MP3 recovery

A recent job involved a corrupted MP3 player.  On plugging it into the PC it displayed as an music player, rather than as a hard drive.  A bit of reading the manual showed there were multiple modes for the USB interface to work, and once set in the appropiate mode, I could see the device as a storage device.  As expected it was a FAT32, but 6.5GB of it's 8GB capacity was in the FOUND.000 subdirectory, as the result of a chkdsk type command.

The files to be recovered were ones the customer had recorded which were no longer visible.  The first recovery attempt was a data carve of the disk and this showed a number of files, of the type required, but no file names or directories.  The second attempt was a logical read, but this only showed what was seen directly on the PC.  The third attempt was a scan of the disk for FAT directory stubs using CnW recovery software.  Interestingly this scan came up trumps.  All the files that had been lost (and captured on the chkdsk) were found with valid names and valid subdirectories.  When recovered the complete MP3 player was much as originally configured.

Overwritten MAC disk

I recently received a MAC disk for data recovery. The disk imaged without any sectors errors, and a scan of the disk indicated there was about 70GB of data. However, when I read it, only about 20MB was recovered. The fist thought is that all the daya had been deleted which is not good news for a MAC. When a MAC file is deleted, it also removes the metadata from the directory, making intelligent recovery impossible. The only recovery approach is data carving.However, looking through the disk, several files looked rather PC based, and there were also som FAT32 directory structures. A scan of the disk using the CnW Partition function showed there were about 300 FAT sub directories on the drive. This indicates that the drive was intially a FAT32 drive that had been reformatted as a MAC drive. A bit more examination also indicated that much (but not all) of the FAT was still intact.CnW was set to recognise the partition as a FAT32 and a very complete recovery was made. By examining the log (and sorting on start location) it was clear that the area that th MAC writes most directory information was one where only a few system files originally existed, and so it was likely that very few useful files were lost.Moral - when only a few files have bee found on a disk, it is always worth investigating if it has been reformattted, either to the same, or a different file system.

AVI data carving

Most data files are written sequentially which means that data carving can have a good guess that the data will typically be sequential. However, recently some AVI files have been found that do not seem to follow this pattern.

The file in question was written using a video camera and it appears that the first section was the data - a series of tagged chunks ofthe starting "00dc" or "00wb". An AVI file contains an index and in this version, the index was added to the first block after the main header information. Thus to carve the files it is necessary to read the header, and then in effect go back to find the blocks used. To make the job possible, the index does conatin the offset and length of each tag. It is therefore possinle to search the raw disk for a cluster that contains a '00xx' tag at a certain location within a block, with a defined length.

Recent developments with CnW Recovery software have added the automatic feature so that a trailier can be created if missing.  This means that even a partial fragment can be viewed.