Home

The GoPro camera is a very popular device for action video, including diving, parachuting, cycling and even on remote control helicopters.

The video is recorded on SD memory chips, and typically are 32GB FAT32, or 64GB exFAT.  The FAT32 and exFAT means that when deleted the exact location of each file fragment is lost.  For many systems, files are store sequentially so this is not a problem, but for GoPro, the camera records two streams of data at the same time, a high resolution video, and a low resolution video.  Hence, the files are always fragmented.

There are also differences between the Hero-3 and Hero-4.  

Looking a physical memory chip, a Hero-3 has the data in the sequence of

MDAT - FTYP (on a new cluster)-MOOV.  On the hard drive, the logical sequence is FTYP-MOOV-MDAT

Many so called data recovery programs try and associate the FTYP-MOOV data with the following MDAT, and not the previous one

GoPro Hero-4, Silver stores data slightly differently

       FTYP-MDAT-MOOV

This is the same as the logical structure, but the MDAT data is all fragmented.

A pattern that may be seen on both  type Hero for the MDAT could be as follows

<H><H><H><H><L><H><H><H><L><H><H><H><H><H><L><L><H>...

where <H>  is a cluster of high resolution video, and <L> is low resolution video.  The clusters are just a fixed size, and have relation to the start or end of a video frame.  It is from this 'mess' that CnW has to recover the video data in separate streams.

The basic GoPro Hero has a third layout - and does not normally store high and low resolution files interleaved.  This format is referred in CnW as M4_RVFR_FTPY_MOOV_FREE_MDAT.  The RVFR marks the start of the video data which is physically stored first.  The actual 'mdat' marker is stored after the standard ftyp and moov atoms.

The CnW approach is to use the MP4/GoPro Wizard function.  This scans the complete device and looks for strings of data that maybe starts of video and audio frames.  It also looks for possible MDAT, FTYP and MOOV strings (known as atoms).  The next stage is to reconstruct the files based on information stored with the MOOV atom.  There are several possible interactions for the reconstruction, but when a video has been recovered correctly, a thumbnail image will be displayed.  This works in demo mode to give confidence that all will work.

Other software packages

CnW does not like to be negative about competing software packages, but when it comes to video recovery there are many (big name) programs that indicate they have the video file, but when a user comes to view it, the screen just remains blank. CnW normally recovers these files, and if there is ever a problem, will look at the video memory chip until the data can be recovered.  CnW has an SFTP server to allow for large file transfers.