Friday, November 6, 2015

Windows 10

I have been running a pre-release of Windows 10 for some time, and seemed fairly stable.  After making good backups,  I have decided to upgrade several working PCs to Windows 10 as well.  This included 2 x Windows 7, and a Windows 8.1 system.  Overall I do not regret this, but the following are a few issues I ran into.

The first issue was to do with remote log on.  I typically have more PCs than screens, partly because I use 3 screens on my main development PC.  The upgrade to Windows 10 took across my pre configured setups, but not everyone worked.  I am not entirely sure how I fixed it, but think the main problem is that Windows 10 is more precise on logon than Windows 8.1  I needed to add the full C name, eg \\Window7system\user name  rather than any abbreviation.  Once the correct logon string was determined, it has been stable.

Next big issue was a conflict between Carbonite backup, and Kaspersky 2016.  When one Googles this problem it is not uncommon.  The solution appears to be to remove both programs and re-install Carbonite followed by Kaspersky. I had to configure Kaspersky by hand to give Carbonite the required permissions.   Another laptop with Carbonite and Norton 360 did not have any issues.

The last problem, I have just solved is that the internet uploads seemed very slow.  An internet test on an iPad showed good speed, but on the PC, downloads were about 35Mbs, but uploads 0.5Mbs.  A few suggested tweaks made no difference.  I tried to update the Ethernet drivers, and was told they are up to date, dated 2012.  The PC is a 2 year old Dell, and I then tried to disable the Ethernet, and use the built in WiFi.  Internet speeds were back to normal, but obviously this is not the way top transfer TB files in the office.  My suspicion was then the device drivers, rather than the basic Windows 10 software.  I went to the Realtek website and found that for my board, RTL8168 there is a Win10 Auto installation package, dated October 2015.  I downloaded this and it now works correctly, ie fast.  I am sorry that the auto driver update did not find this driver.

I may be the last man in the world to stick with Windows Internet Explorer, rather than Firefox, Chrome etc.  IE11 however seems very flawed, and much to my surprise, Microsoft Edge works well.  This has now become my default explorer.

Saturday, October 10, 2015

MXF video

MXF is a video encapsulation program, and as in many programs, the video is stored sequentially on the camera memory chip.  I have a problem with an exFAT memory chip froma Sony PXW-X70 camera XAVC which had been partially formatted.  All fragmentation information was lost.

The solution was to add a new wizard function to CnW.  This scans the memory chip and isolates key types of cluster, headers, indexes, and video data and trailer.  Once found, these XAVC video files are reconstructed in the correct logical order and video will play.

This is another growing example of video that cannot be recovered by standard data carving methods.  Unfortunately many companies may claim to process such files because they are probably tested by writing files sequentially to a memory chip, and saying that recovery is possible.  True, but this is not the way the camera writes it's data 

Sanyo E1 Video camera

Most months I come across a new video variation.  One of the latest is a Sanyo E1.  The video is 'standard' MP4 but the physical recording is non standard.  The customer had spent a few years trying to get the video recovered with no success.  The problem is that the moov atom is both fragmented, and out of sequence, and interleaved with the start of the mdat atom.  No program that just does data carving could ever recover this type of file.  Once the correct sequence was determined recovery was possible.  The initial attempts found video, but no sound, but eventually this was resolved. 

CnW Recovery V4.99 now supports recovery for many such videos, though a few tweaks are still required for longer files.  and run the MP4 wizard.

Website URL

My new GoPro Recovery program is working well, but sales are currently limited.  Most sales appear to be UK based, and USA, where the big market is, is still limited.  One reason I feel for this is because the website  is a .uk website.  I have now tried a new website,  in the hope that having set my Google preference for world wide coverage, I will get more USA hits.  Time will tell.

An area I am also working on is to try and ensure the two websites are different enough in content so as not be classed as duplicate, even though they have started from the same base.

Sunday, August 2, 2015

Panasonic Lumix GH4 recovery

I have often written about recovery from video memory chips.  Everything I create a new solution, a new variation is found.  The latest one is from the Panasonic Lumix GH4 camera.

The video is fairly standard AVC  MP4 structure.  As is typical, the ftyp and moov are recorded in one section, while the mdat is in a different section.  In most cases these sections adjoin.  However, the Panasonic, in at least one case have split these sections to different areas of the memory chip.  This means there are series of ftyp-moov atoms, but after all ftyp-moov atoms, there are then a series of mdat atoms.  Each mdat starts on a cluster boundary so joining the correct moov with the correct mdat has involved analysing the header to see where frames start in the mdat.  Each mdat is then examined until a match is found.  A novel approach, but also one that normally means the atoms are saved sequentially.

The recovery routine has now been added to CnW V4.95

GoPro Recovery Released

The first version of GoPro recovery has now been released.  It is being sold at an introductory price of $9.50 for a life time licence and full support.  This is a basic version, but will recover deleted videos from all GoPro camera sD memory chips.

Future developments will include processing unfinalised files and lost video fragments.  The later may have useful forensic applications.

For download, go to

Thursday, July 2, 2015

GoPro Recovery Update

The new GoPro Recovery software is progressing well.  It now has the following features

Will recover accidently deleted files from
  • GoPro Hero
  • GoPro Hero 3  (Black and Silver)
  • GoPro Hero 4  (Black and Silver)
Files are saved and the log is populated

Thumbnails are shown for every video that is verified as valid.

The current free evaluation will expire on September 1st 2015.  Licenced copies will be available for purchase at the start of August with an introductory special offer price.

Visit  for up to date details

Wednesday, June 10, 2015

GoPro Recovery Software - dedicated software

CnW have been supporting high quality recovery from the GoPro Camera.  In particular, it addresses the problem that most recovery program fail on, in that GoPro video files are complex and cannot be recovered with data carving.

CnW are now launching a new program, GoPro Recovery.  This is simple to use program that will just recover files from GoPro memory chips.  The program is still in early stages of development, but will support Hero3 and Hero 4 files with a good success rate, though the next stage will be nearly perfect.

The fully functional evaluation program (beta version) may be downloaded for free and will operate for about one month.  For details go to  It requires Windows 7/8/10 and only works with a memory chip, or memory image file.

New updates will be uploaded every few days.  Please try and it send us any feed back.

Full version will be launched this summer (2015)

Sunday, December 7, 2014

3.5" floppy disks and Word 6

I thought I had seen the last of 3.5" floppies until last week.  A customer turned up on my door step with 4 3.5" floppies, and wanted back documents she had written 20 years ago.

Fortunately I still have a few PCs with internal floppy drives (on XP boxes).  These I could see were DS-DD 720K rather than the normal 1.44MB disks.  The customer mentioned an Apricot system, very popular in the mid 80s, but not totally PC compatible.  On placing the disk in the PC, it suggested a reformat, as the disk was not recognised.  Fortunately on examining the sectors it was clear that the disk was still sound, with not obvious sector errors.

Trying to read it was not an instant success.  It was FAT12, but as there were no subdirectories the CnW automatic parameters program failed.  The next stage was top fire up an old copy of InterMedia for Windows.  Being a 16 bit program, this had to be on an XP box.  InterMedia for Windows has a routine called MS Auto that will try and determine disk parameters automatically for floppy disks, and with this the directory was soon visible.

I could now read the files, a mixture of .DOC and associated .BAK files.  However, to be expected, trying to open the .DOC file indicated it was from a Word 6  system.  Word 2003 is meant to have a filter to read this, but it would not work (mswrd632.wpc) so the files could be seen, but with a lot of binary code included.  I am not sure that Word 2003 is supported anymore, being an XP era program.

The next stage was to use InterMedia for Windows again that has protocol handlers for hundreds of old word processing packages, including Word (several versions).  This then  produced nice clean text, with embedded  commands (IMIC2) for some formatting.  These commands were then stripped out using translation tables to generate a simple text file that could be read on a modern PC.

InterMedia for Windows now looks like an old program - it is over 10 years since I last updated it, but it did produce a nice clean result.

Friday, November 14, 2014

Windows 10

I have an oldish PC, bought originally to run Vista.  This I then updated to 7 and 8.  This week I download the Microsoft Technical Preview, otherwise to be called Windows 10.

The installation required DVD to be burnt and then the occasion button pressing while loading.

The final loaded PC was almost exactly as I had it setup in Windows 8.  All programs ran, in particular CnW Recovery.  ie the upgrade could not have been more painless - although it is reported that come April, it might all stop working.  It even worked as a remote desk top with no additional attention.

I cannot comment on performance as the PC is an old Core Duo but it does have 8GB RAM.  I am currently using it on video file recovery testing and after a few days it has just worked.

The famous start menu is back, with a few tweaks, and a bit of the metro style start at the same time.

The only downside is that Norton 360 does not work, so the system is protected by the free Microsoft Defender.

So far, so good.