VideoHelp Forum

Our website is made possible by displaying online advertisements to our visitors. Consider supporting us by disable your adblocker or try DVDFab DRM and remove iTunes movie & music protection! :)
+ Reply to Thread
Results 1 to 9 of 9
Thread
  1. I am recovering videos from a broken drive and I literally have nothing but raw data to work with. I can already recognize most containers by the first few bytes. AVI starts with RIFF, MP4 starts with ftypmp* and so on. What I need is a way to tell when a file ENDS. WMV does the work for me because the filesize is in the header and so does AVI but it doesn't matter because the obvious patterns at the end of an AVI gives it away.

    Mostly I need help identifying the correct length of MP4s.
    Quote Quote  
  2. Member
    Join Date
    Mar 2008
    Location
    United States
    Search Comp PM
    For mp4, the mdat + moov atoms is almost the complete file. Look at some good files in a hex editor and you'll see.
    I'm not aware of a place where the absolute number is stored. It might not be. Perhaps someone else will chime in
    Quote Quote  
  3. Member
    Join Date
    Aug 2013
    Location
    Central Germany
    Search PM
    To know how an MP4 container can be structured (similar to MOV and 3GPP), will require to study the "ISO Media" container specifications. Several chunks are mandatory, others are optional, but they all will have a hierarchy, they cannot be placed in any arbitrary order. Chunks usually have a size field, so you can skip forward this number of bytes to find the next chunk (maybe with some exception of "list" style chunks), until you reach the end of the file.
    Quote Quote  
  4. Originally Posted by davexnet View Post
    For mp4, the mdat + moov atoms is almost the complete file. Look at some good files in a hex editor and you'll see.
    Atoms? What are you talking about? "Almost the complete file" doesn't cut it either. I need to know exactly when it ends. It's obvious with AVI but not with MP4 and others.

    Ligh.de, many of these videos are hours long so I will not have time to inspect every individual chunk of every video to say the very least. I need a way to quickly tell where videos begin and end and so far it's only possible with AVI and WMV. Even this is taking forever where I can only recover a few in one hour.
    Quote Quote  
  5. Member
    Join Date
    Aug 2013
    Location
    Central Germany
    Search PM
    Try to understand the purpose of the following tool:

    http://atomicparsley.sourceforge.net/

    Then we talk again.
    Quote Quote  
  6. Originally Posted by Aludin View Post
    Originally Posted by davexnet View Post
    For mp4, the mdat + moov atoms is almost the complete file. Look at some good files in a hex editor and you'll see.
    Atoms? What are you talking about?
    The size of a file is in the directory entry for the file. Otherwise, for the MP4 container, you have to parse the atom tree to get the size. There is no overall file size entry in the MP4 headers that I know of. Each atom starts with a 4 byte size element (big endian) followed by the four character atom name and then data for that atom.
    Last edited by jagabo; 8th Sep 2018 at 11:01.
    Quote Quote  
  7. Member DB83's Avatar
    Join Date
    Jul 2007
    Location
    United Kingdom
    Search Comp PM
    Aludin,

    Have you not tried the standard file recovery tools such as Getdataback or ZAR (Zero Assumption Recovery) ? I have had success with both of these.
    Quote Quote  
  8. Ah, I get it now. MP4 is more 'raw' than others so info like size has to be inferred by putting the chunks together. The word atom confused me. Basically, I can overestimate the data I'm selecting with the hex editor and this program will have no problem knowing when it ends. This is doable. Thank you.
    At first I thought I would have to manually add up the data of every single chunk. Derp!

    jagabo, the MFT is lost, that's the problem. Directory indexes are still scattered on the drive but without knowing where on the disk each entry points to, I have no way to know which file is which.

    DB83, I have tried recovery tools though not the ones you mentioned. They are incredibly unreliable so I decided I had no choice but to do it manually. This drive is largely unfragmented yet most of what these programs autorecovered was pieces. Do you know of one which is more interactive? I'd like to see exactly the data it has selected and approve each one.
    Quote Quote  
  9. Member DB83's Avatar
    Join Date
    Jul 2007
    Location
    United Kingdom
    Search Comp PM
    ZAR will preview what it is going to recover. Since it scans the entire disk or partition (selectable) this process will take some time - many hours for a large partition.

    I believe the free version only scans and previews. You would have to purchase the program to do a full recovery or the files you select. But as I said I recovered and entire partition with the full program so more than happy with it.
    Quote Quote  



Similar Threads