|
|
Article DetailsThis article covers the WindowsMail.MSMessageStore database used by Windows Mail. This article may serve as an aid to forensic examiners or data recovery technicians.
A short guide covering how to quickly gather all file signatures (file headers) from all files within a case for review and/or research purposes. This article will use the tools Header Grab Advanced, part of the Simple Carver Suite. This article may serve as an aid to forensic examiners or data recovery technicians.
A short guide covering how to quickly view and export search results from Winhex POS files to CSV format. This article may serve as an aid to forensic examiners or data recovery technicians.
A short guide covering how to quickly search for and detect any hidden worksheets present within a Microsoft Excel Workbook (xls and xlsx). This article will use the tools XLS Worksheet Detect Free and commercial versions, part of the Simple Carver Suite. This article may serve as an aid to forensic examiners or data recovery technicians.
A short guide covering how to batch preview URL files used to store favorites information in Internet Explorer. This article will use the tool URL Previewer, part of the Simple Carver Suite. This article may serve as an aid to forensic examiners or data recovery technicians.
- Active Links: 10
- Pending Links: 3
- Todays Links: 0
- Total Articles: 16
- Total Categories: 4
- Sub Categories: 0
How to recover deleted 3gp video files |
| Date Added: August 12, 2009 06:22:14 PM |
| Author: admin |
| Category: Documents |
This article covers in brief showing how to recover deleted 3gp video files which may be of use to forensic practioners and data recovery technicians. For reference, 3GP video files: http://en.wikipedia.org/wiki/3GP Before performing any recovery, inspection of some valid 3gp files will quickly provide you will search terms to use. In the screenshot below 'A' shows an example search term that could be used to identify the start of a 3gp file. Note the initial 3 bytes 'B'. For playback of this 3GP file it is important that these bytes are present. It is generally good practice to copy out the entire cluster containing the search hit during the initial stages of recovery.
For a 3GP file to playback in a video player there needs to be sufficient video data present and more importantly no/little fragmentation. If using a file carver to recover the files you will need to know how much data to carve, one method of finding the correct amount of data to carve is to use a tool called 'MediaInfo'. MediaInfo will read the video file information present within the start of a 3GP file. The file does not need to be complete, only the first portion of the file is required. Copy out the first cluster of the 3GP data and drag the fragment into MediaInfo. Information about the video will be displayed automatically if it doesn't then insufficient data has been copied or the data is not valid (Note: you will need to change the media info view to Text to view as shown in this article).
The example screenshot above shows the recovered 3GP video information containing two streams 'A' the video stream and 'B' the audio stream. Add both values together and you have the size of the 3GP file (89.9KB)! Any file carver will recover this no problem. Note, playback may be problematic if the video is fragmented. Fragmentation will vary for a number of reasons, activity, type of storage device etc. Try as many 3GP video files as possible, some work better than others. |
