Home

When the Process Fragments option is enabled, once the disk has been scanned, the option box below will be displayed. This will run automatic data carving routines.

The box indicates the number and type of files that could be processed.  ie it will try and determine the location of each fragment of the file, and reconstruct the file.  This process has a variable success rate, and can be slow, but will often reconstruct files that have otherwise been totally lost.

To assist in this operation there are two very critical values that need to be set which indicate the original size and location of clusters on the disk.  See the section on disk clusters for more details.  The example above is from a  small memory stick, and so a cluster size of 4 has been detected.  For most current hard drives, the most common cluster size is 32 or 64 ie 16K or 32K.

The option box above does have a link to the log which can be viewed to help assess the correct cluster sizes.  On a small disk the calculation of cluster size and offset is often correct.  On a large disk, and in particular one that has been heavily used, it is common to require manual setting of the cluster sizes.  It is often very useful to examine the file starts of the files to be processed, such as JPEGs.  If all such files always start with the same sector offset, and multiple of increment sizes, then this is the best value to use.

JPEG Options

JPEG fragmentation can be complex, and so there are two additional options to assist with such files.  The rety count and contrast value.  There is no correct setting for these values, and sometimes trial and error will be required.  The JPEG routine works by searching for a possible cluster that contains compressed data.  This is then appended to the current partial photo and the result tested to see if this is still a valid partial photo.  Each one of these is a retry value.  The more retries, the chance of recovery improves, but the process becomes slower.  As not all photos can be recovered, as the fragments may no longer exist it is important to have a cut off point of possible clusters.  The default value is about 2,000 tries. 

Once a cluster has been appended to a partial photo, tests are run to see if the photo is still valid by looking for a jump in the image.  Visually this is easy to see when the bottom of the photo does not match the top.  CnW works on the same principle but as a help, the contrast of the photo can be added.  For images with a very low contrast (pastel colours etc) the routine will look for a very close match between sections.  For photos with lots of contrast and images, a higher level may be required.  If the contrast level is set too high, then a mis-match of photos may occur.  If the level is set too low, no matches will be be made.  This an area of continuous development so later program updates may manage better results.

AVI

AVI is a common video standard, often used on cameras (rather than camcorders).  Some cameras record the data in such a way that the video data is physically stored first, and then the header information is stored in sectors after the main data.  Normal carving will fail, but the CnW fragmentation routine will detect this and correct the data.

MP4/3GP

MP4 covers a whole range of similar files for video, including many used on mobile phones, and .mov files.  The defragmentation operates in sevral different ways depending on what data is available.  The files start with a 'ftyp' segment follwoed by a 'mdat' and 'moov' segement.  However, the order of the segments is not fixed, and so may be

       ftyp-mdat-moov  or ftyp-moov-mdat

The mdat segment contains the video data, and the moov segemnt all the control data and meta data.

A file will work with a partial mdat, but must have a complete moov.  The moov segment contains many pointers that are used to try and select the correct fragment from possible mdat clusters.  In a similar way, a moov fragment can be discovered and added to the file, with padding as required to ensure it is in the correct location.  Development is underway to create missing moov segements when totally missing.  For more details on 3GP processing, click here.

AVCHD and MTS

AVCHD is a popular high definition video format used with many new video devices.  The data files are .MTS.  Such files can be viewed using Windows 7 media player.  Typical data carving generates many MTS fragments, and this process will join many together.  However, for a camera memory chip, the prefered method is to use the dedicated wizard function

Word

Word processing is for pre Word 2007.  The sucess rate is limited when a device contains many word documents as it is very easy to obtain a false positive match.

Zip and DOCX

Current Office 2007 and later files are in effect ZIP files. These can now be processed and very high success rate has been achieved.