Nextbase Dashcam - Sandisk 128GB MicroSD corrupted

[whiteduck]

A previously working and regularly reformatted MicroSD card from a Nextbase Dashcam 522GW lost all files after plugging into my Mac... all that is on there now is the .VT100Spotlight folder that the Mac indexes searches with. The drive would normally have a label of NEXTBASE - this is missing.

Photorec manages to recover >1000 files but most of these (which are MP4 format as seen as MOV by Photorec) cannot be opened... I know often this is considered to be fragmentation but oddly I can read 66 files and a bunch of text files that hold the dashcam status. Would I be able to read any of the .mov files if .mdat/ftyp fragmentation was at play. The Nextbase writes a small preview AND a larger full resolution file - they are not identical sizes but follow that pattern. The card was formatted before these files were written so there should be no over-writing taking place.

Running hexdumps:

These two work and are 1 minute (the Nextbase default) long:

Code: Select all

f7408128_ftyp.mov
00000000  00 00 00 20 66 74 79 70  61 76 63 31 00 00 00 00  |... ftypavc1....|
00000010  61 76 63 31 69 73 6f 6d  00 00 00 00 00 00 00 00  |avc1isom........|
00000020  0a 2b bf 38 6d 64 61 74  00 00 00 02 09 10 00 00  |.+.8mdat........|
00000030  00 13 06 00 0d 80 af c8  00 00 03 00 00 af c8 00  |................|
00000040  00 03 00 40 80 00 00 00  0e 06 01 09 00 3c 08 24  |...@.........<.$|
00000050  68 00 00 03 00 01 80 00  00 00 05 06 06 01 c4 80  |h...............|
00000060  00 04 7c 04 25 88 80 20  00 4c c6 f5 66 33 27 0b  |..|.%.. .L..f3'.|
00000070  d0 ce b3 93 4a 2f 47 e6  ab f2 f6 7c 45 25 1d d4  |....J/G....|E%..|
00000080  dc 43 4d 26 fe 24 1c 7d  0e 56 12 e2 55 be 46 68  |.CM&.$.}.V..U.Fh|
00000090  7f d2 fe 9c 1b 8d 90 09  8f 11 b4 4d 74 48 9d e3  |...........MtH..|
f7428608_ftyp.mov
00000000  00 00 00 20 66 74 79 70  61 76 63 31 00 00 00 00  |... ftypavc1....|
00000010  61 76 63 31 69 73 6f 6d  00 00 00 00 00 00 00 00  |avc1isom........|
00000020  00 9c 20 78 6d 64 61 74  00 00 00 02 09 10 00 00  |.. xmdat........|
00000030  00 13 06 00 0d 80 af c8  00 00 03 00 00 af c8 00  |................|
00000040  00 03 00 40 80 00 00 00  0e 06 01 09 00 3c 08 24  |...@.........<.$|
00000050  68 00 00 03 00 01 80 00  00 00 05 06 06 01 c4 80  |h...............|
00000060  00 00 46 c4 25 88 80 20  03 ff f2 1f 73 2e 4b 0c  |..F.%.. ....s.K.|
00000070  b6 eb 4c 9d 7a ee d1 8d  29 16 20 7e aa ee 28 f4  |..L.z...). ~..(.|
00000080  9e f3 52 6f 02 f5 1c 0a  3b f7 90 81 54 83 2e 14  |..Ro....;...T...|
00000090  55 67 6d 20 af d5 ff e5  04 6e 56 57 ff 4c fb 51  |Ugm .....nVW.L.Q|

These two don't work:

Code: Select all

f7776768_ftyp.mov
00000000  00 00 00 20 66 74 79 70  61 76 63 31 00 00 00 00  |... ftypavc1....|
00000010  61 76 63 31 69 73 6f 6d  00 00 00 00 00 00 00 00  |avc1isom........|
00000020  0a af eb 5a 6d 64 61 74  00 00 00 02 09 10 00 00  |...Zmdat........|
00000030  00 13 06 00 0d 80 af c8  00 00 03 00 00 af c8 00  |................|
00000040  00 03 00 40 80 00 00 00  0e 06 01 09 00 3c 08 24  |...@.........<.$|
00000050  68 00 00 03 00 01 80 00  00 00 05 06 06 01 c4 80  |h...............|
00000060  00 04 91 24 25 88 80 20  00 4c c6 ea 6a 2b 81 58  |...$%.. .L..j+.X|
00000070  56 2b b4 ed 3f 26 c1 2e  10 68 85 20 8f cf f8 63  |V+..?&...h. ...c|
00000080  45 f3 7c bc 9a 83 56 15  71 22 6e 76 a5 b9 21 39  |E.|...V.q"nv..!9|
00000090  17 6c 7f e1 10 42 9a 4f  65 d4 c4 95 96 70 c9 13  |.l...B.Oe....p..|
f7797248_ftyp.mov
00000000  00 00 00 20 66 74 79 70  61 76 63 31 00 00 00 00  |... ftypavc1....|
00000010  61 76 63 31 69 73 6f 6d  00 00 00 00 00 00 00 00  |avc1isom........|
00000020  00 a7 94 3a 6d 64 61 74  00 00 00 02 09 10 00 00  |...:mdat........|
00000030  00 11 06 00 0d 80 af be  00 00 0a 00 af be 00 00  |................|
00000040  0a 40 80 00 00 00 0e 06  01 09 00 3c 08 24 68 00  |.@.........<.$h.|
00000050  00 03 00 01 80 00 00 00  05 06 06 01 c4 80 00 00  |................|
00000060  3b 26 25 88 80 20 00 df  00 2a d6 47 eb 2d 6c 1f  |;&%.. ...*.G.-l.|
00000070  7e 88 4a 55 31 23 71 65  af 69 a3 d3 88 70 61 51  |~.JU1#qe.i...paQ|
00000080  03 87 00 9e 63 f8 1d 3a  18 57 01 a3 9c db e1 b7  |....c..:.W......|
00000090  d6 90 74 b5 1e 07 1e 96  ce 4e b9 e4 15 60 22 fc  |..t......N...`".|

Code: Select all

total 740088
drwxr-xr-x   6 root  staff        192 28 Feb 12:48 .
drwxr-xr-x  12 root  staff        384 28 Feb 12:48 ..
-rw-r--r--   1 root  staff  178203180 27 Feb 22:59 f7408128_ftyp.mov
-rw-r--r--   1 root  staff   10431020 27 Feb 22:59 f7428608_ftyp.mov
-rw-r--r--   1 root  staff  179301242 27 Feb 22:59 f7776768_ftyp.mov
-rw-r--r--   1 root  staff   10982490 27 Feb 22:59 f7797248_ftyp.mov

Any suggestions would be most appreciated!

Thank you
Ian

[recuperation]

I have no idea!
I am not familiar with the internals of this format.

This type of issue has appeared a couple of times in the forum:

viewtopic.php?p=23603&hilit=mp4+atom#p23603

Use the detailed search, using cgrenier aus author. Other keywords would be "mp4", "MOV" or "atom".

[whiteduck]

Thanks yes I saw that post but it says if "all" your files are found to be unreadable you need to join ftyp+mdat where as in my case some are readable which suggests something else is happening... would reformatting the card in the dashcam help photorec understand the sectors / boundaries / geometry ?

Thanks for your guidance

Best regards
Ian

[recuperation]

No! Formatting is a destructive operation which reduces chances of recovery.
Fragmentation is a symptom that reduces the chances of recovery as well.

If you are curious why some stuff was recovered and other stuff not you have to do your own research.

[whiteduck]

OK - thank you. If in the meantime anyone else has experienced the same and found a fix / reason then I'd appreciate it. Unfortunately I wasted my money on Stellar Photo Recovery premium which has not been able to solve this either... it used the reference file method to try to rebuild the .MOV but that resulted in shorter videos with lots of distortion...

[whiteduck]

Digging through a hexdump (not really knowing what to look for - I can see the date / time of the video clips in both the readable and unreadable files which suggests they are not totally corrupted... this pattern repeats - as the time and GPS location changes.

unreadable file:

Code: Select all

00075760  00 00 00 00 32 30 32 34  30 32 31 38 31 33 30 39  |....202402181309|
00075770  30 31 00 00 00 05 00 00  00 00 00 00 c0 ff ff ff  |01..............|
00075780  24 47 50 52 4d 43 2c 31  33 30 39 30 31 2e 39 30  |$GPRMC,130901.90|
00075790  30 2c 41 2c 35 30 34 31  2e 32 35 37 36 33 2c 4e  |0,A,5041.25763,N|
000757a0  2c 30 30 34 31 30 2e 38  34 38 35 37 2c 57 2c 35  |,00410.84857,W,5|
000757b0  36 2e 31 33 38 2c 38 30  2e 36 32 2c 31 38 30 32  |6.138,80.62,1802|
000757c0  32 34 2c 2c 2c 41 2a 35  46 0d 0a 0a 00 00 00 00  |24,,,A*5F.......|
000757d0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
00075800  24 47 50 47 47 41 2c 31  33 30 39 30 31 2e 39 30  |$GPGGA,130901.90|
00075810  30 2c 35 30 34 31 2e 32  35 37 36 33 2c 4e 2c 30  |0,5041.25763,N,0|
00075820  30 34 31 30 2e 38 34 38  35 37 2c 57 2c 31 2c 31  |0410.84857,W,1,1|
00075830  31 2c 31 2e 32 31 2c 31  30 38 2e 34 2c 4d 2c 35  |1,1.21,108.4,M,5|
00075840  32 2e 30 2c 4d 2c 2c 2a  36 44 0d 0a 00 00 00 00  |2.0,M,,*6D......|
00075850  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

and the good file

Code: Select all

00077060  00 00 00 00 32 30 32 34  30 32 31 38 31 33 30 38  |....202402181308|
00077070  30 31 00 00 40 05 00 00  00 00 00 00 00 01 00 00  |01..@...........|
00077080  24 47 50 52 4d 43 2c 31  33 30 38 30 31 2e 39 30  |$GPRMC,130801.90|
00077090  30 2c 41 2c 35 30 34 30  2e 38 37 30 35 37 2c 4e  |0,A,5040.87057,N|
000770a0  2c 30 30 34 31 32 2e 32  35 38 39 36 2c 57 2c 36  |,00412.25896,W,6|
000770b0  30 2e 37 30 39 2c 36 33  2e 33 35 2c 31 38 30 32  |0.709,63.35,1802|
000770c0  32 34 2c 2c 2c 41 2a 35  44 0d 0a 0a 00 00 00 00  |24,,,A*5D.......|
000770d0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
00077100  24 47 50 47 47 41 2c 31  33 30 38 30 31 2e 39 30  |$GPGGA,130801.90|
00077110  30 2c 35 30 34 30 2e 38  37 30 35 37 2c 4e 2c 30  |0,5040.87057,N,0|
00077120  30 34 31 32 2e 32 35 38  39 36 2c 57 2c 31 2c 31  |0412.25896,W,1,1|
00077130  33 2c 30 2e 38 33 2c 31  30 32 2e 35 2c 4d 2c 35  |3,0.83,102.5,M,5|
00077140  32 2e 30 2c 4d 2c 2c 2a  36 31 0d 0a 00 00 00 00  |2.0,M,,*61......|
00077150  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

[whiteduck]

In case @cgrenier you wish to check the fingerprints of two files (a large and a small mp4) that do recover OK from the same SD card here goes... I wonder if some of the .mov files are sometimes missing the start or end of the file... https://share.icloud.com/photos/00dPt39 ... pf4GRNXgxg - if the link expires let me know

[whiteduck]

Doing a hexdump on a dd of the partition

mdat is listed but I couldn't get this to be recognised as a signature in photorec:

Code: Select all

dat 0 0x00e39bd86d646174
mp4 0 0x000000206674797061766331

Then doing an egrep on the disk image (dd) - for avc, mdat etc.

Code: Select all

0f740000  00 00 00 20 66 74 79 70  61 76 63 31 00 00 00 00  |... ftypavc1....|
0f740010  61 76 63 31 69 73 6f 6d  00 00 00 00 00 00 00 00  |avc1isom........|
0f740020  0d 1b 49 da 6d 64 61 74  00 00 00 02 09 10 00 00  |..I.mdat........|
10140000  00 00 00 20 66 74 79 70  61 76 63 31 00 00 00 00  |... ftypavc1....|
10140010  61 76 63 31 69 73 6f 6d  00 00 00 00 00 00 00 00  |avc1isom........|
10140020  00 e3 8c da 6d 64 61 74  00 00 00 02 09 10 00 00  |....mdat........|
1dd40000  00 00 00 20 66 74 79 70  61 76 63 31 00 00 00 00  |... ftypavc1....|
1dd40010  61 76 63 31 69 73 6f 6d  00 00 00 00 00 00 00 00  |avc1isom........|
1dd40020  0d 1d 4e 38 6d 64 61 74  00 00 00 02 09 10 00 00  |..N8mdat........|
1e740000  00 00 00 20 66 74 79 70  61 76 63 31 00 00 00 00  |... ftypavc1....|
1e740010  61 76 63 31 69 73 6f 6d  00 00 00 00 00 00 00 00  |avc1isom........|
1e740020  00 e3 9b d8 6d 64 61 74  00 00 00 02 09 10 00 00  |....mdat........|
2c340000  00 00 00 20 66 74 79 70  61 76 63 31 00 00 00 00  |... ftypavc1....|
2c340010  61 76 63 31 69 73 6f 6d  00 00 00 00 00 00 00 00  |avc1isom........|
2c340020  0c d5 81 da 6d 64 61 74  00 00 00 02 09 10 00 00  |....mdat........|
2cd40000  00 00 00 20 66 74 79 70  61 76 63 31 00 00 00 00  |... ftypavc1....|
2cd40010  61 76 63 31 69 73 6f 6d  00 00 00 00 00 00 00 00  |avc1isom........|
2cd40020  00 dc aa 7a 6d 64 61 74  00 00 00 02 09 10 00 00  |...zmdat........|
3a940000  00 00 00 20 66 74 79 70  61 76 63 31 00 00 00 00  |... ftypavc1....|
3a940010  61 76 63 31 69 73 6f 6d  00 00 00 00 00 00 00 00  |avc1isom........|
3a940020  0c d9 ca d8 6d 64 61 74  00 00 00 02 09 10 00 00  |....mdat........|
3b340000  00 00 00 20 66 74 79 70  61 76 63 31 00 00 00 00  |... ftypavc1....|
3b340010  61 76 63 31 69 73 6f 6d  00 00 00 00 00 00 00 00  |avc1isom........|
3b340020  00 dd a9 b8 6d 64 61 74  00 00 00 02 09 10 00 00  |....mdat........|

[whiteduck]

Sorry for the spam - last post for tonight I promise - I looked for MP4 tags in a partial hexdump of the volume - I wonder if photorec doesn't recognise the format Nextbase use:

Code: Select all

% egrep "mdat|ftyp|meta|stts|stsc|stsz|mfra|moof|moov|pdin"  image.hex
0b557510  e9 00 00 00 1c 73 74 73  63 00 00 00 00 00 00 00  |.....stsc.......|
0b557530  34 73 74 73 7a 00 00 00  00 00 00 00 00 00 00 07  |4stsz...........|
0b55aff0  00 00 04 00 00 00 02 00  00 00 18 73 74 74 73 00  |...........stts.|
0b55b010  00 00 1c 73 74 73 63 00  00 00 00 00 00 00 01 00  |...stsc.........|
0b55c0a0  47 65 6e 65 76 61 00 00  00 18 73 74 74 73 00 00  |Geneva....stts..|
0b55c0c0  00 1c 73 74 73 63 00 00  00 00 00 00 00 01 00 00  |..stsc..........|
0bb3fff0  00 00 00 00 3c 00 00 00  00 00 00 08 6d 65 74 61  |....<.......meta|
0f5d2b40  00 00 18 73 74 74 73 00  00 00 00 00 00 00 01 00  |...stts.........|
0f5d2b50  00 07 08 00 00 03 e9 00  00 00 1c 73 74 73 63 00  |...........stsc.|
0f5d2b70  00 00 01 00 00 1c 34 73  74 73 7a 00 00 00 00 00  |......4stsz.....|
0f5d6640  18 73 74 74 73 00 00 00  00 00 00 00 01 00 0e a8  |.stts...........|
0f5d6650  00 00 00 00 01 00 00 00  1c 73 74 73 63 00 00 00  |.........stsc...|
0f5d6670  01 00 00 00 14 73 74 73  7a 00 00 00 00 00 00 00  |.....stsz.......|
0f5d76f0  73 74 74 73 00 00 00 00  00 00 00 01 00 00 02 58  |stts...........X|
0f5d7700  00 00 00 64 00 00 00 1c  73 74 73 63 00 00 00 00  |...d....stsc....|
0f5d7720  00 00 09 74 73 74 73 7a  00 00 00 00 00 00 00 00  |...tstsz........|
0f73fff0  00 00 00 00 3c 00 00 00  00 00 00 08 6d 65 74 61  |....<.......meta|
0f740000  00 00 00 20 66 74 79 70  61 76 63 31 00 00 00 00  |... ftypavc1....|
0f740020  0d 1b 49 da 6d 64 61 74  00 00 00 02 09 10 00 00  |..I.mdat........|
10140000  00 00 00 20 66 74 79 70  61 76 63 31 00 00 00 00  |... ftypavc1....|
10140020  00 e3 8c da 6d 64 61 74  00 00 00 02 09 10 00 00  |....mdat........|

[whiteduck]

An update for anyone who is following this thread. I found the website fix.video and so far 4/4 files I've uploaded (170MB-220MB) have been fixable - I had to adjust the fps to 30fps else the video was not the correct length and perhaps some may have some errors but on this small selection it's working...

Current profile: 1/1 Profile Name: ambarella - generic - 2560x1440

So this would suggest the files are not entirely corrupted but clearly I need to try more... I wonder if ffmpeg or photorec could work?

Video Information
Duration:1 min 14 s (this one appears to be longer than it should by 14s)
Container:QuickTime / MOV
Video Size:2560x1440
Codec Video:h264 (Main)
Bitrate Video:22.2 Mb/s
FrameRate:30.000 FPS
Aspect Ratio:16:9
Audio Format:null (correct because these videos don't have sound)
Audio Codec:null
Audio Bitrate:0.0 Kb/s

Best regards
Ian