When files are fragmented, Klennet Carver can reassemble them from the fragments to their original condition,
or at least close enough to their original condition.
What if one or more fragments are overwritten?
You cannot recover overwritten data, but what about the remaining fragments?
First, if an image file header is overwritten,
Klennet Carver cannot recover the file, for there is no starting point to work with.
This is a rare situation, though.
File headers are a thousand times smaller than a complete file,
and the probability of a header being overwritten is quite low.
If a video file header is overwritten, Klennet Carver uses header stealing to reconstruct the header
if at least one valid header is available.
This works well on memory cards, where all videos are filmed with the same settings.
So, what happens depends on file type and on header availability:
- For image files with valid headers,
Klennet Carver recovers the file until the first overwritten fragment, and then the recovery stops.
Visually, the top part of the resulting image will be fine.
A short burst of random colors may follow, and the bottom part will be missing.
-
Image files without headers are not recoverable by Klennet Carver.
- For video files with valid headers, Klennet Carver recovers the file until it encounters the overwritten fragment.
Then, a stream of zeros or other data from the media goes into the file until the next
valid (non-overwritten) fragment.
After the end of the overwritten fragment, recovery continues with the remaining valid data.
If there are multiple overwritten fragments, the process repeats.
Visually, this results in dropouts or distorted fragments.
Depending on the amount of data that is overwritten, quite long fragments may be missing.
Still, as long as there is more data on the media,
the video will continue after the overwritten fragment ends.
- For video files with damaged headers,
Klennet Carver recovers contiguous sequences of video and audio frames on the media
and stores each contiguous sequence in a separate file.
Filed under: File carving.
Created
Updated
This text is licensed under Creative Commons Attribution 4.0 License