Recover deleted MP4 files from Sony PMW-F3 update

My last post reported good progress on recovery of Sony PMW-F3 files.  I am now pleased to report some extremely good results.

The final approach involved scanning the complete disk for possible audio and video elements.  As this is fairly machine intensive it was very satisfying from the programming point of view to make use of parallel processing.  While one cluster was being read from the physical device, the previous cluster was examined for audio data, and in parallel, video data.

Once the disk has been scanned it is then quick to isolate any pre scanned video structure with it's location within a cluster.  On a small memory device one is normally luck that each structure will have a unique offset.  For large memory device there will be duplicate entries.  In these cases the physical location of the matching cluster will be used to determine the correct one.

When a video file is deleted it is normal for the data to remain, although may well be non sequential.  The critical section to find is the moov atom.  This contains pointers to frame starts and audio buffers.  By tying up the moov pointers with the physical clusters a valid file can be reconstructed.

Simple?  In some respects yes, but recognising patterns is not a simple computer task.  It is very much an exercise in fitting together the best matches.  It is a bit like doing a jigsaw that has no picture.  When it works, the results are fantastic.

Many videos are recorded in two sections, the Sony sometimes uses over 100 sections, so joining these together is a great success.

Which file is a sector in?

Many forensic investigations will scan a complete hard disk for possible interesting strings. The result will be that the string is found in several sectors, but then there is the problem of discovering which files these sectors relate to.

CnW recovery software has a feature within the log to provide an answer to this question. As CnW retains all locations of file fragments, the sme information can be used to discover if a sector is used within any files. This with thelog, the user can search for a specific sector and it will indicate if it is part of a file, or even files. A sector can be marked as part of several files if one has been overwritten by a later file.

If the sector is not part of a file, then it indicates that the data has been found in unallocated space - whch can of course be carved to obtain possibly useful files