1

A friend decided to clean up his external hard drive but found out he deleted media he didn't make any backups of. A company has recovered a lot of files but they were all broken.

He asked me if I could repair the broken video and image files. The files would not play with any software on Windows or Mac (I tried the obvious ones, VLC, MPCHC, QT and WMP). After trying lots of freeware to repair the files (with no success) I used the paid service of aeroquartet.com which could recover most of the video files and turn them into playable ones.

When watching the files, a lot of the files appear to have the same content. They contain the majority of frames that also appear in other files but also frames of other videos. My question is how this is possible.

Did the file recovery recover files that don't exist? They do have incremental names like _VID0002.MPG, _VID0003.MPG, _VID0006.MPG etc, but the content in those files does not appear to be chronological.

  • What was the file system on the drive? NTFS? ExFAT? – Andrea Lazzarotto Jun 19 '16 at 16:51
3

My question is how this is possible.

Large files are likely to be non-contiguous on disk. This just means that the data is scattered in several places, not all together.

A consequence is that when a file is deleted, another file can be written to an area of disk that used to be in the middle of the deleted file.

If you then attempt to recover the deleted file, depending on the details of the internals of how the file system allocates and tracks space, you can recover overwritten fragments as well as intact fragments.

This produces files that are corrupted. They are no longer valid video files.

It can be possible to examine the files at a detailed level and painstakingly correct the errors but this probably means skipping over or cutting out totally incomprehensible parts and synthesizing some new parts to tie the intact fragments back together.

Did the file recovery recover files that don't exist?

No, it did its best to reassemble the shattered remains into something that is structurally sound. Like rebuilding a Roman temple from the broken fragments found under the soil several millennia after its destruction. This is hard if many fragments have been lost and you don't know how big the original was or how many pillars and of what height. You might only have enough pieces to make something much smaller and incomplete. If the partial remains of the ruins of several buildings are all mixed together it may be hard to work out how many buildings existed originally and which pieces belong to which buildings.

the content in those files does not appear to be chronological.

Sometimes it is probably hard, or impossible, to work out the order in which the fragments were originally placed. At least not without significant human intervention ($$$) and perhaps not without some knowledge of the context (it was a video of a wedding at a church in fooville followed by shots of the reception in barville)

a lot of the files appear to have the same content.

Sometimes a filesystem can, in error, get files cross-threaded. Meaning that the list of chunks for two or more files all contain a reference to the same chunk. This is probably especially likely to happen when resurrecting deleted files because much of the file metadata has been lost.

Sometimes, when files are edited, the process creates many intermediate files that are created and deleted as needed. This strews unallocated disk space with multiple copies of fragments of the data. A later recovery process may have difficulty working out which fragments are part of files you want and which fragments are just detritus from editing, they all look similar.

  • Great answer, thanks. It's a bit like I suspected. About the $$$ (€€€): you're right there too. He did check if there was a company and they would charge something over €1000. Don't know their name, but I some sort of a result now for €114. Perhaps a specialised company will do much better, but this will do for now. – ar34z Jun 17 '16 at 11:15
  • «it did its best to reassemble the shattered remains» Absolutely NOT their best if the only thing they did was to use a data carving tool (there are plenty of free tools for this) on the drive. – Andrea Lazzarotto Jun 19 '16 at 16:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.