24 bytes

#4 Post by cgrenier »

recuperation wrote: 03 May 2019, 15:30 Runtime DiskExplorer for FAT is such a tool. But your assumption is wrong. Deleting files under FAT32 means cleaning up the FAT. FAT information for the deleted files is not available. Luckily you can always find the first cluster based upon the remaining information from the directory entry with the "deleted status" and move forwards in a linear way ignoring the length information in the directory entry. You can then export as many clusters as you consider necessary using your preferred disk editor.
It's what TestDisk, Advanced, Undelete does to recover files from FAT.

Locked