Other data recovery companies

It is not good british policy to 'throw' mud at other businesses, but in the past week I have come across two cases of what best be described as incompetence.

The first case was a company trying to recover photos from a damaged or corrupted sD card.  At the end of the recovery the results were poor.  Then for some reason they returned the poor results on the same memory card, so overwriting the files and making the chance of future recovery extremely remote.

Another job I received a partially deconstructed CE card.  The company was about to remove the chips, but realised they were not compatible with their memory chip reading equipment, having an unusual hidden pin layout.  What I cannot understand is that the card would read OK as a complete card, but just had a few sectors not working.  OK these were part of the FAT but actually not at all critical.  It was possible to read the card, and using CnW recovery software a full recovery of the critical files was made.

The biggest golden rule with data recovery is to never change data on the problem device.  When ever possible it is best to connect the device using a write blocker as this will also prevent a PC doing a virus erase, defrag, or any other device the PC may decide to do which is normally invisible and harmless.  In the second case, the issue was solved with software as only a few sectors had failed.  Chip removal may well have come across the same failed sectors and there is always the chance of more damage when subjecting memory chips with lots of hot air, and physical strain.

Another MP4 video structure on camera

I have written several times about the way that 3GP and MP4 files are physically stored on a FAT32 chip, and the file allocation table is set so that the logical structure is 'normal'.  The issue that the mdat atom is large, and the camera does not know how large until the filming has finished.  This is therefore written on the fly, and at the end of recording, the ftyp and moov atoms can be created and saved.  Logically, the ftyp is always first, and very often the moov atom is second.

When the file is deleted in FAT32 all this sequence information is lost so the file has to be reconstructed by in effect moving the ftyp and moov before the previous mdat fragment.  This is something the enhanced data carving in CnW recovery software does when 'process fragments' is selected.  Straight data carving will not touch such recovery.

However, as ever, a new variation has been found recently.  One Samsung camera (and there may well be more) allows the user to take still photos at the same time as the video.  As might be expected, the video stream now has MP4 data, and then clusters of photo data embedded in the stream.  Just one more issue to be resolved while doing data recovery.

The new CnW 3GP/MP4 data recovery wizard is being designed to take care of this, and was released in October 2012, with regukar updates