Contiguous, Fragmented, and Damaged files in Klennet Carver

Klennet Carver categorizes recovered files into three groups - Contiguous, Fragmented, and Damaged.

Category definitions

Contiguous files are just that, stored contiguously on the media. These files are valid and do not require complicated recovery. Non-contiguous files, which are stored in several non-adjacent fragments on media, require a complicated reconstruction process to find all the fragments and join them as appropriate. If the recovery algorithm determines that the resulting file is valid, it puts the file into the Fragmented category. If the recovery algorithm fails to find all the file fragments, position them properly, or ensure the file is valid, it puts the file into the Damaged category.

Understanding results

Contiguous files are good.

Fragmented files are almost always good. File validation algorithms are not perfect, but they are pretty good, with less than a one-in-a-hundred average error rate.

Damaged files need to be reviewed by hand.

Image files, such as JPEG, may still be usable, for example after cropping. An image file that has a narrow swath at the bottom damaged may be useful, but the algorithm still declares the file damaged.

Video files (MP4) will be classified as damaged even if a single frame is missing, which often happens when fragment boundaries cannot be precisely established I recommend you review all video files to see if they are badly damaged, can be used in parts, or are usable as a whole. This especially applies to videos coming from dash camera memory, when even several frames can be useful. Also, with damaged videos, always try different players. VLC player and MPC-HC will often work where Windows built-in player does not.

Filed under: File carving.

Created Wednesday, May 29, 2019