Fragmentation of video files

Last week I got two cases of fragmented videos. One case was the memory card from a photo camera, and the other was from a dash camera. Card sizes were 4 GB and 16 GB. Both cases involved deleted files and, all in all, were pretty similar. The dash camera used some codec I hadn't seen before, so the case required some adjustments. Klennet Carver requires certain calibration for each codec and will, in most cases, reject even valid files if it encounters an unknown codec, thinking it is junk, not valid data. That by itself is not a very interesting story, but I was surprised by the amount of fragmentation.

The photo camera produced about 75% fragmented video files. In a dash cam case, every single video (there were about 90 files) was fragmented. For the image files, say JPEGs, we'll have like 10%, maybe 20% files fragmented, and then most of these will be in two or three fragments. The fragmentation of video files is so much worse. I had no reliable way to establish the exact number of fragments (the recovery process is not precise enough to use its output for the measurement). Fill, every single file was at least in two fragments.

Fragmentation levels like that completely prevent any use of traditional header-footer carving. While header-footer carving is perfectly feasible with image files, at a loss of typically 10% to 20% of images, it just does not work with videos.

This situation is much more common than one might expect. Most of the small-size, all-compatible data storage uses FAT. On FAT, file location data is zeroed out once the file is deleted, effectively reducing filesystem recovery to header-size carving, which does not work on fragmented files.

Therefore, if you are recovering deleted video files, nothing other than complex carving will work for you.

Filed under: File carving.

Created Thursday, November 9, 2017