CnW Recovery software can recover many fragmented video files - a feature that very few data recovery packages even try. A deleted file is often fragmented, as many cameras actually create video files in a non sequential way. With FAT32, when the file is deleted, the sequence information is lost. Many data recovery packages just use data carving which finds sequential files, but can not recreate a fragmented file. The CnW 3GP/MP4/GoPro Wizard works to piece the sections together in sequence, and so recover the video. It will show thumbnails of valid files. CnW are not aware of other data recovery packages that do this level of reconstruction. The results range from very good to perfect.

Typical problems with Video camera files
● Deleted and fragments are not in sequence
● The data stream includes photos
● The file was never finalised, so no ftyp or moov atom on the memory device
● Memory chip removed while still recording

Why is CnW data recovery different?
Cell phones and mobile phones often produce video files that are based on the Quick time format, with extensions such as .3GP, .MP4, .MOV. As with any file, it is often possible for these file to be fragmented, and so if recovered with data carving, the file will not be valid. Many video cameras do not record the video sequentially in first place, so a deleted file is always fragmented. CnW defragmenting routine is an option within data carving - at the end of carving the files may be optionally defragmented. This option is part of even the most basic CnW package - because it is very important for successful recovery procedures.

A complete wizard function exists to process MP4 and 3GP files directly. It is optimised for memory chips and as part of it’s process will scan the complete chip for all parts of the video file. For some types of file it will even reconstruct elements of the video that have been erased, or never actually generated. The process can be slow - but the results are worth waiting for.

The details below give a technical description but for most users it is only necessary to run the program. New variations are being found and implemented all of the time - CnW are happy to accept new examples which will be implemented at no cost to the user. Download program here.

Typical data structure
The file structure is a series of 4 byte lengths followed by multiple 4 byte tags

00000000 00 00 00 18 66 74 79 70 - 33 67 70 35 00 00 03 00 ftyp3gp5

This type of file can be recognised by it’s header which started with a 4 byte length (normally 0x14, 0x18, 0x1c 0x20 or 0x24) followed by the string ‘ftyp’. The next 4 bytes gives the file type, such as 3gp, or mp42. There are about 30 recognised file types - CnW software will convert most to be MP4. See here for more details www.ftyps.com

The next logical tag is often a ‘moov’ atom which contains all data pointers etc. The structure is complex, and can allow for multiple tracks, typically one for video, and the other for audio

00000010 6D 70 34 32 6D 70 34 31 - 00 00 0B E6 6D 6F 6F 76 mp42mp41 æmoov

The final important tag is ‘mdat’ that contains all the video and sound data. Both sound and video can be compressed with one of several different codecs.

To reconstruct the files, the process is to analyze the moov segment and determine where each video frame starts. (This is based on information in the stco and stsz tags). On may files, the start of the video frame is fixed data, and so data cluster can be searched for and tested to make sure they contain a frame start (or starts) at a known offset within the cluster.

One significant problem with the above description is that many files are structured ftyp-moov-mdat, but other ones are ftyp-mdat-moov. In the later case, it is necessary to search for the matching moov fragment before reconstructing the mdat segment. With file fragmentation, the mdat is the one most likely to be fragmented as the moov segment is often less than 64K in length. Current success rate is between 0 and 100%, it all depends how fragmented the files are, and if the fragments do actually exist. We have also seen files where there is an incomplete mdat segment and no moov segment at all. Also, the length of the ftyp header is zero Current development plan working on reconstructing the a missing moov segment based on a sample from the same camera. Due to variations this development is on a per codec basis.

The original spec for MP4 file had a limit of 4GB size. This meant that all pointers were 32 bit, and even today this is suitable for the very large majority of files. For files greater than 4GB (maybe over 2 hours standard recording quality) there are changes to the tag and length structure. The 4 byte length is set to 1 (otherwise an illegal value) and the 8 byte length then follows the tag name. This would be the case for the mdat tag. The other change is the tag ‘stco’ points to the absolute location of frame starts - this 4 byte length is now swapped with ‘co64’ which is a 64 bit (8 byte) pointer.

How defragmenting works
The basic structure of the file is one of a four byte length, then a four byte tag, followed by data. This means that the location of the next tag is always known, although the type of tag can only be guessed. For the mdat segment, unfortunately there is only a single header and tag, but the moov segment may have a 100 or so tags. Typically the moov segment is short, but a complete one is essential to view a possibly incomplete mdat.

With defragmenting, it is assumed that data is always in original clusters, although the location of a cluster is not known. This mens that if a tag is expected at location 0x579421 in a file, and the cluster size is 0x4000, then clusters are tested to see if they have a suitable tag in location 0x1421 (ie 0x579421 modulus 0x4000). For many moov segments this will produce a good reliable result. Problems arise on long files, and sometimes the tag ‘stts’ and ‘stsz’ can be very long. If this sits over a fragment location, then different functions are required to analyse data and try and add the relevant pieces.

To reconstruct mdat segments is it largely essential to have a valid moov segment. From this, key elements can be found, eg frame starts, and matched with possible data clusters.

No moov segment
Video has been come across where the camera did not complete the file. ie it has a dummy ftyp header, a mdat section but no moov. The indication that this is an incomplete file, rather than just fragmented is that the ftyp header length is set as zero. CnW is currently working on creating a moov section to enable the mdat to be displayed.

Non sequential recording
An issue with several cameras is that the data is not recorded onto the memory chip sequentially. This is because the moov segment can only be created when the mdat segment is complete. The approach is to record the segments as ftyp-mdat-moov with each segment on a cluster boundary. The FAT on the disk can then be changed to that logically the data is ftyp-moov-mdat. However, when files are deleted, this modified FAT is lost and recovery difficult. Fortunately, CnW Recovery defragmentation software detects this pattern and corrects the files, allowing for very successful recovery.

User support
CnW is very keen to help ever customer. If a situation arises where recover has not been possible, CnW will assist. If necessary, the media, or a copy, can be sent to CnW who will extract the files. As this is both good customer support, and useful development, there is no extra charge for this work - except possible postage costs.
3GP is actually a simplified version of MPEG-4 (MP4). Video frames can either be MPEG-4 or H.264
Incomplete files - or not finalised

Occasionally a camera will not finalize a file. One example is when a camera is dropped and the battery drops out. This can leave a file with a complete mdat fragment, but no meta data (ie the moov fragment). This type of file cannot be viewed by normal packages. CnW is developing tools to overcome this problem. This involves recreating a moov fragment from scratch - often using a sample working file from the same camera. The success rate does depend on whether or not CnW software recognised the video encoding system used, ie the codec. CnW are always happy to undertake new examples as part of on going development - there is no charge for this.

GoPro Hero range
This camera is a potential nightmare to recover files from. It can operate in a mode where both high and low resolution videos are stored at the same time. Thus the videos are both interleaved. If not enough, there can also be thumbnail jpegs, and information text files inserted the the data stream. CnW Recovery software can achieve extremely good results recovering such files that have been deleted or corrupted from a FAT32 or exFAT memory chip.

Sony PMW150
The Sony is a format that records the data almost sequentially but has clusters inserted through out the file. CnW can recover this video correctly.

Other formats
Other typical video camera formats are AVCHD, that produces .MTS files and AVI that produces .AVI files.
● AVCHD are normally used in high resolution cameras, while AVI is typically used in slightly older compact cameras. CnW has wizard functions for both of these common formats
● AVCHD Wizard, .MTS files
● AVI Wizard