[MEncoder-users] Need help fixing/decoding a recovered h264 file

[Marc MERLIN]

On Fri, Feb 26, 2010 at 08:07:50PM +0100, Reimar Döffinger wrote:
> To simplify my last mail: going by all the information you gave, testdisk
> should not have the slightest problem restoring your file.

To answer your later question, it's a 2GB SD card with FAT (not FAT32)

Unfortunately it does. I tried testdisk first, but what happened was
1) I moved 2 videos off the card (which deleted them)
2) I then took 3 pictures on the card
3) later on my 2nd video got clobbered on my hard drive

I know the 2nd video blocks are still on the card, but apparently not in
contiguous order anymore.

Testdisk only lets me undelete my 3 pictures, not the videos that are not in
the directory entry anymore. The only way to get the 2nd video back is to
scan the raw blocks and put them back together.

> If it can't, find some other tool that can analyze FAT cluster chains,
> the first cluster of your file obviously has not been overwritten, thus
> at the very least the FAT still contains the data where the second cluster
> of your file is.
> PhotoRec just is the wrong tool for large data stored on FAT.

testdisk documentation does say that it's the one of the 2 tools that can
restore a file by scanning disk blocks if the file entry is gone.
I looked at the testdisk documentation again and it does not seem like the
right tool
http://www.cgsecurity.org/wiki/TestDisk:_undelete_file_for_FAT
(I also just tried testdisk 6.12-WIP, and didn't see any extra scan/undelete
option)

On Fri, Feb 26, 2010 at 09:33:03PM +0100, Reimar Döffinger wrote:
> > > Well, the obvious question is: have you tried those undelete tools for FAT?
> > > FAT contains a lot of redundant information and thus usually allows for rather
> > > good recovery of "lost" data.
> > 
> > I tried a few,
> 
> Which?
 
testdisk, photorec, photorecovery (windows), and cardrecovery (windows).
photorecovery doesn't know how to handle MOV/AVC1 so it misses them
cardrecovery did try to recover my MOV but got the wrong size and it won't
play.
Christophe is working on seeing if he can make photorecovery work in that
case, but I think he's stalled.

If you have a better tool and you'd be willing to give it a shot, the
/dev/mmcblk0p1 image is here:
ftp://ftp.merlins.org/sd
(you'd have to put it on a 2GB sd card that's already partition and dd the
file over /dev/mmcblk0p1)
If you can somehow restore the video from there, I would be happy to make a
donation for your time and/or the software you had to pay for (assuming it's
commercial. I looked at a couple, but didn't really want to keep buying
$40-$60 recovery software when I don't know they'll work here).
 
> We are talking about FAT, right? FAT has no mechanisms to avoid fragmentation,
> and for FAT32 the directories themselves are ordinary files, so it is never
> very likely they are in order.
 
I thought that on an empty filesystem, FAT would just allocate blocks in
order, since why not? (and I do delete all the files before each recording,
so the filesystem should be empty).
 
> Not it is trivial for FAT. For every cluster of the file that was not overwritten the
> FAT still contains the next cluster address.

Oh, good. I'm not sure why photorecovery is having issues recovering then.

> However if you didn't even write to the card since you deleted the file you would
> just have had to replace one single byte (the first byte of the file name) to
> "undelete" it.

Yes, I know about ?ILE.MOV, but unfortunately at least that part isn't
possible anymore, I did write 3 files on the card (about 10MB's worth which
should only have overwritten the first 500MB video and not the second 500MB
video I'm trying to get back).

Marc
-- 
"A mouse is a device used to point at the xterm you want to type in" - A.S.R.
Microsoft is to operating systems & security ....
                                      .... what McDonalds is to gourmet cooking
Home page: http://marc.merlins.org/