Finding owner of data

On a recent walk along a Californian beach I found a compact camera, covered in sand and salt water.  The camera was very dead, but out of interest I eventally managed to extract the 2GB SD memory card.   After drying it out, it was readable with errors.  When totally dry, it read without errors.

I was keen to try and contact the owner and return the photos, over 500 of them.  Unfortunately, there is very little on a memory chip to tell you about an owner, only the camera, and date and time of the photos.  From this I could determine that the last photo had been taken about 10 days before I found the camera.  I did try and add a 'Found camera' to a local lost and found website, but no reply.

Recently, I did a bit more investigation by looking at the photos more closely.  Obviously the owner was a young person, with lots of photos in night clubs, no names identifiable, but also some at a college.  One photo though I do hope will be a major clue is that it includes, possibly the owner, or close friend holding a college certificate with their unusal surname name on it.  A bit of Googling took me to Facebook, and I hope a perfect match. (The name and college course both match, and the photo looks similar).  I have now sent a message to the person, and am waiting for a reply.

The moral of the story is that if you want goods returned, it can be helpful to have some return details stored with it.

As a post script, the owner did contact me and a DVD of photos was sent.  I have just received a very nice letter of thanks.

Virus issue

I don't often get involved in fixing PC problems, but recent jobs involved the same type of issue.  The PC starts to report serious errors, and show problems with boot sector and other critical areas of the disk.  It all looks rather real, and very worrying.  However, in both cases it was caused by a similar, but different Fake Anti Virus program.  I think if you continue there was an offer of the program to fix the issue - in exchange for some $$$s.

The approach I tooks was to remove the drive from the laptop and create an image for security purposes.  I then ran Norton which tracked down several viruses, and removed them.  This is where the two viruses behaved differently.

Virus one did not want to be removed by Norton and started each time the machine booted.  The problem was that a startup function  (go to msconfig) was launching the virus at startup each time.  By removing this start up line - and seeing the program it was starting (it had a randomly generated name) the PC was then OK.  The free AVG virus checker was added to the PC to try and prevent this happening again.  A report a few weeks after this event indicated that eveything has been OK.

Virus two was removed by Norton, but left the PC in a state where no program would actually launch from explorer.  Various 'Googled' ideas pointed to the registry, but this did not help.  Launching the command prompt was also very difficult and the start program launcher did not work.  A solution to this was rather unusual, but worked, and hence I am including it here.  Do Ctrl-Alt_Del and b ring up the task manager.  Under the top menu item 'File' thre is a run command.  This worked and a command window was opened.  It did not seem possible to change file attributes to make sure that a .exe was launched so evenually the PC was restored to a restore point from afew weeks earlier.  Everything then nearly worked.

On examining the PC there were issue with McAfee antivirus which was not running, and also 18 months of Vista updates had not been loaded - 90 patches althogether.  The 90 patches were installed, McAfee updated and this worked.  PC now all OK, but all automatic updating was set to 4am when the PC is normally turned off.  This was changed to a time when the PC was likely to be on and hopefully the problem will not arise again.

In both cases, no data was actually lost

Parallel Programming

Modern proessors are not getting much faster, 3GHz has been a fast processor for about 7 years.  They are getting wider.  It started with hyperthreading and then multiple cores.  Almolst every processor is now a multiple core, and current Intel chips have 4 cores with hyperthreading, making in effect 8 cores.

Unfortunately, most programs just use a single core and so performance gains are not very significant.  The solution is to use parallel programming so that different tasks are performed in different cores.  This may sound simple but unfortunately many computing tasks are sequential.  In data recovery it is sequence or read disk, analyse data and save data.  The other problem is each time a task is split there is a processing overhead.  This means that benefits may not be very significant.

An example of the limited benefit mentioned above is a simple program I wrote to experiment with parallel programming.  It was purely an exercise with in memory manipulation - ie no hard disk access.  The first example was single threaded and took 35 seconds to run, using a single core.  The next example was using the 'parallel_invoke' function and used all possible cores.  When running it looked impressive with all 8 cores running at 100%.  However, the time was not reduced by a factor 8, but only roughly halved to 15 seconds.  Although this would be a worth while time gain its shows how overheads of a new task eat into the gains.  I am sure that a bit of tweaking could have made the improvement better, but the warning is that a PC may be running at 8 * 100% but actually alot of this may be house keeping.

In a real world example I have added some parallel processing into CnW Recovery software.  The area was to do with calculating MD5 hash values while writing data to the output drive.  As these processes do not depend on each other, they can run at the same time sharing the same memory buffer.  The result was a reduction in time from about 3 hours 30 mins to 3 hours 10 mins.  This is worth while but not very dramatic.  However, it will be possible to add SHA-1 hashing with no extra time penalty and that would be a major benefit.

WD disk not responding

A recnt Western Digital 500GB disk was spinning, but not recognised by a PC with USB connector.  The next test I always try is with Ace Laboratories PC-3000 which is designed to test abd refirm driver firmware.  At first this would not recognise the disk under general routines, but when the WD funtion tests were tried some response was found.  It was not enough to recognise which family the drive belonged too, and so this was a case at looking at all the PCB layouts and matching a photo.  Eventually the short list was 4 possible drive types, of which Tornado 2D was found to work.

The PC-3000 did a series of tests, and end of which it was possible to view a sector.

I did not know how long this reading would last so I started a Read to file and this moved very slowly, but positively.  After a few hours the reading sped up to an acceptable rate.  Over night over 200GB was imaged, but then the reading had gone painfully slow.  I stopped the read and confirmed that other areas of the disk could be read without significant delays.  The problem with PC-3000  is that it is not very good at reading sections of disks in an easily managed way.

The next stage was to carefully disconnect the SATA cable from PC-3000 and connect a PC (USB) SATA connector, without turning the drive power off.  To my delight, the PC would read the disk anda process of incremental imaging was continued.  I started with the final 200GB or so of the disk, and slowly worked back to the area that caused so many problems.  When I had managed to image probably over 99% of the I decided the return rate was probably too small to consder worth continuing.  The image produced a very healthy recovery of the disk, thanks both the PC-3000 and Incremental Imaging.

Windows 7 update

I recently wrote about upgrading a PC from Vista to Windows 7.  The cost was about £80 for software upgrade and £25 for extra memory.

It has been worth it.  The machine is more reponsive and setting up network connections and printers much easier. The configuration is a 2.4GHz, Core 2 duo PC with 4GB RAM, 750GB hard drive, (250-500 partitions), a 2TB WD green drive, and a 2.7TB  RAID.  The only slow part to be investigated is the100Mb network.

The WD Green drives are not blistering fast, but they are very cool (in the sense of temperature).  This should help reliablity, and mean that computer fans can run less often, giving me a quieter life.

Graphics are not important, so the PC has the standard graphics interface, but Windows 7 aero does work.

Create a DVD with recovered video

Software development is always looking at ways to improve the use of a program. What often happens is that simple task is being repeated many times, and this indicates that something can be improved.
CnW gets lots of failed mini-DVDs to recover, and has a very high success rate.  Copies of the software are also sold to do the same function.  The original version would produce a series of files in the standard directory structure for a video disk.  The user would then have to use a DVD burning program to create a new video disk.  Not every 3rd party burning program works as required, so now the function has been added to CnW.  It is a very simple process, so when a disk has been recovered, a blank DVD may be inserted, and a new DVD burnt.  This saves both time, and also the chance of operator error, and program incompatiblity.
So for simple video data recovery, that will actually produce a playing DVD at the end look at www.cnwrecovery.com/html/mini_dvd.html

Blank DVD-RW

I recently received 2 mini DVD-RW disks.  When read with normal hardware, every sector was blank, and there were no error messages.  However, when read with specialised hardware, it was possible to recovery about 20 mins of a wedding video from each disk.

The moral of this story is what looks blank, may not always be blank.  Any forensic investigation should also take this into account.  CnW Recovery have developed a method to examine and recover data from areas of a DVD that can not otherwise be accessed.  CnW Recovery has a fixed price of £40, no fix, no fee for this type of data recovery.  Contact info@cnwrecovery.co.uk for more details

Solved - problems copying files to a Mac from PC disk

My data recovery is all done on PCs.  Often though, the original disk is a Mac HFS+ disk, and the customer wants the data back on a Mac Drive.  My process for doing this is to recover the files to a PC drive (NTFS or FAT32) which a Mac will read. By using the AppleDouble format (with hidden ._ files) all resource forks are retained.  I then copy the files, using a Mac on to a customer disk.  I could have used a program such as MacDrive, but the last version I had did not retain resouce forks.
Most files copy without problems, and the resource fork is correct, but sometimes an error such as - 
     "The operation cannot be completed because you do not have sufficient privileges for some of the items"

is displayed and the copying stops.  This is best described as a pain as the point of stopping has to be determined, and a copy restarted.  Eventually I tracked this down to the type of file and established the problem files had the file type 'slnk' or 'hlnk' in the resouce fork.  This was trying to associate the file with a program that may not present on the copying Mac.  The solution has been to remove this strings in the resouce fork and initial results now allow me to do a copy  in one stage.

Bye Bye Vista!

Doing software development it is essential that your product works on systems customers want to use.  This means keeping upto date with standard updates and a few years ago I purchased a Vista system.  It did thrown up a few compatibility problems so the purchase was worth while, but somehow the system never worked very well.  The PC was a reasonable spec, Core Duo, 2.4GHz with 2GB or RAM.

However, enough has been enough, and my Windows 7 systems seem very stable, so I decided it was time to update the Vista to Windows 7 - 32bit.  A search on Amazon brought up a reasonable price, and then a few more GBs or RAM to go to 4GB.  The fitting of RAM was easy, though of course, 32 bit Windows only sees 3GBs.

In theory, Vista can be updated to Windows and keep the system intact.  Obviously a full backup was done first, and the install was started.  At this point a problem arose.  The new Windows 7 package was less high end than the original Vista package, and this would not allow for a seamless upgrade. The notes implied that all data would be lost, and a clean install would be carried out.  The truth was actually not quiet so bad.  On starting the update, about 50GB of files were backed up to a windows.old directory, and this contained all programs and user directory.  Obviously the programs are not installed, but copies are made.  Unexpectedly, the rest of the hard drive was left unchanged, so all existing directories were left as original.  I now just need to clear down a lot of the unwanted 50GB backup.

Overall, the upgrade was very painless and after a bit of personal tweaking, I now have a nice Windows 7 machine which seems to work.

Defragmenting videos from mobile phones

Mobile / Cell phones typically store videos as .3GP, .MP4 type files.  These can be recognised easily in a hex viewer by looking at the start of the file. The second group of 4 bytes will be the string 'ftyp' followed by the exact type of file, eg '3gp5'.

If the files are to be recovered by data carving, then at times the data may be fragmented.  CnW is working on a solution to this problem.  Fortunately these Quick Time files have a fairly helpful data structure, and so it is possible to both verify, and hence reconstruct files from fragmented stored in different fragments.  The basic file struct is 3 main data areas,

    ftyp  moov  mdat

However, the order of moov and mdat can vary.  The moov segment stores all pointers and decoding details for the data area, mdat.  The mdat area basically contains frames of video and sound.  As video frames normally start with the same header string, by decoding the moov it is possible to examine a possible fragment and determine if it does have the correct headers in the correct location.  If a match is found then it is possible to apply this fragment to the new image.

The moov fragment is not normally very large and so the expectations are that the complete segment will be found in the first complete fragment, along with the ftyp header.  This will be true for the files that store moov straight after the ftyp tag.  For files which are ftype - mdat - moov sequence, it is necessary to examine the mdat for frame starts and hence calculate possible values that will be found in a moov segement.  The disk then has to be searched for a suitable moov fragment.

The current status of CnW Recovery is for recovery of a ftyp - moov - mdat file.  The second variation is under development.  http://www.cnwrecovery.com/ for more details of software