GoPro Recovery (gpr.exe from CnW Recovery Developments Ltd)
Video
Recovery
How video recovery operates
Why are video files hard to recover?
A video in some respects is just a simple file, stored on a memory device. It can be read by any computer. So why is it so complex to recover, and why do so many software packages promise to recover video, but then fail? The very simple answer is that the file is not stored sequentially, and deleting the file, the sequence is lost. Video cameras typically use FAT32 to store data, though some newer cameras, and in particular those using memory chips greater than 32GB, use exFAT. A file is stored as a series of clusters, each cluster being maybe 64 sectors, or 256 sectors A file can have 10s of thousands of clusters. On a FAT32, each cluster is pointed to by data in the File allocation Table (FAT). This table is deleted when a file is deleted, or the chip reformatted. The process is similar on a exFAT memory chip, though the FAT is not used for sequential files. Why are the files recorded out of sequence? A video file is basically made up of two sections, video data and index information. When a video recording is started, obviously the length is unknown. For this reason, it is not possible to know how long the index information will be. Many video files are logically <index info> followed by <video data>. Some cameras allocate a large area for the index info, and another one stores index info at the start of the memory chip, and video data at the other end of the memory chip. However, a very common approach is to store the video data (mdat) physically first on the memory chip, and then add the index info (moov atom) physically after the video. The FAT is then written in such a way that the index info is seen first, logically followed by the video data. If a common data carving process is used to recover the video, the program will see a file start followed by video and recover the data. Unfortunately, it will be the header from file 1, joined to the video from file 2. The result is nothing works, and all the user can see is a blank screen. Many data recovery companies will then claim that the video was corrupted, which is why it failed and try and repair part of video 2 with part of video 1. We would speculate that many software companies tested their software by copying video files to memory chips, deleting and recovering. This process would write sequential files, and so data carving would work. For many standard cameras taking videos, and specific video cameras it is normal for a video on the original memory chip to be in 2 or 3 different sections, or fragments. This number can increase if the camera allows embedded still JPEGs to be taken whilst recording a video, or if separate videos have been deleted, hence fragmenting the memory chip. CnW Recovery software is probably the only software package to process original memory chip for many camera types, and GoPro cameras. The GoPro Recovery package takes the features within CnW and optimises for just the GoPro, and also adds extra recovery modes for partial images.GoPro Camera Recovery
The above section describes many common cameras. The GoPro camera takes recover requirements to a new level. Although each Hero model is different, there are common issues with the data being physically stored in a different sequence to the logical order. The major issue is that GoPro Hero 3 and 4 cameras typically store two data sequences, a high resolution .MP4 and a low resolution .LRV. Both are standard MP4 files with the normal elements, <ftyp><moov><mdat> but the two streams are interleaved. On one example the low resolution fragment was about 0x400 sectors long (1024) and the MP4 fragment was about 0xa000 sectors long (40,000). These sizes are not fixed, and vary between different areas of the video. As the files have been deleted, there is no information remaining on how each fragment is saved. This is where GoPro Recovery software does it’s clever work. The chip is scanned and all atoms (mdat, moov, and ftyp) starts are noted. Then each video frame is also located. GoPro Hero, and Hero 4 have audio frames and video frames tagged. With this knowledge, it is possible to tie the index with the video data, and create a pair of sequential playable video files. Some DJI cameras work in a very similar way and so can be recovered. The demo will show a thumbnail if the camera is compatible
GoPro partial file recovery
Occasionally the camera may fail due to a physical accident. When this happens it is likely that the video will not be complete. Current development will ensure that the partial video will be recovered, and playable version generated. Partial file recovery is a complex procedure. First the high and low resolution video streams have to be separated out and then the index has to be created. For Hero 3 cameras the high and low resolution streams are interleaved and there are no specific tags to determine the start and length of each audio or video frame. Fortunately, the video frame does have an embedded length, but the audio frame can only be determined by decoding. The ‘clever’ part of the recovery system is to separate out the high and low resolution streams, even when a cluster has no video or audio header information. GoPro recovery software has developed ways of doing this with a high success rate. With this complex recovery process, CnW feel that it is the only company that can perform valid GoPro video recovery from the camera memory chip.Recovery of other digital cameras
The GoPro camera is probably the most complex camera to recover deleted video from, but many other camera have similar issues. Fortunately, CnW Recovery has a general purpose product that supports many video camera types. This list includes the following cameras, though the list does grow on a regular basis. Cameras supported • *Canon EOS/Rebel series • *Canon SX600 • *HS Canon HF-G30 • Fuji Film FinePix XP50 • GoPro Hero GoPro Hero 3+ Black GoPro Hero 4 Silver • Kodak Zx1 Pocket Video camera • Nikon Corporation D5100 • Samsung HMX200 • Samsung HMX300 • Samsung Galaxy phone • Sanyo E1 • *Sony PMW-F3 • *Sony PMW-150 • Panasonic Lumix GH4 When standard recovery programs to to recover from the camera memory chip of these cameras, most fail. They may find an .MP4 file, but it will not play. CnW has a high success rate with these and many more cameras. * is part of current GPR software as well
Non GoPro Cameras
Many drone cameras record data in a similar way to GoPro, ie
interleaved low and high resolution video. It has therefore been
possible to share the Gopro development with many DJI Drones
and provide a solution to the otherwise very difficult issue of
recovering fragmented files after deletion.
Since mid 2019, GPR software supports more than just GoPro
Hero cameras, and the list will continue to grow.
© GoPro Recovery
GoPro Recovery
Video
Recovery
How video recovery
operates
Why are video files hard to recover?
A video in some respects is just a simple file, stored on a memory device. It can be read by any computer. So why is it so complex to recover, and why do so many software packages promise to recover video, but then fail? The very simple answer is that the file is not stored sequentially, and deleting the file, the sequence is lost. Video cameras typically use FAT32 to store data, though some newer cameras, and in particular those using memory chips greater than 32GB, use exFAT. A file is stored as a series of clusters, each cluster being maybe 64 sectors, or 256 sectors A file can have 10s of thousands of clusters. On a FAT32, each cluster is pointed to by data in the File allocation Table (FAT). This table is deleted when a file is deleted, or the chip reformatted. The process is similar on a exFAT memory chip, though the FAT is not used for sequential files. Why are the files recorded out of sequence? A video file is basically made up of two sections, video data and index information. When a video recording is started, obviously the length is unknown. For this reason, it is not possible to know how long the index information will be. Many video files are logically <index info> followed by <video data>. Some cameras allocate a large area for the index info, and another one stores index info at the start of the memory chip, and video data at the other end of the memory chip. However, a very common approach is to store the video data (mdat) physically first on the memory chip, and then add the index info (moov atom) physically after the video. The FAT is then written in such a way that the index info is seen first, logically followed by the video data. If a common data carving process is used to recover the video, the program will see a file start followed by video and recover the data. Unfortunately, it will be the header from file 1, joined to the video from file 2. The result is nothing works, and all the user can see is a blank screen. Many data recovery companies will then claim that the video was corrupted, which is why it failed and try and repair part of video 2 with part of video 1. We would speculate that many software companies tested their software by copying video files to memory chips, deleting and recovering. This process would write sequential files, and so data carving would work. For many standard cameras taking videos, and specific video cameras it is normal for a video on the original memory chip to be in 2 or 3 different sections, or fragments. This number can increase if the camera allows embedded still JPEGs to be taken whilst recording a video, or if separate videos have been deleted, hence fragmenting the memory chip. CnW Recovery software is probably the only software package to process original memory chip for many camera types, and GoPro cameras. The GoPro Recovery package takes the features within CnW and optimises for just the GoPro, and also adds extra recovery modes for partial images.GoPro Camera Recovery
The above section describes many common cameras. The GoPro camera takes recover requirements to a new level. Although each Hero model is different, there are common issues with the data being physically stored in a different sequence to the logical order. The major issue is that GoPro Hero 3 and 4 cameras typically store two data sequences, a high resolution .MP4 and a low resolution .LRV. Both are standard MP4 files with the normal elements, <ftyp><moov><mdat> but the two streams are interleaved. On one example the low resolution fragment was about 0x400 sectors long (1024) and the MP4 fragment was about 0xa000 sectors long (40,000). These sizes are not fixed, and vary between different areas of the video. As the files have been deleted, there is no information remaining on how each fragment is saved. This is where GoPro Recovery software does it’s clever work. The chip is scanned and all atoms (mdat, moov, and ftyp) starts are noted. Then each video frame is also located. GoPro Hero, and Hero 4 have audio frames and video frames tagged. With this knowledge, it is possible to tie the index with the video data, and create a pair of sequential playable video files. Some DJI cameras work in a very similar way and so can be recovered. The demo will show a thumbnail if the camera is compatible
GoPro partial file recovery
Occasionally the camera may fail due to a physical accident. When this happens it is likely that the video will not be complete. Current development will ensure that the partial video will be recovered, and playable version generated. Partial file recovery is a complex procedure. First the high and low resolution video streams have to be separated out and then the index has to be created. For Hero 3 cameras the high and low resolution streams are interleaved and there are no specific tags to determine the start and length of each audio or video frame. Fortunately, the video frame does have an embedded length, but the audio frame can only be determined by decoding. The ‘clever’ part of the recovery system is to separate out the high and low resolution streams, even when a cluster has no video or audio header information. GoPro recovery software has developed ways of doing this with a high success rate. With this complex recovery process, CnW feel that it is the only company that can perform valid GoPro video recovery from the camera memory chip.Recovery of other digital cameras
The GoPro camera is probably the most complex camera to recover deleted video from, but many other camera have similar issues. Fortunately, CnW Recovery has a general purpose product that supports many video camera types. This list includes the following cameras, though the list does grow on a regular basis. Cameras supported • *Canon EOS/Rebel series • *Canon SX600 • *HS Canon HF-G30 • Fuji Film FinePix XP50 • GoPro Hero GoPro Hero 3+ Black GoPro Hero 4 Silver • Kodak Zx1 Pocket Video camera • Nikon Corporation D5100 • Samsung HMX200 • Samsung HMX300 • Samsung Galaxy phone • Sanyo E1 • *Sony PMW-F3 • *Sony PMW-150 • Panasonic Lumix GH4 When standard recovery programs to to recover from the camera memory chip of these cameras, most fail. They may find an .MP4 file, but it will not play. CnW has a high success rate with these and many more cameras. * is part of current GPR software as well
