Klennet Carver vs. partially overwritten files
When files are fragmented, Klennet Carver can reassemble them from the fragments to their original condition,
or at least close enough to their original condition.
What if one or several fragments are overwritten?
You cannot recover overwritten data, but what about the remaining fragments?
First, if an image file header is overwritten,
Klennet Carver cannot recover the file, for there is no starting point to work with.
This is a rare situation, though.
File headers are a thousand times smaller than a complete file,
and the probability of a header being overwritten is quite low.
If a video file header is overwritten, header stealing is used to reconstruct the header if at least one valid header is available.
This works well on memory cards, where all videos are filmed with the same settings.
So, what happens depends on file type and on header availability:
- For image files with valid headers,
Klennet Carver recovers the file until the first overwritten fragment, and then the recovery stops.
Visually, the top part of the resulting image will be fine,
followed possibly by a short burst of random colors, and the bottom part will be missing.
-
Image files without headers are not recoverable by Klennet Carver.
- For video files with valid headers, Klennet Carver recovers the file until it encounters the overwritten fragment.
Then, a stream of zeros or whatever happens to be on the media goes into the file until the next
valid (non-overwritten) fragment.
After the end of the overwritten fragment, recovery continues producing remaining valid data.
The process is repeated if there are multiple overwritten fragments.
Visually, this results in a video having dropouts or visually distorted fragments.
Depending on the amount of data overwritten, quite long fragments may be missing.
Still, as long as there is more data on the media,
the video will continue after the overwritten fragment ends.
- For video files with headers damaged,
Klennet Carver recovers contiguous sequences of video and audio frames on the media
and stores each contiguous sequence in a separate file.
Filed under: File carving.
Created Wednesday, January 3, 2018
Updated 19 May 2018