I am recovering videos from a broken drive and I literally have nothing but raw data to work with. I can already recognize most containers by the first few bytes. AVI starts with RIFF, MP4 starts with ftypmp* and so on. What I need is a way to tell when a file ENDS. WMV does the work for me because the filesize is in the header and so does AVI but it doesn't matter because the obvious patterns at the end of an AVI gives it away.
Mostly I need help identifying the correct length of MP4s.
Our website is made possible by displaying online advertisements to our visitors. Consider supporting us by disable your adblocker or try DVDFab DRM and remove iTunes movie & music protection! :)
+ Reply to Thread
Results 1 to 9 of 9
For mp4, the mdat + moov atoms is almost the complete file. Look at some good files in a hex editor and you'll see.
I'm not aware of a place where the absolute number is stored. It might not be. Perhaps someone else will chime in
To know how an MP4 container can be structured (similar to MOV and 3GPP), will require to study the "ISO Media" container specifications. Several chunks are mandatory, others are optional, but they all will have a hierarchy, they cannot be placed in any arbitrary order. Chunks usually have a size field, so you can skip forward this number of bytes to find the next chunk (maybe with some exception of "list" style chunks), until you reach the end of the file.
Ligh.de, many of these videos are hours long so I will not have time to inspect every individual chunk of every video to say the very least. I need a way to quickly tell where videos begin and end and so far it's only possible with AVI and WMV. Even this is taking forever where I can only recover a few in one hour.
Last edited by jagabo; 8th Sep 2018 at 11:01.
Have you not tried the standard file recovery tools such as Getdataback or ZAR (Zero Assumption Recovery) ? I have had success with both of these.
Ah, I get it now. MP4 is more 'raw' than others so info like size has to be inferred by putting the chunks together. The word atom confused me. Basically, I can overestimate the data I'm selecting with the hex editor and this program will have no problem knowing when it ends. This is doable. Thank you.
At first I thought I would have to manually add up the data of every single chunk. Derp!
jagabo, the MFT is lost, that's the problem. Directory indexes are still scattered on the drive but without knowing where on the disk each entry points to, I have no way to know which file is which.
DB83, I have tried recovery tools though not the ones you mentioned. They are incredibly unreliable so I decided I had no choice but to do it manually. This drive is largely unfragmented yet most of what these programs autorecovered was pieces. Do you know of one which is more interactive? I'd like to see exactly the data it has selected and approve each one.
ZAR will preview what it is going to recover. Since it scans the entire disk or partition (selectable) this process will take some time - many hours for a large partition.
I believe the free version only scans and previews. You would have to purchase the program to do a full recovery or the files you select. But as I said I recovered and entire partition with the full program so more than happy with it.