Recovery of video from a hard drive or memory chip
On the face of it, recovery of deleted file should be the same where ever they were deleted. However the recovery of video files from a hard drive, or internal memory chip is different. The reason is video cameras store files on the internal memory chip in a different physical order to the logical order. Another reason that the cluster size of the camera memory chip is often different to that of the computer hard drive. Many recovery programs will work with deleted files from a hard drive, but not from a memory chip. CnW support both modes of operation. Download the demo to try.
Hard drive recovery
When a file is copied to a hard drive, it is typically stored in a single sequential run. The exception might be for a long file, when copied to the hard drive it may end up in a few fragments. Typically, but not always, the fragments will be in sequence. For data recovery on a FAT drive, it can be assumed that the video will still be sequential, and often good results will be achieved. NTFS recovery is often easier and can handle some fragmentation as the data run information is retained after the file has been deleted.
SD card video recovery, CF card video recovery
Sometimes the same procedures will work for both hard drive, and memory recovery. If a file has been copied to a memory chip, it will probably be sequential and so work in the same way as a hard drive. If the memory chip is straight from the camera, the file may not be sequential. Typical examples are below.
MP4/MOV/3GP files
The import areas of these files are the data area, (mdat) and the meta data, with all the pointers (moov). The length of either section (or atom) is unknown when recording starts, it could be a 2 second video, or 10 minutes. For this reason, the large mdat atom is written straight to the memory device, while the smaller moov atom is stored in memory. When the video is finished (finalised) the moov atom is written to the memory chip, and the FAT manipulated to make this section of the file to be logically before the mdat section. Thus the file is physically fragmented.
A secondary problem is that some cameras can record still photos (JPEGs) at the same time as the video. This means the video stream is fragmented with these photos.
The most complex chip structure is probably from the GoPro camera. This again stored the logical start, physically at the end of the data, but also multiplexes high and low resolution video as recorded. A stream could be such as
<Hi><lo><Hi><Lo><Hi><Lo.<High start><Low start>
The number of fragments can be in the hundreds
AVI files
AVI files are similar to the MP4 files. The data is often stored while being recorded, and then the header, (RIFF) is added at the physical end of the file, but logically at the start.
AVCHD/MTS video
These video have different issues to AVI and MP4 type videos. The meta data is stored in different files, but thesetend to be written near the end of a recording. Thus physically, the storage may be MTS, then CPI, then MPL then rest of MTS.