Klennet Storage Software

Recovery of fragmneted MP4 and QuickTime video in Klennet Carver

Recovery of fragmented video files is indispensable capability to have in file carving. In modern mobile phones, video cameras, and dash cameras often more than the half of video files are fragmented, defying traditional data recovery and requiring specialized carving algorithms to recover.

MP4 and QuickTime (MOV) videos, by far the most common video file types in use, share a common format, consisting of what is called atoms. Atom is a part of file, defined by atom name (identifying type of data the atom contains) and length. Atom may contain payload data, other atoms, or a combination of both. We will only be concerned with top-level atoms, of which three are important.

  1. ftyp atom, which defines the “file type”, a variation of the format, would it be QuickTime movie, or MP4 video, or MP4 audio, and what is the exact version of it.
  2. moov atom, consisting in turn of multiple atoms, contains various decoder settings and metadata and most importantly, contains a frame map for the mdat atom. Normally, a video decoder cannot seek, or move, to any arbitrary position in the video stream and restart or continue video decoding. The decoder can only seek to a set of defined points, called key frames. So, to allow player application to seek inside the video file, the moov atom contains among other things a list defining which key frame offset inside the mdat atom of the file corresponds to which time point in a video.
  3. mdat atom, containing a video stream. The video stream consists of frames going one after other without (at least in general case) any distinguishing marks between them.

ftyp is always first atom in the file, followed by moov and mdat in any order.

The file is often split into several fragments, not just two fragments, but often five or more. Parts of the file may be overwritten, even if the file is not fragmented, and some fragments may be missing in a fragmented file.

Klennet Carver reassembles these fragments to produce a viewable video whenever possible. Overwritten parts can’t be recovered, and this causes loss of video up to the closest next keyframe. At the keyframe, video decoder synchronizes with the stream again and playback continues normally. Sometimes, Klennet Carver fails to determine fragment boundaries properly. While this causes distortion of a recovered video for a brief period of time, the effect is usually negligible.

If ftyp atom is missing, or if fragmentation is bad, it may be impossible to determine if the order of atoms is ftyp - moov - mdat or ftyp - mdat - moov. If these cases, ftyp atom is rebuilt and the file is regenerated assuming ftyp - mdat- moov atom order.

In all cases, missing parts of the file are filled with zeros. The total size of all recovered files may well be larger then the capacity of the source media. This happens when there are many video files on the media but only small part is available for each file. Each file is padded with zeros in places where content is missing and this padding may account for significant amount of data.

There are many different video encoding algorithms, called codecs (short for coder-decoder). The recovery implemented in Klennet Carver requires some understanding of the codec used to encode the particular video. If your videos are not recovered, make sure to put forth a support request so that I can look into the case and make any adjustments required to accommodate that specific codec your camera is using.