Home

3GP/MP4 Files

3GP/MP4 are all part of the Quick Time file structure.  A Quick Time file has three main elements

• ftyp - the file header
• moov - file meta data
• mdat - the file video and audio data

Logically, the main file can be either of the two sequences below

       

       ftyp-mdat-moov  or ftyp-moov-mdat

The format is very common with current disk or memory chip video recorders (rather than min dvd recorders).  Most recorders use FAT32 as the file system which means when deleted, the files may be fragmented.

Why are 3GP/MP4 files fragmented?

The two main reasons why the files are fragmented either because of general FAT32 fragmentation, or due to the way they have been recorded.  When an individual file, or group of fils are deleted on FAT32 there is an area of unallocated data space.  New files will be written to this space but if larger than the first gap, the file will be split into two or more fragments.  The chaining is contraolled by the FAT (file allocation table) and so invisible to the user.  When files are deleted, so is the relevant allocation information in the FAT, and so recovery from data carving is not immediately possible.

The second reason for fragmentation is rather more obscure.  When a  video is recorded the mdat segment takes most space, but is continuously indexed by the moov segement.  Until recording is finished, the size of the moov and mdat segments is unknown.  The mdat segement is large and so can not be cached in camera memory and must bewritten directly to the disk.  The moov segment contains many atoms that have pointers to the mdat, and these pointers are often absolute values from the start of the main file.  Different camera manufacturers have devised different approaches to the problem.  These are outlined below and automatically deteceted by CnW Recovery software to reconstruct the fragmented files

mdat-ftyp-moov

In this format the camera records the mdat straight to the disk, and when finalised the header and moov segments are added to to the next cluster after the mdat.  By manipulating the FAT, logically the file will look like ftyp-mov-mdat.  If a standard program tries data carving, then the incorrect ftyp-moov will be applied to the following mdat and the video will not play.  CnW data carving and fragment processing takes care of this issue.

ftype - preallocated moov - mdat - trak

In the above approach an attempt to pre-allocate the moov area is used.  The moov area is allocated an area at the start of the file and the large atoms, such as 'stsz' all start on cluster boundaries.  These atoms are then padded with a 'free' so that they remain cluster sized.  For some reason, on one example seen, the audio 'trak' atom is stored after the full mdat segment.

General defragmentation recovery

The examples above show fragmentation in a known pattern.  General defragmentation show no such patterns and processing is more complex.  It falls into two main stages withn the assumption that all data is present.

Recovery when there is no moov segment

If the camera is switched off before recording has finished, or maybe dropped or battery removed then cases can exist where there is a mdat segment but no moov segement.  CnW has a solution for this that will work with certain file types (but currently not all).  The technique used is to use a known good file and extract moov fragment as a template.  This will give fixed values for the camera and then the variables, eg stsz tables are reconstructed.

This technique does require knowledge of each type of codec used.  For this reason, not every MP4 can currently be recovered this way, but the list is growing.  CnW are happy to add support for anyone who has a failed file, and can provide complete file from the same camera.