Klennet Carver vs. partially overwritten files

When files are just fragmented, Klennet Carver can reassemble them from the fragments to their original condition, or at least close enough to their original condition. What if one or several fragments are overwritten? Obviously, overwritten data cannot be recovered, but what about the remaining fragments?

First of all, if an image file header is overwritten, Klennet Carver cannot recover the file for there is no starting point to work with. This is a rare situation though. File headers are small, thousand times smaller then complete file, and probability of a header being overwritten is quite low.

If a video file header is overwritten, header stealing is used to reconstruct the header, if at least one valid header is available. This works well on memory cards, where all videos are filmed with the same settings.

So, what happens depends on file type and on header availability:

  • For image files with valid headers, the file is recovered up to the first overwritten fragment and then the recovery stops. Visually, the top part of the resulting image will be fine, followed possibly by a short burst of random colors, and the bottom part will be missing.
  • Image files without headers are not recoverable by Klennet Carver.
  • For video files with valid headers, Klennet Carver recovers the file until it encounters the overwritten fragment. Then, either a stream of zeros or whetever happens to be on the media goes into the file until the next valid (non-overwritten) fragment. After the end of the overwritten fragment, recovery continues producing remaining valid data. The process is repeated if there are multiple overwritten fragments. Visually, this results in a video having dropouts or visually distorted fragments. Depending on the amount of data overwritten, quite long fragments may be missing, but as long as there is more data on the media, the video will continue after the end of overwritten fragment.
  • For video files with headers damaged, Klennet Carver recovers contiguous sequences of video and audio frames on the media. Each contiguous sequence is stored in a separate file.

Created Wednesday, January 3, 2018

Updated 19 May 2018