Sunday, February 28, 2016

Incomplete, or unfinalized GoPro Videos

The GoPro camera is very popular for activities that involve action.  At times these can go wrong and the camera can be thrown off, and sometimes stop recording.

The latest version of GoPro recovery (V1.25) can recover these partial files for Hero 3 camera.

When a camera is stopped from recording video data is normally left on the memory chip in an unplayable format.  It is this data that the GoPro recovery software will find and reconstruct into a playable video file.  GoPro recovery software goes much further than most packages as it will demultiplex the low and high resolution video and audio streams.  Thus a new file might be created out of maybe 100 separate fragments.

How much data will be recovered.  This is a slightly harder question.  When the camera records, obviously at first the video is saved in memory, and then written to the memory chip.  The unknown question is how quickly is data written to the memory chip, ie how much data up to the point of failure will be saved.  The answer is probably up to the final few seconds.

On some recent examples recovered using GoPro Recovery, the saved data seems to have stopped between 1 and 3 seconds before the critical event.  On one occasion this was made worse beacue the police, thinking nothing further could be recovered, told the owner to use the memory chip again.  On this occasion, the saved data was set by the file system, which is almost certainly updated after the data has been written to the memory chip.  ie there would have been more video data saved in unallocated memory which was then overwritten.

The new version of V1.25 works for just Hero 3 cameras, it has a very good reponse to low res videos, but can be slightly mixed with high res video.  This problem will be resolved very soon, and support for Hero 4 cameras will be added next

Monday, February 1, 2016

Digital signatures and SHA256

A very important point for anyone selling software is to make sure that the demo downloads and works.  A critical point of the download is that it is not recognised as a virus, or malicious software.  Hence, for the past several years, all my software has been digitally signed.

The signing was with a SHA-1 signature, and a recognised certificate.  Recently, (Jan 2016) this started give nasty warning messages on downloads.  What has happened is that SHA-1 is no longer considered safe, and so from 2016, web browsers etc have started to look for SHA-256 signatures.

The solution was to contact GlobalSign who provide my certificate,  and they very quickly supplied one with a SHA-256 code.

The next stage was updating my batch files to add the signature.  This was a matter of changing the .PFX name and the password, and all almost worked.  It worked, but the signature was still showing as SHA-1.  Curiously, the code signed within InstallShield 2015 was showing SHA-256.  This did mean my new certificate was correct.  It turned that my signing routine was along the lines

c:\signtool  sign  /f 1234.pfx   etc

By default the sign routine adds a SHA-1 signature, when I changed the line above to be

c:\signtool  sign /fd SHA256  /f1234.pfx  etc

it all worked OK.

Hopefully my programs will now download without alarm bells.

Friday, November 6, 2015

Windows 10

I have been running a pre-release of Windows 10 for some time, and seemed fairly stable.  After making good backups,  I have decided to upgrade several working PCs to Windows 10 as well.  This included 2 x Windows 7, and a Windows 8.1 system.  Overall I do not regret this, but the following are a few issues I ran into.

The first issue was to do with remote log on.  I typically have more PCs than screens, partly because I use 3 screens on my main development PC.  The upgrade to Windows 10 took across my pre configured setups, but not everyone worked.  I am not entirely sure how I fixed it, but think the main problem is that Windows 10 is more precise on logon than Windows 8.1  I needed to add the full C name, eg \\Window7system\user name  rather than any abbreviation.  Once the correct logon string was determined, it has been stable.

Next big issue was a conflict between Carbonite backup, and Kaspersky 2016.  When one Googles this problem it is not uncommon.  The solution appears to be to remove both programs and re-install Carbonite followed by Kaspersky. I had to configure Kaspersky by hand to give Carbonite the required permissions.   Another laptop with Carbonite and Norton 360 did not have any issues.

The last problem, I have just solved is that the internet uploads seemed very slow.  An internet test on an iPad showed good speed, but on the PC, downloads were about 35Mbs, but uploads 0.5Mbs.  A few suggested tweaks made no difference.  I tried to update the Ethernet drivers, and was told they are up to date, dated 2012.  The PC is a 2 year old Dell, and I then tried to disable the Ethernet, and use the built in WiFi.  Internet speeds were back to normal, but obviously this is not the way top transfer TB files in the office.  My suspicion was then the device drivers, rather than the basic Windows 10 software.  I went to the Realtek website and found that for my board, RTL8168 there is a Win10 Auto installation package, dated October 2015.  I downloaded this and it now works correctly, ie fast.  I am sorry that the auto driver update did not find this driver.

I may be the last man in the world to stick with Windows Internet Explorer, rather than Firefox, Chrome etc.  IE11 however seems very flawed, and much to my surprise, Microsoft Edge works well.  This has now become my default explorer.

Saturday, October 10, 2015

MXF video

MXF is a video encapsulation program, and as in many programs, the video is stored sequentially on the camera memory chip.  I have a problem with an exFAT memory chip froma Sony PXW-X70 camera XAVC which had been partially formatted.  All fragmentation information was lost.

The solution was to add a new wizard function to CnW.  This scans the memory chip and isolates key types of cluster, headers, indexes, and video data and trailer.  Once found, these XAVC video files are reconstructed in the correct logical order and video will play.

This is another growing example of video that cannot be recovered by standard data carving methods.  Unfortunately many companies may claim to process such files because they are probably tested by writing files sequentially to a memory chip, and saying that recovery is possible.  True, but this is not the way the camera writes it's data 

Sanyo E1 Video camera

Most months I come across a new video variation.  One of the latest is a Sanyo E1.  The video is 'standard' MP4 but the physical recording is non standard.  The customer had spent a few years trying to get the video recovered with no success.  The problem is that the moov atom is both fragmented, and out of sequence, and interleaved with the start of the mdat atom.  No program that just does data carving could ever recover this type of file.  Once the correct sequence was determined recovery was possible.  The initial attempts found video, but no sound, but eventually this was resolved. 

CnW Recovery V4.99 now supports recovery for many such videos, though a few tweaks are still required for longer files.  and run the MP4 wizard.

Website URL

My new GoPro Recovery program is working well, but sales are currently limited.  Most sales appear to be UK based, and USA, where the big market is, is still limited.  One reason I feel for this is because the website  is a .uk website.  I have now tried a new website,  in the hope that having set my Google preference for world wide coverage, I will get more USA hits.  Time will tell.

An area I am also working on is to try and ensure the two websites are different enough in content so as not be classed as duplicate, even though they have started from the same base.

Sunday, August 2, 2015

Panasonic Lumix GH4 recovery

I have often written about recovery from video memory chips.  Everything I create a new solution, a new variation is found.  The latest one is from the Panasonic Lumix GH4 camera.

The video is fairly standard AVC  MP4 structure.  As is typical, the ftyp and moov are recorded in one section, while the mdat is in a different section.  In most cases these sections adjoin.  However, the Panasonic, in at least one case have split these sections to different areas of the memory chip.  This means there are series of ftyp-moov atoms, but after all ftyp-moov atoms, there are then a series of mdat atoms.  Each mdat starts on a cluster boundary so joining the correct moov with the correct mdat has involved analysing the header to see where frames start in the mdat.  Each mdat is then examined until a match is found.  A novel approach, but also one that normally means the atoms are saved sequentially.

The recovery routine has now been added to CnW V4.95

GoPro Recovery Released

The first version of GoPro recovery has now been released.  It is being sold at an introductory price of $9.50 for a life time licence and full support.  This is a basic version, but will recover deleted videos from all GoPro camera sD memory chips.

Future developments will include processing unfinalised files and lost video fragments.  The later may have useful forensic applications.

For download, go to

Thursday, July 2, 2015

GoPro Recovery Update

The new GoPro Recovery software is progressing well.  It now has the following features

Will recover accidently deleted files from
  • GoPro Hero
  • GoPro Hero 3  (Black and Silver)
  • GoPro Hero 4  (Black and Silver)
Files are saved and the log is populated

Thumbnails are shown for every video that is verified as valid.

The current free evaluation will expire on September 1st 2015.  Licenced copies will be available for purchase at the start of August with an introductory special offer price.

Visit  for up to date details

Wednesday, June 10, 2015

GoPro Recovery Software - dedicated software

CnW have been supporting high quality recovery from the GoPro Camera.  In particular, it addresses the problem that most recovery program fail on, in that GoPro video files are complex and cannot be recovered with data carving.

CnW are now launching a new program, GoPro Recovery.  This is simple to use program that will just recover files from GoPro memory chips.  The program is still in early stages of development, but will support Hero3 and Hero 4 files with a good success rate, though the next stage will be nearly perfect.

The fully functional evaluation program (beta version) may be downloaded for free and will operate for about one month.  For details go to  It requires Windows 7/8/10 and only works with a memory chip, or memory image file.

New updates will be uploaded every few days.  Please try and it send us any feed back.

Full version will be launched this summer (2015)