I have often said of data structures, 'if it can be done, it will be done'. ie almost anything is possible, and so expect many variations. In the words of the 'Hitch Hikers Guide to the Universe' - Expect the unexpected.
A recent view of a GoPro Hero 3 camera confirmed the above. As I have written in the past, video camera often record the data not in a different physical to logical sequence. The slight of hand is that the FAT defines the logical sequence. Thus many camera record the video data physically earlier than the file start sector. On the GoPro Hero 3 camera another twist has been discovered. Two video streams can be recorded at the same time - a high resolution, and a smaller low resolution. The physical sequence on the disk could be as below
Just to complicate the above, there can also be jpeg thumbnails, and text status files inserted in the above stream. Standard data carving is totally useless as nothing is in sequence.
The CnW MP4/3GP Wizard works hard, but will recover, with a high success rate videos that have been deleted. www.cnwrecovery.com/html/mp4_wizard.html
No comments:
Post a Comment