CnW-FM, duplicate file finder is developing well.

The main objective is to a be very simple to use application to discovery multiple files saved over multiple disk drives on a PC.  This is in addition to multiple duplicate files on a single disk drive.

The latest update now allows to select the type of drive to search for.  This may be photos, music etc and before the end of November 2024 the use can select specific file types - based on extensions.

Download an try now

www.cnwrecovery.co.uk

Any comments please send to info@cnwrecovery.co.uk

 New Development.  I am working on a program to assist in finding duplicate files on a PC.  

The current super 'beta' version will show duplicate files on a single drive, but within the next week or two this will extend to duplications over several disk drives, or network drives.

The intention is to save space on one hand, and to ensure there are duplicates for critical files

Feel free to download the program, CnW-FM from https://www.cnwrecovery.co.uk 

 Any feed back or suggestions will always be appreciated

 Sale to Disk Drill.  

 About 12 months ago (Sept 2023)  I was approached by Disk Drill (Clever Files Inc) with an interest in purchasing the CnW Recovery software, in particular GPR that processes fragmented video files.  The offer was a vey fair one which I accepted.  

The main intention is so that Disk Drill will be able to process fragmented video files.  The now have all the CnW, and GPR source code and it has been a very interesting year answering their very detailed questions on  why I did certain routines.  Much of my development has been looking for patterns that can be searched for and then processing the data.  Disk Drill have often used a slightly different approach by analysing the patterns that should be seen.  Their solution to absorb 10-15 years of  my development have not taken place overnight, but internal tests are now generating valid files.  Once complete, the CnW programs will be retired.

Another interesting aspect at looking at a different data recovery program is they way Disk Drill operates.  CnW disk recovery worked largely on analysing partial file systems, while Disk Drill is much more intelligent data carving.  Each way has it's advantages, but overall Disk Drill does find files, and does not require the user input that CnW does at times require.  I will be sorry to see 'my baby' retire, but look forward to an improved version of Disk Drill  

XFS Deleted File Recovery

 XFS is a high performance Linux file system.  Unlike NTFS, recovering deleted files is not always possible, but CnW have developed tools to assist.  The results can be mixed, but normally better than just data carving.

XFS comes in a few flavours, but until recently CnW Recovery did not support file version 5.  The changes between earlier version and version 5 are small in overall design, but almost every internal data structure has been changed.  The most critical iNode is now twice the length at 0x200 bytes.  All structures now have increased security including a (unique) parent UUID as part of their structure.

CnW version 5.45 now supports all current versions of XFS

Windows 10 2004 update

I don't often comment on Microsoft because I actually like their products, in particular Visual Studio for C++.

My  main PC (Dell XPS desktop) is a few years old, but with a SSD drive and iCore 7 3.4GHz processor,  12GB RAM, still fine for I use it for.

I try and keep the software up to date and so downloaded the 2004 windows update.  I know there has been some bad press about it, but that was a few months ago.  I also have it running this update without problems on a few other PCs/laptops.  The download and install took a few hours, and all seemed OK when I logged in.  My PC is set to sleep if idle for 2 hours.

Normally coming out of sleep is a much faster process that that of it's owner, ie 5-10 seconds and all running well. This time, it did not show signs of waking up, so much so I ended up doing a forced power off.  Starting from cold was a very slow process, about 4-5 minutes, rather than the normal 30 seconds.  

I then did a test sleep, and this time was more patient.  The system eventually started after 3 about minutes, and ran as normal.

Google searching high lighted I was not alone, but none of the suggestions worked.  At the same time I kept losing screens from my 3 screen setup. I normally would have two, but on one occasion I only had one.

My eventual solution was to revert back to an earlier release (an option in Windows Update). This was a 'quick' process, a few minutes not hours. Everything is now as before.

I will wait a month or so before I retry this 2004 update.

GPS values in data recovery

The two main CnW products now try and include GPS co-ordinates in the forensic versions of the software.  For CnW this is added to photos (jpegs) that are recovered.

For GoPro Recovery, the cameras Hero 7 and later all include GPS receivers.  The the starting location value is added for all videos.  It should be noted though that the receiver is has limited sensitivity and so may not be active for internal recordings.

For a forensic investigation, location can be a very valuable tool.

GPR website

Drone cameras added to GoPro Recovery software

Many drone cameras are similar to GoPro Hero cameras in that they save high and low resolution video at the same time.  For this reason it has been possible to expand the capabilities of the world leading GPR software to include drones.  Currently supported drones include the following list

 ● DJI Inspire 1
 ● DJI Matrice 210
 ● DJI Matrice 600
 ● DJI Mavic 2 Enterprise
 ● DJI Mavic Pro
 ● DJI Phantom 3
 ● DJI Phantom 4 (FC6310)
 ● DJI Spark
 ● Yuneec Typhoon H

Download the current demo version and try for yourself from https://www.goprorecovery.co.uk

Incomplete, or unfinalized GoPro Videos

The GoPro camera is very popular for activities that involve action.  At times these can go wrong and the camera can be thrown off, and sometimes stop recording.

The latest version of GoPro recovery (V1.25) can recover these partial files for Hero 3 camera.

When a camera is stopped from recording video data is normally left on the memory chip in an unplayable format.  It is this data that the GoPro recovery software will find and reconstruct into a playable video file.  GoPro recovery software goes much further than most packages as it will demultiplex the low and high resolution video and audio streams.  Thus a new file might be created out of maybe 100 separate fragments.

How much data will be recovered.  This is a slightly harder question.  When the camera records, obviously at first the video is saved in memory, and then written to the memory chip.  The unknown question is how quickly is data written to the memory chip, ie how much data up to the point of failure will be saved.  The answer is probably up to the final few seconds.

On some recent examples recovered using GoPro Recovery, the saved data seems to have stopped between 1 and 3 seconds before the critical event.  On one occasion this was made worse beacue the police, thinking nothing further could be recovered, told the owner to use the memory chip again.  On this occasion, the saved data was set by the file system, which is almost certainly updated after the data has been written to the memory chip.  ie there would have been more video data saved in unallocated memory which was then overwritten.

The new version of V1.25 works for just Hero 3 cameras, it has a very good reponse to low res videos, but can be slightly mixed with high res video.  This problem will be resolved very soon, and support for Hero 4 cameras will be added next

Digital signatures and SHA256

A very important point for anyone selling software is to make sure that the demo downloads and works.  A critical point of the download is that it is not recognised as a virus, or malicious software.  Hence, for the past several years, all my software has been digitally signed.

The signing was with a SHA-1 signature, and a recognised certificate.  Recently, (Jan 2016) this started give nasty warning messages on downloads.  What has happened is that SHA-1 is no longer considered safe, and so from 2016, web browsers etc have started to look for SHA-256 signatures.

The solution was to contact GlobalSign who provide my certificate,  and they very quickly supplied one with a SHA-256 code.

The next stage was updating my batch files to add the signature.  This was a matter of changing the .PFX name and the password, and all almost worked.  It worked, but the signature was still showing as SHA-1.  Curiously, the code signed within InstallShield 2015 was showing SHA-256.  This did mean my new certificate was correct.  It turned that my signing routine was along the lines

c:\signtool  sign  /f 1234.pfx   etc

By default the sign routine adds a SHA-1 signature, when I changed the line above to be

c:\signtool  sign /fd SHA256  /f1234.pfx  etc

it all worked OK.

Hopefully my programs will now download without alarm bells.

Windows 10

I have been running a pre-release of Windows 10 for some time, and seemed fairly stable.  After making good backups,  I have decided to upgrade several working PCs to Windows 10 as well.  This included 2 x Windows 7, and a Windows 8.1 system.  Overall I do not regret this, but the following are a few issues I ran into.

The first issue was to do with remote log on.  I typically have more PCs than screens, partly because I use 3 screens on my main development PC.  The upgrade to Windows 10 took across my pre configured setups, but not everyone worked.  I am not entirely sure how I fixed it, but think the main problem is that Windows 10 is more precise on logon than Windows 8.1  I needed to add the full C name, eg \\Window7system\user name  rather than any abbreviation.  Once the correct logon string was determined, it has been stable.

Next big issue was a conflict between Carbonite backup, and Kaspersky 2016.  When one Googles this problem it is not uncommon.  The solution appears to be to remove both programs and re-install Carbonite followed by Kaspersky. I had to configure Kaspersky by hand to give Carbonite the required permissions.   Another laptop with Carbonite and Norton 360 did not have any issues.

The last problem, I have just solved is that the internet uploads seemed very slow.  An internet test on an iPad showed good speed, but on the PC, downloads were about 35Mbs, but uploads 0.5Mbs.  A few suggested tweaks made no difference.  I tried to update the Ethernet drivers, and was told they are up to date, dated 2012.  The PC is a 2 year old Dell, and I then tried to disable the Ethernet, and use the built in WiFi.  Internet speeds were back to normal, but obviously this is not the way top transfer TB files in the office.  My suspicion was then the device drivers, rather than the basic Windows 10 software.  I went to the Realtek website and found that for my board, RTL8168 there is a Win10 Auto installation package, dated October 2015.  I downloaded this and it now works correctly, ie fast.  I am sorry that the auto driver update did not find this driver.

I may be the last man in the world to stick with Windows Internet Explorer, rather than Firefox, Chrome etc.  IE11 however seems very flawed, and much to my surprise, Microsoft Edge works well.  This has now become my default explorer.

MXF video

MXF is a video encapsulation program, and as in many programs, the video is stored sequentially on the camera memory chip.  I have a problem with an exFAT memory chip froma Sony PXW-X70 camera XAVC which had been partially formatted.  All fragmentation information was lost.

The solution was to add a new wizard function to CnW.  This scans the memory chip and isolates key types of cluster, headers, indexes, and video data and trailer.  Once found, these XAVC video files are reconstructed in the correct logical order and video will play.

This is another growing example of video that cannot be recovered by standard data carving methods.  Unfortunately many companies may claim to process such files because they are probably tested by writing files sequentially to a memory chip, and saying that recovery is possible.  True, but this is not the way the camera writes it's data 

Sanyo E1 Video camera

Most months I come across a new video variation.  One of the latest is a Sanyo E1.  The video is 'standard' MP4 but the physical recording is non standard.  The customer had spent a few years trying to get the video recovered with no success.  The problem is that the moov atom is both fragmented, and out of sequence, and interleaved with the start of the mdat atom.  No program that just does data carving could ever recover this type of file.  Once the correct sequence was determined recovery was possible.  The initial attempts found video, but no sound, but eventually this was resolved. 

CnW Recovery V4.99 now supports recovery for many such videos, though a few tweaks are still required for longer files.

www.cnwrecovery.com  and run the MP4 wizard.

Website URL

My new GoPro Recovery program is working well, but sales are currently limited.  Most sales appear to be UK based, and USA, where the big market is, is still limited.  One reason I feel for this is because the website goprorecover.co.uk  is a .uk website.  I have now tried a new website, www.recovergopro.com  in the hope that having set my Google preference for world wide coverage, I will get more USA hits.  Time will tell.

An area I am also working on is to try and ensure the two websites are different enough in content so as not be classed as duplicate, even though they have started from the same base.

Panasonic Lumix GH4 recovery

I have often written about recovery from video memory chips.  Everything I create a new solution, a new variation is found.  The latest one is from the Panasonic Lumix GH4 camera.

The video is fairly standard AVC  MP4 structure.  As is typical, the ftyp and moov are recorded in one section, while the mdat is in a different section.  In most cases these sections adjoin.  However, the Panasonic, in at least one case have split these sections to different areas of the memory chip.  This means there are series of ftyp-moov atoms, but after all ftyp-moov atoms, there are then a series of mdat atoms.  Each mdat starts on a cluster boundary so joining the correct moov with the correct mdat has involved analysing the header to see where frames start in the mdat.  Each mdat is then examined until a match is found.  A novel approach, but also one that normally means the atoms are saved sequentially.

The recovery routine has now been added to CnW V4.95

GoPro Recovery Released

The first version of GoPro recovery has now been released.  It is being sold at an introductory price of $9.50 for a life time licence and full support.  This is a basic version, but will recover deleted videos from all GoPro camera sD memory chips.

Future developments will include processing unfinalised files and lost video fragments.  The later may have useful forensic applications.

For download, go to www.goprorecovery.co.uk

GoPro Recovery Update

The new GoPro Recovery software is progressing well.  It now has the following features

Will recover accidently deleted files from

• GoPro Hero
• GoPro Hero 3  (Black and Silver)
• GoPro Hero 4  (Black and Silver)

Files are saved and the log is populated

Thumbnails are shown for every video that is verified as valid.

The current free evaluation will expire on September 1st 2015.  Licenced copies will be available for purchase at the start of August with an introductory special offer price.

Visit www.goprorecovery.co.uk  for up to date details

GoPro Recovery Software - dedicated software

CnW have been supporting high quality recovery from the GoPro Camera.  In particular, it addresses the problem that most recovery program fail on, in that GoPro video files are complex and cannot be recovered with data carving.

CnW are now launching a new program, GoPro Recovery.  This is simple to use program that will just recover files from GoPro memory chips.  The program is still in early stages of development, but will support Hero3 and Hero 4 files with a good success rate, though the next stage will be nearly perfect.

The fully functional evaluation program (beta version) may be downloaded for free and will operate for about one month.  For details go to www.goprorecovery.co.uk.  It requires Windows 7/8/10 and only works with a memory chip, or memory image file.

New updates will be uploaded every few days.  Please try and it send us any feed back.

Full version will be launched this summer (2015)

3.5" floppy disks and Word 6

I thought I had seen the last of 3.5" floppies until last week.  A customer turned up on my door step with 4 3.5" floppies, and wanted back documents she had written 20 years ago.

Fortunately I still have a few PCs with internal floppy drives (on XP boxes).  These I could see were DS-DD 720K rather than the normal 1.44MB disks.  The customer mentioned an Apricot system, very popular in the mid 80s, but not totally PC compatible.  On placing the disk in the PC, it suggested a reformat, as the disk was not recognised.  Fortunately on examining the sectors it was clear that the disk was still sound, with not obvious sector errors.

Trying to read it was not an instant success.  It was FAT12, but as there were no subdirectories the CnW automatic parameters program failed.  The next stage was top fire up an old copy of InterMedia for Windows.  Being a 16 bit program, this had to be on an XP box.  InterMedia for Windows has a routine called MS Auto that will try and determine disk parameters automatically for floppy disks, and with this the directory was soon visible.

I could now read the files, a mixture of .DOC and associated .BAK files.  However, to be expected, trying to open the .DOC file indicated it was from a Word 6  system.  Word 2003 is meant to have a filter to read this, but it would not work (mswrd632.wpc) so the files could be seen, but with a lot of binary code included.  I am not sure that Word 2003 is supported anymore, being an XP era program.

The next stage was to use InterMedia for Windows again that has protocol handlers for hundreds of old word processing packages, including Word (several versions).  This then  produced nice clean text, with embedded  commands (IMIC2) for some formatting.  These commands were then stripped out using translation tables to generate a simple text file that could be read on a modern PC.

InterMedia for Windows now looks like an old program - it is over 10 years since I last updated it, but it did produce a nice clean result.

Windows 10

I have an oldish PC, bought originally to run Vista.  This I then updated to 7 and 8.  This week I download the Microsoft Technical Preview, otherwise to be called Windows 10.

The installation required DVD to be burnt and then the occasion button pressing while loading.

The final loaded PC was almost exactly as I had it setup in Windows 8.  All programs ran, in particular CnW Recovery.  ie the upgrade could not have been more painless - although it is reported that come April, it might all stop working.  It even worked as a remote desk top with no additional attention.

I cannot comment on performance as the PC is an old Core Duo but it does have 8GB RAM.  I am currently using it on video file recovery testing and after a few days it has just worked.

The famous start menu is back, with a few tweaks, and a bit of the metro style start at the same time.

The only downside is that Norton 360 does not work, so the system is protected by the free Microsoft Defender.

So far, so good.

Viewing H264 raw video files

This is a very useful link I would like to share.

Often one has a video file that one cannot view - maybe from a CCTV system.  It is quite common to be H264 or similar, but does not have a standard wrapper, eg .MOV, or .MP4.

The very good free program VLC does have a feature to allow you to do this.  The following Youtube link does describe how to

As a very quick summary, the following may help

Select

1.   Tools
2.   Preferences
3.   At the bottom select 'All'
4.   In Stream output  select 'Demuxers'
5.   Then select the  Mux module  - (Automatic is the default)