I have written several times about the way that 3GP and MP4 files are physically stored on a FAT32 chip, and the file allocation table is set so that the logical structure is 'normal'. The issue that the mdat atom is large, and the camera does not know how large until the filming has finished. This is therefore written on the fly, and at the end of recording, the ftyp and moov atoms can be created and saved. Logically, the ftyp is always first, and very often the moov atom is second.
When the file is deleted in FAT32 all this sequence information is lost so the file has to be reconstructed by in effect moving the ftyp and moov before the previous mdat fragment. This is something the enhanced data carving in CnW recovery software does when 'process fragments' is selected. Straight data carving will not touch such recovery.
However, as ever, a new variation has been found recently. One Samsung camera (and there may well be more) allows the user to take still photos at the same time as the video. As might be expected, the video stream now has MP4 data, and then clusters of photo data embedded in the stream. Just one more issue to be resolved while doing data recovery.
The new CnW 3GP/MP4 data recovery wizard is being designed to take care of this, and was released in October 2012, with regukar updates
No comments:
Post a Comment