Jump to content

Using Recuva Professional to access previously deleted videos


ericlane679

Recommended Posts

I just tried this software to recover videos from a go pro that were stored on a micro SD.  I was only able to partially recover the mp4's but they won't play which makes them useless.  I tried opening them with windows media player as well as quick time on my phone. Any help or suggestions would be very much appreciated.  Screen grabs attached of my progress. 

 

  

post-76421-0-66640900-1465842885_thumb.png

post-76421-0-38550000-1465842889_thumb.png

post-76421-0-56150700-1465842893_thumb.png

Link to comment
Share on other sites

  • Moderators

The file names begin with an underscore which indicates that the file system is FAT32 and they have been legitimately deleted.

 

On FAT32 the directory entry for each file holds the offset in the FAT of the first cluster of the file. On deletion the first two bytes of this address is set to zero, so any cluster address that is larger than 65,535 will be corrupted, and will now point to a cluster far closer to the start of the FAT. This cluster (and possibly many if not all of the clusters under 65,535) is likely to be occupied by another file or files, which is why you are getting the message 'This file is overwritten by...'. Recover will retrieve the clusters it finds at the corrupted address, and it's no surprise that they are not valid files.

 

The effect is that once you have filled the first 65,535 clusters - just a quarter of a gb with 4096-byte clusters - any file subsequently created will not have a valid start cluster address if it is deleted. This is a characteristic of FAT32 and no software can resurrect the corrupt addresses. If you switch to Advanced mode in Recuva and look at the Info pane for the files you should see a start cluster number of under 65,535.

 

If you run a deep scan you should find the first fragment of the files, with the mp4 extension but no file names. The drawback is that only the first fragment can be found this way, as subsequent fragments are not identifiable. So not very good news.

Link to comment
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
×
×
  • Create New...

Important Information

By using this site, you agree to our Terms of Use.