Fragmentation of video files

Last week I got two cases of fragmented videos. One case was the memory card from photo camera, the other the dash camera memory card. Card sizes were 4 GB and 16 GB. Both cases involved deleted files, and all in all were pretty similar. Dash camera used some codec I haven't seen before, and therefore the case required some adjustments. Klennet Carver requires certain calibration for each codec and will in most cases reject even valid files if unknown codec is encountered, thinking it is junk, not a valid data. That in itself is not very interesting, but I was surprised by the amount of fragmentation.

The camera produced like 75% fragmented video files. In a dash cam case, every single video (there were about 90 files) was fragmented. The image files, say JPEGs, we'll have like 10%, maybe 20% files fragmented, and then most of these will be in two or three fragments. Fragmentation of video files is much much worse. I had no reliable way to establish the exact number of fragments (the recovery process is not precise enough to use its output for the measurement), but every single file was at least in two fragments.

Fragmentation levels like that completely prevent any use of traditional header-footer carving. While header-footer carving is perfectly feasible with image files, at a loss of typically 10% to 20% images, it just does not work with videos.

This situation is much more common that one might expect. Most of the small-size, all-compatible media uses FAT. On FAT, file location data is zeroed out once the file is deleted, effectively reducing filesystem recovery to header-size carving, which does not work on fragmented files.

Therefore, if you are doing recovery of deleted video files, nothing other than complex carving is going to work for you.

Created Thursday, November 9, 2017