| 12 Mar 2008 01:51 am |
Samurai1974 Guest | I work at a jail, and part of my duties include working with security videos. In transferring the videos to a memory stick, I inadvertently deleted them. Then I resurrected them using Recuva. Now they won’t play. Does anyone have any suggestions on how I might be able to fix... whatever it is that went wrong? Anything else I’ve Recuva’d works fine... just not these files.
| |
| | 12 Mar 2008 07:42 am |
Regular Rep: 3 Joined: 20 Nov 2004 Posts: 1,239 | Here’s a little about how undelete utilities work (at least on FAT and FAT32 systems). When you delete a file, you don’t really wipe it off. You only delete the entry in the table of contents (directory entry) [more specifically the first character of the file name is deleted], and mark its space as free for use (in the file allocation tables). So long as that space is not overwritten with new data, the data still sits there. The directory entry has everything about the file (file name, date, where it starts on the disk, etc... - except the first character). Normal DOS/Windows can’t read such entries, but undelete untilities can.
There’s two caveats with this.
1. The data must not be overwritten. If you write data over (even portions) of the file, it may be gone. That’s why people say pull the plug when you accidentally delete a life-important file. Modern operating systems do a lot of read and write operations to the disk without your knowing it (caching, loading/unloading modules, etc.). By pulling the plug you make sure that background activity does not overwrite your data. Also it’s often best to undelete from a separate system - meaning you only READ the drive/media where the file was deleted from - usually the best way would be to hook up your disk as a slave partition and boot from another hard disk for example.
2. Fragmentation is your biggest enemy. Data on your hard disk is organized into “cells” (sectors/clusters). It’d be nice if everything were contiguous (in one chunk), but in practice, you can have the start of a file in one place, another chunk somewhere else, and the end yet somewhere else. File sharing programs are notorious for fragmenting files. (If you run the defragment utility in Windows 2000/XP, and choose analyze, then view the report, you’ll see many files have thousands of fragments). Where this comes into play is as follows: The directory entry only has the file size and where it starts. So the undelete program goes to that sector, and starts reading so many (unused) sectors till the full file size is reached (skipping over any space used by other files). Now you see how fragmented files have little chance of recovery. That’s why people recommend you defragment often. Makes data recovery easier.
There are advanced techniques for attempting recovery of fragmented files. It’s still ongoing research (google for data carving). Basically it tries to assembles chunks of data in an attempt to reconstitute the original file. As you can imagine the runtime of doing this would be of factorial/exponential complexity. I don’t believe there are automated tools that can do this very successfully yet. The most successful ways seem to be doing it by hand and knowing a LOT about the internals of the file format (at the byte level).
Now for the practical part of things. You want to recover an AVI, but you’re not sure how much was salvaged or if it was successful. The first thing to try would be to feed the file into gspot. Is the file even recognized as an AVI? If yes, the file header may still be intact. Usually if the file length is incorrect, you may be able to play the file with Media Player Classic or avipreview. If those fail, use VirtualDub, the premier tool for working with AVI files. Click file, open. Select the file to open (don’t double click it). At the bottom check “ask for extended options after this dialog”. Check “re-derive keyframe flags” and “open in avifile compatibility mode”.
If the file is not recognized as an AVI, that means the header was corrupt. Recovery may be difficult, but not unfeasible if the rest of the file is still intact. I wrote an extensive post on doing this here http://www.moviecodec.com/topics/32298p1.html. Basically you’ll need to obtain, or produce another video with similar characteristics, then you’ll attempt to attach its header to your unplayable file, and see if you can play it. Other relevant posts: http://www.moviecodec.com/topics/39277p1.html and http://www.moviecodec.com/topics/8907p1.html
Get back to this thread for more assistance.
Last edited 12 Mar 2008 07:45 am by anonymous | | | 12 Mar 2008 07:47 am |
Regular Rep: 3Joined: 20 Nov 2004 Posts: 1,239 | Oh yeah, and if you’ve got the cash, and this is truly important data, just call a data recovery company. They charge a lot, but they can often work miracles.
Last edited 12 Mar 2008 07:47 am by anonymous | | | 15 Mar 2008 03:33 pm |
Samurai1974 Guest | Thanks for all the useful knowledge, anonymous! I’ll give it a shot right away!
Ok, tried gspot, and it said that both the File and Mime Types are “Unknown."
When I used AVIMedic, it told me:
Real Data: 100%
Fake Data: 0%
...so I’m not sure if this means the file is still intact, and the header is corrupt or not...? I’m interested in learning how to perform a head transplant surgery on an avi file tho, so I’ll read through your other thread and see where it gets me.
Thanks again!
| | | 27 Mar 2008 12:40 am |
Samurai1974 Guest | WOOT! You’re awesome, anonymous! It took a couple tries, but the head transplant/virtualdub technique worked wonderfully! THANKS!
| |
|
|
Post Reply |
Moderated by: Admins, Superusers |
»
Video Codecs
» Need to fix damaged one-of-a-kind .avi files
First ]
