Compact Flash damaged - .MXF files corrupted

Using TestDisk to repair the filesystem
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
albarts
Posts: 8
Joined: 28 Sep 2013, 11:55

Compact Flash damaged - .MXF files corrupted

#1 Post by albarts »

Thanks for this awesome forum, it is the first time I write here, I apologize in advance if do something wrong.

I have a damaged 64gb Compact Flash with important videos (MXF), with software tools (diskdrill in mac) we were able to recover damged files (parts of videos, pixelated, missing, etc...). The problem is that I don't know the format it has, I assumed FAT32, no idea if it was formatted in the camera or in a mac.

I have done an image with ddrescue (no problem reading it). Now with the image and TestDisk:

1. As Intel and Analizying it:
Partition sector doesn't have the endmark 0xAA55
2. With Vista enabled, Deep Search
No partition found or selected for recovery
3. Running as Non Partitioned media, Advance, Type = FAT32, Boot:
Disk copy02.img - 64 GB / 59 GiB - CHS 7785 255 63
Partition Start End Size in sectors
P FAT32 0 0 1 7784 144 40 125059072

Boot sector
Bad

Backup boot sector
Bad

First sectors (Boot code and partition information) are not identical.
Second sectors (cluster information) are not identical.
Third sectors (Second part of boot code) are not identical.

A valid FAT Boot sector must be present in order to access
any data; even if the partition is not bootable.
4. Rebuild BS:
Here I found some directories, but not sure what to do, because if I copy them, checking them they are as damaged, videos (MXF) are not completed, some are pixelated. And also I found some .mov videos that I guess were recorded before the mines.


I am not sure what next step to do, any advice would be welcome. I have been reading similar cases and I tried to follow same steps, but perhaps I am doing something wrong.

Thanks
Albarts
Last edited by albarts on 07 Oct 2013, 22:47, edited 1 time in total.
Top
albarts
Posts: 8
Joined: 28 Sep 2013, 11:55

Re: 64gb Compact Flash damaged

#2 Post by albarts »

Hello again, anyone can help me ?

I am not sure what else to do.

As far as I know:
- Checking the MBR is all fucked.
- ddrescue doesn't find any error in the drive, so I guess that means that the card is not physically damaged and all the sectors are easy to read.
- When I mount an image, it is raw, no format.
- Using photorec looking for mxf, it recovers lots of files, but when I play them, they are damaged (pixelated or choppy playback)

Any advice/help ?

Thanks,
Albarts
Top
User avatar
cgrenier
Site Admin
Posts: 5436
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:
Contact cgrenier

Re: 64gb Compact Flash damaged

#3 Post by cgrenier »

There was probably a single FAT32 partition on the flash card. If you have create a image of the disk, and not of the partition, the partition table type must be PC/Intel, not None.
Please post the content of testdisk.log after trying to rebuildbs the boot sector.
Top
albarts
Posts: 8
Joined: 28 Sep 2013, 11:55

#4 Post by albarts »

Many thanks cgrenier!

Using locale 'en_GB.UTF-8'.


Sat Oct 5 11:28:58 2013
Command line: TestDisk copy02.img /log

TestDisk 6.13, Data Recovery Utility, November 2011
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Linux, kernel 3.2.0-52-generic (#78-Ubuntu SMP Fri Jul 26 16:21:44 UTC 2013) x86_64
Compiler: GCC 4.6
Compilation date: 2012-02-05T07:15:52
ext2fs lib: 1.42, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: none
User is not root!
Hard disk list
Disk copy02.img - 64 GB / 59 GiB - CHS 7785 255 63, sector size=512


TestDisk exited normally.
Using locale 'en_GB.UTF-8'.


Sat Oct 5 11:29:08 2013
Command line: TestDisk copy02.img /log

TestDisk 6.13, Data Recovery Utility, November 2011
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Linux, kernel 3.2.0-52-generic (#78-Ubuntu SMP Fri Jul 26 16:21:44 UTC 2013) x86_64
Compiler: GCC 4.6
Compilation date: 2012-02-05T07:15:52
ext2fs lib: 1.42, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: none
Hard disk list
Disk copy02.img - 64 GB / 59 GiB - CHS 7785 255 63, sector size=512

Partition table type (auto): Intel
Disk copy02.img - 64 GB / 59 GiB
Partition table type: Intel

Analyse Disk copy02.img - 64 GB / 59 GiB - CHS 7785 255 63
Current partition structure:

Partition sector doesn't have the endmark 0xAA55
Ask the user for vista mode
Allow partial last cylinder : Yes
search_vista_part: 1

search_part()
Disk copy02.img - 64 GB / 59 GiB - CHS 7785 255 63

interface_write()

No partition found or selected for recovery
That is why with PC/Intel I can't rebuild the sector, I don't have that choice. I am doing now again with None, and recovering files, but I have done that before, I guess it will be the same...
Top
albarts
Posts: 8
Joined: 28 Sep 2013, 11:55

#5 Post by albarts »

And this is with the partition type None:
Using locale 'en_GB.UTF-8'.


Sat Oct 5 17:24:29 2013
Command line: TestDisk copy02.img /log

TestDisk 6.13, Data Recovery Utility, November 2011
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Linux, kernel 3.2.0-52-generic (#78-Ubuntu SMP Fri Jul 26 16:21:44 UTC 2013) x86_64
Compiler: GCC 4.6
Compilation date: 2012-02-05T07:15:52
ext2fs lib: 1.42, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: none
User is not root!
Hard disk list
Disk copy02.img - 64 GB / 59 GiB - CHS 7785 255 63, sector size=512


TestDisk exited normally.
Using locale 'en_GB.UTF-8'.


Sat Oct 5 17:24:31 2013
Command line: TestDisk copy02.img /log

TestDisk 6.13, Data Recovery Utility, November 2011
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Linux, kernel 3.2.0-52-generic (#78-Ubuntu SMP Fri Jul 26 16:21:44 UTC 2013) x86_64
Compiler: GCC 4.6
Compilation date: 2012-02-05T07:15:52
ext2fs lib: 1.42, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: none
Hard disk list
Disk copy02.img - 64 GB / 59 GiB - CHS 7785 255 63, sector size=512

Partition table type (auto): Intel
Disk copy02.img - 64 GB / 59 GiB
Partition table type: None

Analyse Disk copy02.img - 64 GB / 59 GiB - CHS 7785 255 63
Current partition structure:
P Unknown 0 0 1 7784 144 40 125059072

search_part()
Disk copy02.img - 64 GB / 59 GiB - CHS 7785 255 63
check_FAT: Bad jump in FAT partition
HFS 4563 30 53 106975 110 10 1645253778 [¢ÎYînjȆ`ë¿@pø·ùðTê5|]
HFS, 842 GB / 784 GiB
This partition ends after the disk limits.
Disk copy02.img - 64 GB / 59 GiB - CHS 7785 255 63
Check the harddisk size: HD jumpers settings, BIOS detection...
The harddisk (64 GB / 59 GiB) seems too small! (< 879 GB / 819 GiB)
The following partition can't be recovered:
HFS 4563 30 53 106975 110 10 1645253778 [¢ÎYînjȆ`ë¿@pø·ùðTê5|]
HFS, 842 GB / 784 GiB

interface_write()

No partition found or selected for recovery

search_part()
Disk copy02.img - 64 GB / 59 GiB - CHS 7785 255 63
check_FAT: Bad jump in FAT partition
HFS 4563 30 53 106975 110 10 1645253778 [¢ÎYînjȆ`ë¿@pø·ùðTê5|]
HFS, 842 GB / 784 GiB
This partition ends after the disk limits.
Disk copy02.img - 64 GB / 59 GiB - CHS 7785 255 63
Check the harddisk size: HD jumpers settings, BIOS detection...
The harddisk (64 GB / 59 GiB) seems too small! (< 879 GB / 819 GiB)
The following partition can't be recovered:
HFS 4563 30 53 106975 110 10 1645253778 [¢ÎYînjȆ`ë¿@pø·ùðTê5|]
HFS, 842 GB / 784 GiB

interface_write()

No partition found or selected for recovery

Interface Advanced
P Unknown 0 0 1 7784 144 40 125059072
Change partition type:
P FAT32 0 0 1 7784 144 40 125059072

fat32_boot_sector
P FAT32 0 0 1 7784 144 40 125059072
Boot sector
Bad

Backup boot sector
Bad

First sectors (Boot code and partition information) are not identical.
Second sectors (cluster information) are not identical.
Third sectors (Second part of boot code) are not identical.

A valid FAT Boot sector must be present in order to access
any data; even if the partition is not bootable.
FAT32 at 35018(2/45/54), nbr=142
FAT32 at 50277(3/33/4), nbr=249
FAT32 at 75984(4/186/7), nbr=1
FAT32 at 75985(4/186/8), nbr=1
FAT32 at 75986(4/186/9), nbr=1
.
.
.
.
FAT32 at 108767(6/196/30), nbr=1
FAT32 at 108768(6/196/31), nbr=1
FAT32 at 108769(6/196/32), nbr=1
FAT32 at 108770(6/196/33), nbr=1
FAT32 at 108771(6/196/34), nbr=1
FAT32 at 108772(6/196/35), nbr=1
FAT32 at 108773(6/196/36), nbr=1
FAT32 at 875007(54/119/1), nbr=1
FAT differs, FAT sectors=0-16/15259
sector 65664, cluster 4
sector 65728, cluster 5
sector 65792, cluster 6
sector 65856, cluster 7
sector 65920, cluster 8
sector 65984, cluster 9
sector 66048, cluster 10
sector 66112, cluster 11
sector 66176, cluster 12
sector 66240, cluster 13
find_sectors_per_cluster_aux
Selected: sectors_per_cluster=64, cluster 2 at sector 65536, nbr=9
FAT : 32
next_free 61456, free_count 72871
New / Current boot sector
FAT32
sector_size 512 19254
cluster_size 32 2
reserved 32 520
fats 2 254
dir_entries 0 32312
sectors 0 30605
media F8 5A
fat_length 0 2307
secs_track 63 31188
heads 255 2940
hidden 0 2591775319
total_sect 125059072 612856469
fat32_length 32752 2482108100
flags 0000 6437
version 0.0 74.68
root_cluster 7 3171206
info_sector 1 1733
backup_boot 6 12359
free_count 18446744073709551615 18446744073692635134
next_free 18446744073709551615 18446744072894530543
Extrapolated boot sector and current boot sector are different.

FAT: cluster=7(0x7), pos=65696
FAT: cluster=8(0x8), pos=65728
FAT: cluster=9(0x9), pos=65760
FAT: cluster=10(0xa), pos=65792
FAT: cluster=11(0xb), pos=65824
FAT: cluster=12(0xc), pos=65856
FAT: cluster=13(0xd), pos=65888
FAT: cluster=14(0xe), pos=65920
FAT: cluster=15(0xf), pos=65952
FAT: cluster=16(0x10), pos=65984
FAT: cluster=17(0x11), pos=66016
FAT: cluster=18(0x12), pos=66048
FAT: cluster=19(0x13), pos=66080
FAT: cluster=20(0x14), pos=66112
FAT: cluster=21(0x15), pos=66144
FAT: cluster=22(0x16), pos=66176
FAT: cluster=23(0x17), pos=66208
FAT: cluster=24(0x18), pos=66240
FAT: cluster=25(0x19), pos=66272
FAT: cluster=26(0x1a), pos=66304
FAT: cluster=27(0x1b), pos=66336
FAT: cluster=28(0x1c), pos=66368
FAT: cluster=29(0x1d), pos=66400
FAT: cluster=30(0x1e), pos=66432
FAT: cluster=31(0x1f), pos=66464
FAT: cluster=32(0x20), pos=66496
FAT: cluster=33(0x21), pos=66528
FAT: cluster=34(0x22), pos=66560
FAT: cluster=35(0x23), pos=66592
FAT: cluster=36(0x24), pos=66624
Directory /
78 drwxr-xr-x 0 0 0 22-Sep-2013 02:37 AA0039
X 994018 -rwxr-xr-x 0 0 2573824 22-Sep-2013 02:37 _NDEX.BAK
X 994098 -rwxr-xr-x 0 0 2573824 22-Sep-2013 02:37 _NDEX.MIF
X 994098 -rwxr-xr-x 0 0 2573824 22-Sep-2013 02:37 _NDEX.BAK
X1006843 -rwxr-xr-x 0 0 2573824 22-Sep-2013 02:38 _NDEX.MIF
X1006843 -rwxr-xr-x 0 0 2573824 22-Sep-2013 02:38 _NDEX.BAK
X1006922 -rwxr-xr-x 0 0 2573824 22-Sep-2013 02:39 _NDEX.MIF
79 drwxr-xr-x 0 0 0 22-Sep-2013 02:39 AA0040
X1006922 -rwxr-xr-x 0 0 2573824 22-Sep-2013 02:39 _NDEX.BAK
X1007002 -rwxr-xr-x 0 0 2573824 22-Sep-2013 02:39 _NDEX.MIF
X1007002 -rwxr-xr-x 0 0 2573824 22-Sep-2013 02:39 _NDEX.BAK
X1024659 -rwxr-xr-x 0 0 2573824 22-Sep-2013 02:41 _NDEX.MIF
X1024659 -rwxr-xr-x 0 0 2573824 22-Sep-2013 02:41 _NDEX.BAK
X1024738 -rwxr-xr-x 0 0 2573824 22-Sep-2013 02:42 _NDEX.MIF
80 drwxr-xr-x 0 0 0 22-Sep-2013 02:42 AA0041
X1024738 -rwxr-xr-x 0 0 2573824 22-Sep-2013 02:42 _NDEX.BAK
X1024818 -rwxr-xr-x 0 0 2573824 22-Sep-2013 02:42 _NDEX.MIF
X1024818 -rwxr-xr-x 0 0 2573824 22-Sep-2013 02:42 _NDEX.BAK
X1038779 -rwxr-xr-x 0 0 2573824 22-Sep-2013 02:43 _NDEX.MIF
X1038779 -rwxr-xr-x 0 0 2573824 22-Sep-2013 02:43 _NDEX.BAK
X1038858 -rwxr-xr-x 0 0 2573824 22-Sep-2013 02:50 _NDEX.MIF
81 drwxr-xr-x 0 0 0 22-Sep-2013 02:50 AA0042
X1038858 -rwxr-xr-x 0 0 2573824 22-Sep-2013 02:50 _NDEX.BAK
X1038938 -rwxr-xr-x 0 0 2573824 22-Sep-2013 02:50 _NDEX.MIF
X1038938 -rwxr-xr-x 0 0 2573824 22-Sep-2013 02:50 _NDEX.BAK
X1058635 -rwxr-xr-x 0 0 2573824 22-Sep-2013 02:52 _NDEX.MIF
X1058635 -rwxr-xr-x 0 0 2573824 22-Sep-2013 02:52 _NDEX.BAK
X1058714 -rwxr-xr-x 0 0 2573824 22-Sep-2013 02:56 _NDEX.MIF
82 drwxr-xr-x 0 0 0 22-Sep-2013 02:56 AA0043
X1058714 -rwxr-xr-x 0 0 2573824 22-Sep-2013 02:56 _NDEX.BAK
X1058794 -rwxr-xr-x 0 0 2573824 22-Sep-2013 02:56 _NDEX.MIF
X1058794 -rwxr-xr-x 0 0 2573824 22-Sep-2013 02:56 _NDEX.BAK
X1078427 -rwxr-xr-x 0 0 2573824 22-Sep-2013 02:57 _NDEX.MIF
X1078427 -rwxr-xr-x 0 0 2573824 22-Sep-2013 02:57 _NDEX.BAK
X1078786 -rwxr-xr-x 0 0 2573824 22-Sep-2013 03:12 _NDEX.MIF
83 drwxr-xr-x 0 0 0 22-Sep-2013 03:12 AA0044
X1078786 -rwxr-xr-x 0 0 2573824 22-Sep-2013 03:12 _NDEX.BAK
X1078866 -rwxr-xr-x 0 0 2573824 22-Sep-2013 03:12 _NDEX.MIF
X1078866 -rwxr-xr-x 0 0 2573824 22-Sep-2013 03:12 _NDEX.BAK
X1091171 -rwxr-xr-x 0 0 2573824 22-Sep-2013 03:13 _NDEX.MIF
X1091171 -rwxr-xr-x 0 0 2573824 22-Sep-2013 03:13 _NDEX.BAK
X1091250 -rwxr-xr-x 0 0 2573824 22-Sep-2013 03:20 _NDEX.MIF
84 drwxr-xr-x 0 0 0 22-Sep-2013 03:20 AA0045
X1091250 -rwxr-xr-x 0 0 2573824 22-Sep-2013 03:20 _NDEX.BAK
X1091330 -rwxr-xr-x 0 0 2573824 22-Sep-2013 03:20 _NDEX.MIF
X1091330 -rwxr-xr-x 0 0 2573824 22-Sep-2013 03:20 _NDEX.BAK
X1098091 -rwxr-xr-x 0 0 2573824 22-Sep-2013 03:21 _NDEX.MIF
X1098091 -rwxr-xr-x 0 0 2573824 22-Sep-2013 03:21 _NDEX.BAK
X1098170 -rwxr-xr-x 0 0 2573824 22-Sep-2013 03:22 _NDEX.MIF
85 drwxr-xr-x 0 0 0 22-Sep-2013 03:22 AA0046
X1098170 -rwxr-xr-x 0 0 2573824 22-Sep-2013 03:22 _NDEX.BAK
X1098250 -rwxr-xr-x 0 0 2573824 22-Sep-2013 03:22 _NDEX.MIF
X1098250 -rwxr-xr-x 0 0 2573824 22-Sep-2013 03:22 _NDEX.BAK
X1130123 -rwxr-xr-x 0 0 2573824 22-Sep-2013 03:24 _NDEX.MIF
X1130123 -rwxr-xr-x 0 0 2573824 22-Sep-2013 03:24 _NDEX.BAK
X1130202 -rwxr-xr-x 0 0 2573824 22-Sep-2013 03:27 _NDEX.MIF
86 drwxr-xr-x 0 0 0 22-Sep-2013 03:27 AA0047
X1130202 -rwxr-xr-x 0 0 2573824 22-Sep-2013 03:27 _NDEX.BAK
X1130282 -rwxr-xr-x 0 0 2573824 22-Sep-2013 03:27 _NDEX.MIF
X1130282 -rwxr-xr-x 0 0 2573824 22-Sep-2013 03:27 _NDEX.BAK
X1165155 -rwxr-xr-x 0 0 2573824 22-Sep-2013 03:30 _NDEX.MIF
X1165155 -rwxr-xr-x 0 0 2573824 22-Sep-2013 03:30 _NDEX.BAK
X1165234 -rwxr-xr-x 0 0 2573824 22-Sep-2013 03:31 _NDEX.MIF
87 drwxr-xr-x 0 0 0 22-Sep-2013 03:31 AA0048
X1165234 -rwxr-xr-x 0 0 2573824 22-Sep-2013 03:31 _NDEX.BAK
X1165314 -rwxr-xr-x 0 0 2573824 22-Sep-2013 03:31 _NDEX.MIF
X1165314 -rwxr-xr-x 0 0 2573824 22-Sep-2013 03:31 _NDEX.BAK
X1209491 -rwxr-xr-x 0 0 2573824 22-Sep-2013 03:35 _NDEX.MIF
X1209491 -rwxr-xr-x 0 0 2573824 22-Sep-2013 03:35 _NDEX.BAK
X1209570 -rwxr-xr-x 0 0 2573824 22-Sep-2013 03:37 _NDEX.MIF
88 drwxr-xr-x 0 0 0 22-Sep-2013 03:37 AA0049
X1209570 -rwxr-xr-x 0 0 2573824 22-Sep-2013 03:37 _NDEX.BAK
X1209650 -rwxr-xr-x 0 0 2573824 22-Sep-2013 03:37 _NDEX.MIF
X1209650 -rwxr-xr-x 0 0 2573824 22-Sep-2013 03:37 _NDEX.BAK
X1241139 -rwxr-xr-x 0 0 2573824 22-Sep-2013 03:39 _NDEX.MIF
X1241139 -rwxr-xr-x 0 0 2573824 22-Sep-2013 03:39 _NDEX.BAK
X1241218 -rwxr-xr-x 0 0 2573824 22-Sep-2013 03:40 _NDEX.MIF
89 drwxr-xr-x 0 0 0 22-Sep-2013 03:40 AA0050
X1241218 -rwxr-xr-x 0 0 2573824 22-Sep-2013 03:40 _NDEX.BAK
X1241298 -rwxr-xr-x 0 0 2573824 22-Sep-2013 03:40 _NDEX.MIF
X1241298 -rwxr-xr-x 0 0 2573824 22-Sep-2013 03:40 _NDEX.BAK
X1280251 -rwxr-xr-x 0 0 2573824 22-Sep-2013 03:44 _NDEX.MIF
X1280251 -rwxr-xr-x 0 0 2573824 22-Sep-2013 03:44 _NDEX.BAK
X1280330 -rwxr-xr-x 0 0 2573824 22-Sep-2013 03:45 _NDEX.MIF
90 drwxr-xr-x 0 0 0 22-Sep-2013 03:45 AA0051
X1280330 -rwxr-xr-x 0 0 2573824 22-Sep-2013 03:45 _NDEX.BAK
X1280410 -rwxr-xr-x 0 0 2573824 22-Sep-2013 03:45 _NDEX.MIF
X1280410 -rwxr-xr-x 0 0 2573824 22-Sep-2013 03:45 _NDEX.BAK
X1281939 -rwxr-xr-x 0 0 2573824 22-Sep-2013 03:45 _NDEX.MIF
X1281939 -rwxr-xr-x 0 0 2573824 22-Sep-2013 03:45 _NDEX.BAK
X1282018 -rwxr-xr-x 0 0 2573824 22-Sep-2013 03:47 _NDEX.MIF
91 drwxr-xr-x 0 0 0 22-Sep-2013 03:47 AA0052
X1282018 -rwxr-xr-x 0 0 2573824 22-Sep-2013 03:47 _NDEX.BAK
X1282098 -rwxr-xr-x 0 0 2573824 22-Sep-2013 03:47 _NDEX.MIF
X1282098 -rwxr-xr-x 0 0 2573824 22-Sep-2013 03:47 _NDEX.BAK
X1332907 -rwxr-xr-x 0 0 2573824 22-Sep-2013 03:51 _NDEX.MIF
X1332907 -rwxr-xr-x 0 0 2573824 22-Sep-2013 03:51 _NDEX.BAK
X1332986 -rwxr-xr-x 0 0 2573824 22-Sep-2013 03:52 _NDEX.MIF
92 drwxr-xr-x 0 0 0 22-Sep-2013 03:52 AA0053
X1332986 -rwxr-xr-x 0 0 2573824 22-Sep-2013 03:52 _NDEX.BAK
X1333066 -rwxr-xr-x 0 0 2573824 22-Sep-2013 03:52 _NDEX.MIF
X1333066 -rwxr-xr-x 0 0 2573824 22-Sep-2013 03:52 _NDEX.BAK
1364811 -rwxr-xr-x 0 0 2573824 22-Sep-2013 03:54 INDEX.MIF
FAT: cluster=7(0x7), pos=65696
FAT: cluster=8(0x8), pos=65728
FAT: cluster=9(0x9), pos=65760
FAT: cluster=10(0xa), pos=65792
FAT: cluster=11(0xb), pos=65824
.
.
.
.
FAT: cluster=32(0x20), pos=66496
FAT: cluster=33(0x21), pos=66528
FAT: cluster=34(0x22), pos=66560
FAT: cluster=35(0x23), pos=66592
FAT: cluster=36(0x24), pos=66624
Directory /
78 drwxr-xr-x 0 0 0 22-Sep-2013 02:37 AA0039
79 drwxr-xr-x 0 0 0 22-Sep-2013 02:39 AA0040
80 drwxr-xr-x 0 0 0 22-Sep-2013 02:42 AA0041
81 drwxr-xr-x 0 0 0 22-Sep-2013 02:50 AA0042
82 drwxr-xr-x 0 0 0 22-Sep-2013 02:56 AA0043
83 drwxr-xr-x 0 0 0 22-Sep-2013 03:12 AA0044
84 drwxr-xr-x 0 0 0 22-Sep-2013 03:20 AA0045
85 drwxr-xr-x 0 0 0 22-Sep-2013 03:22 AA0046
86 drwxr-xr-x 0 0 0 22-Sep-2013 03:27 AA0047
87 drwxr-xr-x 0 0 0 22-Sep-2013 03:31 AA0048
88 drwxr-xr-x 0 0 0 22-Sep-2013 03:37 AA0049
89 drwxr-xr-x 0 0 0 22-Sep-2013 03:40 AA0050
90 drwxr-xr-x 0 0 0 22-Sep-2013 03:45 AA0051
91 drwxr-xr-x 0 0 0 22-Sep-2013 03:47 AA0052
92 drwxr-xr-x 0 0 0 22-Sep-2013 03:52 AA0053
1364811 -rwxr-xr-x 0 0 2573824 22-Sep-2013 03:54 INDEX.MIF
FAT: cluster=79(0x4f), pos=68000
FAT: cluster=78(0x4e), pos=67968
FAT: cluster=79(0x4f), pos=68000
FAT: cluster=80(0x50), pos=68032
FAT: cluster=81(0x51), pos=68064
FAT: cluster=82(0x52), pos=68096
FAT: cluster=83(0x53), pos=68128
FAT: cluster=84(0x54), pos=68160
FAT: cluster=85(0x55), pos=68192
FAT: cluster=86(0x56), pos=68224
FAT: cluster=87(0x57), pos=68256
FAT: cluster=88(0x58), pos=68288
FAT: cluster=89(0x59), pos=68320
FAT: cluster=90(0x5a), pos=68352
FAT: cluster=91(0x5b), pos=68384
FAT: cluster=92(0x5c), pos=68416
FAT: cluster=93(0x5d), pos=68448
FAT: cluster=94(0x5e), pos=68480
FAT: cluster=95(0x5f), pos=68512
FAT: cluster=96(0x60), pos=68544
FAT: cluster=97(0x61), pos=68576
FAT: cluster=98(0x62), pos=68608
FAT: cluster=99(0x63), pos=68640
FAT: cluster=100(0x64), pos=68672
FAT: cluster=101(0x65), pos=68704.
.
.
.

Sorry for the long message, the logs were quite large, I cut them, I hope they are useful, let me know if you have any clue! Thanks!
Top
albarts
Posts: 8
Joined: 28 Sep 2013, 11:55

Re: Compact Flash damaged - .MXF files corrupted

#6 Post by albarts »

In the card there are supposed to be around 90 .MXF videos, but I am recovering around 300-400 .MXF depending of the recovering options in photorec. The videos I get, are not playable or plays only for few seconds (although they are longer). I guess that makes sense, as in some way the files are corrupted and photorec detects like few .MXF for each original .MXF

I have to spend more time reading the Hex file of the image, checking MBR/VBR and looking for headers for .MXF or something like that...

Any idea/advice would be welcome, as you can see I am not sure of the next steps...

Thanks!!
Top
albarts
Posts: 8
Joined: 28 Sep 2013, 11:55

Re: Compact Flash damaged - .MXF files corrupted

#7 Post by albarts »

It seems no one has any idea??

I am trying to get another card with videos from the same camera with same format, and I will compare the structure, and try to figure out the problem with the MBR/VBR of the damged one....
Top
Lito
Posts: 83
Joined: 08 Sep 2012, 06:58

Re: Compact Flash damaged - .MXF files corrupted

#8 Post by Lito »

I would like to point out that you must run either TestDisk or PhotoRec
as Root or Administrator. Your log clearly states: User not root.

File formats recovered by PhotoRec:

http://www.cgsecurity.org/wiki/File_For ... y_PhotoRec

Looking at the list in the that page, your file format is not listed.
However, it might belong to another file family. That i do not know.

But you can add your own custom file format signatures, as explained in this page:

Add your own extension to PhotoRec:

http://www.cgsecurity.org/wiki/Add_your ... o_PhotoRec

It might be a good idea to clone your card, or create another image using a different card reader.

At one point in your search, you managed to list a lot of files.
Have tried to see what happens copying one of those .BAK files? Do they play correctly, or are they
also corrupted? Your list shows .BAK and .MIF files but not .MXF ones. Might be you can try one of those .MIF's as well.
You might have to rename the file to .MXF to make it play. Have you tried Videolan? It is a very versatile player.

If you hurry up you could get a copy of Paragon Software, Rescue Kit for Mac:

http://www.paragon-software.com/home/rk ... nload.html

It is a bootable CD. You can try to read your cloned card or might be your image from that environment.

Another bootable CD worth having is the MiniTool Partition Wizard (free version, 8.11):

http://www.partitionwizard.com/download.html

Again, with this you will be able to search through a clone of the card or extract a copy of any partition found.


Alternatively you can get the Active Live CD:

http://www.livecd.com/

Be aware that you might have to pay to get it fully functional.


If you can get access to a Windows machine, you can try mounting your image with OSF Mount:

http://www.osforensics.com/tools/mount-disk-images.html

Also for Windows machines, you could try Gizmo Drive 2-7-9 to mount your image files:

http://arainia.com/software/gizmo/index.html

This tool claims to mount images in a Mac. I do not own a Mac, so I cannot verify that.
It is advertised as free for 20 days. Enough time to rename your image file to .dmg i guess:

http://www.daemon-tools.cc/products/dtMacLite#features


Best of luck
Top
albarts
Posts: 8
Joined: 28 Sep 2013, 11:55

Re: Compact Flash damaged - .MXF files corrupted

#9 Post by albarts »

Hi Lito, many thanks for your help!

I tried several times, maybe that time I forgot to run as root, but the other times I did with the same results.
First day I did few images.

It seems that the only important files are the .MXF the are listed in photorec. I am able to play the files, but they are corrupted, maybe they play for 5 seconds (when they are 2 minutes long). Other MXF even doesn't open. They are as bits of bigger videos, because I was expecting to recover like 90 videos, but there are like 300 files, it is something like many of the MXF videos are splitted in several smaller ones.

I tried the live-cd gparted and clonezilla, nothing.

In windows I have tools to mount images, when I rebuild the MBR is the only way that the image is able to be mounted. In that case I can run CHKDSK and other tools, but I never recover more than damaged MXF files...

I will try some of the tools you mentioned, thanks!!
Top
albarts
Posts: 8
Joined: 28 Sep 2013, 11:55

Re: Compact Flash damaged - .MXF files corrupted

#10 Post by albarts »

Hi Lito,
I am using to mount image ImDiskm WinHex to read hex img. I tried as you say the MiniTool Partition Wizard but doesn't add anything new to what I have been doing.

Not sure what to do next, I think I should spend more time reading the hex to find the headers for the mxf and see if it makes some sense...

Many Thanks for your help!
Top
Locked

Return to “Filesystem repair”