Im using WinHex to recover files from disk. Its mostly very good except for MPEG files.It seems to truncate almost every single one of them into files of various sizes, almost always less than 1MB.
It detects the start of file synccode of
0x000001BA but looking through the hex offsets for the end of the file, the
EOF markers it has chosen seem totally random. There are a lot ending in
0000 but then my understanding of the format is that an MPEG stream can use null bit stuffing to ensure strict adherence to an overall bit rate... so I wouldn't expect 00000 to be the end of the file marker for that reason.
Then there are others that end with random byte codes:
What I'm looking for and can't find is either the "proper"
EOF marker codes (not sure why WinHex doesn't use them) or alternatively some kind of content-length header fields a'la HTTP that I can use to infer