Other data recovery companies

It is not good british policy to 'throw' mud at other businesses, but in the past week I have come across two cases of what best be described as incompetence.

The first case was a company trying to recover photos from a damaged or corrupted sD card.  At the end of the recovery the results were poor.  Then for some reason they returned the poor results on the same memory card, so overwriting the files and making the chance of future recovery extremely remote.

Another job I received a partially deconstructed CE card.  The company was about to remove the chips, but realised they were not compatible with their memory chip reading equipment, having an unusual hidden pin layout.  What I cannot understand is that the card would read OK as a complete card, but just had a few sectors not working.  OK these were part of the FAT but actually not at all critical.  It was possible to read the card, and using CnW recovery software a full recovery of the critical files was made.

The biggest golden rule with data recovery is to never change data on the problem device.  When ever possible it is best to connect the device using a write blocker as this will also prevent a PC doing a virus erase, defrag, or any other device the PC may decide to do which is normally invisible and harmless.  In the second case, the issue was solved with software as only a few sectors had failed.  Chip removal may well have come across the same failed sectors and there is always the chance of more damage when subjecting memory chips with lots of hot air, and physical strain.

Another MP4 video structure on camera

I have written several times about the way that 3GP and MP4 files are physically stored on a FAT32 chip, and the file allocation table is set so that the logical structure is 'normal'.  The issue that the mdat atom is large, and the camera does not know how large until the filming has finished.  This is therefore written on the fly, and at the end of recording, the ftyp and moov atoms can be created and saved.  Logically, the ftyp is always first, and very often the moov atom is second.

When the file is deleted in FAT32 all this sequence information is lost so the file has to be reconstructed by in effect moving the ftyp and moov before the previous mdat fragment.  This is something the enhanced data carving in CnW recovery software does when 'process fragments' is selected.  Straight data carving will not touch such recovery.

However, as ever, a new variation has been found recently.  One Samsung camera (and there may well be more) allows the user to take still photos at the same time as the video.  As might be expected, the video stream now has MP4 data, and then clusters of photo data embedded in the stream.  Just one more issue to be resolved while doing data recovery.

The new CnW 3GP/MP4 data recovery wizard is being designed to take care of this, and was released in October 2012, with regukar updates

Memory on Windows 7 64

Windows 7 64 often comes with 4 or 6GB or RAM.  Although it sounds enough, I kept finding my system 'freezing'  Checking memory use, it normally 'froze' when all the physical memory had been used, ie 6GB, and the rest of memory was virtual memory.

The fix was a very simple, and actually low cost memory upgrade.  Buying 8GB of RAM, let me install 2x4GB and 2x2GB chips giving a total of 12GB.  My first attempt on a DELL PC displayed just 8GB of RAM and not 12GB.  An e-mail enquiry to Dell Support indicated that the memory has to be arranged in pairs.  In this case it was the higher capacity in the first two memory slots.  After this, all 12GB  was available.

Since the upgrade, I have rarely hit the 12GB capacity, and the PC has remained much more responsive.

MP4 recovery from a truncated file

I recently received a 20 minute MP4 file were recovery of both video and sound was required.  However, the file had not been finalised so there was no meta data.  The file contained a header, 'ftyp' and the 'mdat' segement, but no 'moov' data.

Interestingly, Windows media player would view the file - but video only.  Quick time and VLC would not touch it.

To process the file I recquested, and received a small MP4 file.  From this all the meta data in the moov atom could be read.  It was then a case of reconstructing the atoms that describe the file.  The most important ones are 'stsz', 'stss' and 'stco'.  Each codec has different coding systems, but on this video, each video chunck started with the string 0x00 0x00 0x01 0xb3.  Each audio chunck was a fixed length, and preceeded the video chunk.  The difficult one to find was the video frame, which started with 0x00 0x00 0x01 0x00  - although easy to find, the possiblity of false positives required careful attention.

After a fair bit work and investigation it was possible to get a viewable video with sound, but approx halfway through the video became distorted.  The problem turned out to be the 'stss' atom (sync sample atom).  All chunks seemed to have a fixed number of frames, so the 'stss' array was straight incrementing numbers.  However, at about the 2GB mark of the file one chunk had extra frames.  This was reflected in both the 'stss' and 'stsz' atoms, but the video did not display correctly.  After a lot of head scratching a workable solution was found by ignoring the extra frames.

Curiously, the sample MP4 would not play with QuickTime, or produce sound with Windows Media Player.  It is possible that the originally created file was valid, but VLC does not like variable length 'stss' atom elements.

Overall, a very satisfactory solution as file was reconstructed with a totally missing moov section.

Multiple screens

I don't know why I didn't do this before - add a second screen to my main development PC (win7-64).  The benefits are dramatic.  On one screen I can have visual studio for program development, and on the second a hex dump of the file I am looking at.  Or the second screen can be a web page of documentation, or anything else.

The result is that is now much less likely necessary to print anything out for reference purposes, and one can cut and paste beween the two screens.

The setup was easy, just aquire a suitable monitor, and in my case a new lead to connect to the video card my PC.  Configuration was through the control panel and the only hiccup was trying to get the second monitor to be logically (as well as physically) on the left of my desk.  The tip is that the control panel will display two monitors with a big 1 and 2 on them.  These icons can be dragged so that the main and second monitor are as required.

PSR

It has been known (although I would like to think very rarely) for my software to crash. As the user could be anywhere, it normally means several e-mails to track down what they have been doing, upto the point of failing.

I have just discovered a very useful Microsoft feature - part of Windows 7 - that may help considerably in the future.  It is called PSR - and can be launched from the command prompt, or Windows start prompt.  It will very simply record screens and produce a sensible size file that can be e-mailed for investigation.  The user can see what is being sent so there can be no question of possible spying.  There is also no requirement to load software on the user PC, or change security settings (beyond setting administrator rights for the PSR to run).

Credit for this information should really go to PC-PRO magazine in UK, April 2012 - thanks.

4K sector size

I am sure we have all read about hard drives with sector sizes greater than 512 bytes (0x200).  This week I saw my first one. A 1TB Iomega drive, with USB 3.0 connection.  The customer had lost their data, and sure enough when plugged into a Mac, there was nothing.

Looking at the disk, the first surprise was the sector size was 4096  (0x1000) bytes.  On first loading, my software did not like it but fortunately the fix was very quick to implement.  The software was expecting the boot sector signature of 0x55 0xAA to be at the end of the sector, rather than the end of the first 0x200 area.  By fixing this small problen, CnW recovery read the disk without problems.  Logically, the Mac disk is still based on 0x200 byte sectors so the program has a simple read function that translates a logical sector number into a disk logical block address (LBA) and the extracts the sector.

Be warned, more of these disks will be on their way.

Not enough server storage is available to process this command

I recently upgraded an XP system to have a larger hard drive for data storage.  The new drive is a 1.5TB drive, replacing the previous 500GB drive.  The PC is about 5 years old but still works well, and has 3GB of RAM.

On a recent disk imaging process, it came up with errors writing to the drive.  It indicated not enough resources.  I tried a reboot (to clear down any untidy memory) but errors kept appearing.  I then tried writing from a different machine via the network.  This displayed the error message
"Not enough server storage is available to process this command".  As a second test I tried to copy a 350GB to the same drive.  After seconds, this Windows only command failed.

I determined that the error being returned was m_loSError 1130, or 0x46a 

The next stage was Google with this error message and sure enough I have not been the first to receive it.  Also, very nicely there is a fix by changing a registry setting. 

http://support.microsoft.com/kb/304101

Subsequent testing shows that the system is now stable, and I can copy a 350GB file to the same disk drive.  As a spin off, I have improved the error reporting of my software to assist with other users hitting he same problem.

How to read XFS on Windows

I often read about problems people have reading Unix formats on a PC.  Linux has many features that allow a new file system to be loaded and hence read disks in non Ext/2/3/4 format.

One solution for a PC is to use CnW to just read the data files from the foreign file system.  95% of the time this will be a satisfactory solution, though there will be occasions were read and write are required. CnW does not write to non PC file systems.

By using a copy of CnW Recovery software files can be read from many Unix disks, including XFS and Reiser.  It also included Macintosh.  The demo will read the files, but not actually save any.

CnW is designed as a data recovery tool, rather than this general reading tool, so file selection is limited, for instance there is no drag and drop.  However, there are extensive file filter tools so file of a certain date, size or name/location may be selected or skipped.

When presented with a problem of accessing data from a foreign drive, CnW may well provide a simple solution.  As a bonus deleted files can also be found.

Ubuntu disk formatting

Recently I was using Ubuntu V11.10 to create a sample Unix disk.  I am no greate fan of Linux, but I have to say that V11 is getting close to a system that could be used by 'normal' users and not just geeks that love long command lines with millions of options.  On the negative side it does seem to be influenced by the Macintosh.

However, one currious problem I ran into was with formatting a disk.  I wanted to reformat an old Windows disk into Unix.  The old disk was a valid disk, so had a partition identifier set in the boot sector, and naturally it was set as 7 for NTFS.  I formated the disk, copied some files over and went to use the disk.  Rather oddly, it was recognised as an NTFS disk - but corrupted.  I discovered this was because the partition ID was still 7, rather than 0x83 I would have expected for Reiser.

The solution was two fold - it is posible in Ubuntu to edit the partition info, and in CnW it is possible to select the correct type of disk.

The warning that I doubt I am the first to create this problem and it is possible that a corrupt NTFS disk is infact a Unix disk.  Be aware!