Fragmented Files

Previous Topic  Next Topic 

Home



CnW has several tools to assist with fragmented files when data carving.  Some are part of the standard data carving, and others are special wizard function, mainly for video recovery.


A common problem with Raw recovery is that files are may have been fragmented. On a camera memory chip this is often due to photos or videos being deleted on a one by one basis, rather than a complete clearing or reformatting of the chip. When files are deleted separately, the space they used to occupy is used on new photos.  Each photo is a different size, so sometimes a new photo will occupy multiple gaps, and is a fragmented file.  For normal reading, the file allocation table (FAT) takes care of this fragmentation and so it is not a problem.



Raw recovery of a file is necessary when the FAT, or directory information is missing or corrupted.  On camera memory chips, it can also be because all files have been shifted a few sectors, normally due to a software glitch somewhere.


To enable this option, you need to check the boxes Split on possible file starts  an Process fragments.  The routine is currently fairly slow, and only works when file fragments are actually sequential on the drive / memory chip.  It works best on camera memory chips.  Once the Process Fragments has been checked, a normal recovery of files is done, followed by automatic fragment processing. The process can be cancelled at any time.


There will be times when fragments of files will exist, but certain fragments have been overwritten.  These images are impossible to recover.  The aim of CnW Recovery, is to recover files that could have been read if there was a valid FAT.  This will include files that have been deleted, but not overwritten.


Typical success rate of recovering  fragmented jpegs will be approx 25-75% of images that first appear incomplete, though it is media dependant. It should be noted that very few recovery programs attempt to recover fragmented files when operating in raw or image mode.


For fragmented video files the best solution is to use one of the wizard functions, ie 3GP/MP4 or AVCHD.  These are optimised for complex recovery of deleted disks