cgsecurity.org

Hi all,
I have recently lost a big part of a movie file because the Mac's Image Capture app contains a terrible footgun: if a file is larger than 4 GB, it will only import the first 4 GB, truncating the file. Therefore I have the first 4 GB but I'd like to recover the rest (I estimate the original was around 10 GB). I tried running photorec on the card I have, but it only found a few other MOVs, the largest being ~250 MB. Is there a way to tell it I want to look for something very specific?

What is "something very specific"?

I mean, I have the first 4GB, so I'm interested in any data that might follow. I can imagine using the last kilobyte from that 4GB as a search pattern to find the place where the remaining part begins... I realize that assuming that such a big file wouldn't be broken to parts in the filesystem is somewhat naive, but as I empty the card before each new session, I assume the fragmentation to be nearly zero.

You can uncheck all other file formats.
Photorec creates a new file once it finds a new fingerprint.
This way your mov file has the chance of growing larger.

You can try to build a fingerprint based on your proposal and use it with Photorec.

Do you have an unmodified over 4GB mov file from your camera ?
Please run in a terminal "./fidentify -check /path/*.mov" ? (replace path by the full pathname). Is the filesize correct ?