From: http://www.cnwrecovery.com/manual/index.html?RecoverVideoFromCamcorderWithAHardDrive
Many camcorders today use an internal hard drive, rather than removable DVDs. These hard drives are typically FAT32 and so recovery is fairly straight forward. Probably the most common reason for data loss is accidental use of ‘Delete All’.
The main area that needs care with when dealing with a video camera directly is accessing the drive. For many cameras, when they are plugged into the USB port, they should appear as a logical drive. If it is not possible to access the drive as either a logical drive, eg Drive F: or a physical drive, eg Phys-2 then CnW Recovery software will not beable to assist.
The best advice at this stage is to create a image copy (Use Image raw function) so that any accidental use of the camera will not loose any more files.
There are two procedures that can be followed to extract your video files
Deleted file recovery
Most video recorders use FAT32 as the disk file structure. The first approach to take on recovery is to read the disk, and enable recovery of deleted files. This is the preferable approach as filenames will remain intact. If sections have been deleted, and then new ones filmed, the resulting files may not be complete, or fragmented, in which case some errors may be expected. However, the vast majority of video will be recovered.
With a FAT32 disk that contains deleted files recovery is not always totally reliable. Never the less, CnW Recovery program does do much more analysis than many other software programs but below are described fundamental issues.
When a FAT disk file is deleted, two main things happen
- The file entry is marked as deleted, by setting the first character in the file name as a 0xE5
- The File Allocation Table is cleared
On Fat 32, the high order cluster pointer values are also cleared.
A FAT directory always uses a cluster number pointer to indicate where the file starts. For FAT 12 and FAT 16 this a 12 or 16 bit number, stored in two bytes at offset 0x1a and 0x1b in the directory. For FAT32, the pointer is 32 bits, with the extra two bytes (16 bits) stored at offset 0×14 and 0×15. It is these final two bytes which are (for some reason) also cleared when the file is deleted. Therefore with a FAT32 deleted file, only the lower 16 bits are available to determine where the file starts.
CnW Recovery software does not give up at this point, it will examine the file extension and for many common file type, it will therefore know how a file should start. For instance, a Zip file always starts with the characters PK. By knowing this, possible file starts can be examined, based on the lower 16 bits of the cluster number and there is a good chance that the required file can be found. However, without human intervention, this can not be 100% reliable, but it is quick, and automatic.
The second problem with any FAT recovery is that the file allocation table is also deleted. The initial approach is to assume that the file is sequential, and often this is correct, and so valid files are recovered. CnW are working on enhancements to this procedure which will increase the likely hood of only getting good files by only recovering files in clusters marked as unused. Some extra fragmented files will therefore be recovered intact.
Which recovery mode to use?
The FAT recovery screen has two useful recovery modes which may produce different results
- Full Recover
- Recover from directory stubs
For a disk that has just had some files deleted, the Full recover will work well. Deleted files will be recovered and written to the output directory, prefixed by !deleted
For a disk that has been used a lot since files have been deleted, the Recover from directory stubs is more likely to detect and recover all files. This is slightly more exhaustive that the Full recover, as it does not rely on an intact directory structure. Typically it will find files and subdirectories that can not be placed in a tree, and so files there will be many dirstub dummy directories created. The log function will indicate which files had been deleted by the ‘D’ in the flag column.
When the disk is being scanned, the display will indicate the number of Deleted FAT32 files that will be recovered. These are ones that the program has searched the hard disk for to locate the start of the file, of the correct type, in a known empty location.
Raw Image recovery
The Raw Image approach should be tried if the deleted file dies not recover all the relevant files. Once the files have been recovered, as MPEGS, it may be necessary to convert and merge them to make a viewable video disk. Details are in the chapter on Camcorder recovery.
Mini DVDs are typically used in Camcorders, Video cameras etc. The typical failure mode is related to sessions not closing, or just general failure at the start of disk.
Different types of camera do use slightly different logical recording methods, but fortunately, the basic standard is to record mpeg files, with some control files, IFO files. It is very common for a failed DVD not to have any of these IFO files, but recovery is still possible.
There are three possible ways to work on a Mini DVD that has failed
- Wizard
- Logical Recovery
- Raw Recovery
A mini DVD is normally recorded as an ISO9660 structure, or UDF with groups of files with the following extensions, IFO, BUP and VOB. The file IFO and BUP are identical. The VOB file stores the mpeg data and therefore is the important one to recover.
A VOB file is basically an MPEG file with addition information taken from the IFO and BUP files. The maximum size for a VOB is 1GB, and so on a long movie there will be multiple VOBs and matching IFO files. In addition there should also be a VIDEO_TS.IFO and VIDEO_TS.BUP, with an optional VIDEO_TS.VOB if there is a start menu. If it is possible to recover all of these files, then a new video disk can be created. If only the MPEG can be recovered, it is necessary to rebuild the IFO / BUP files. This is performed by a feature (currently under development) to rebuild video files
Wizard recovery
For many camcorder disks, they will be detected by the wizard as Corrupted Video Disks. If the screen indicates that several files are present, then a full recovery may work. Typically, it will be necessary to recover files from unallocated space.
Logical recovery
The Recover function will allow recovery of files in a logical way – as long as the disk has the basic control blocks still intact. If this fails, then Raw recovery will be the best option.
Raw recovery
The raw recovery mode is probably the most common mode for recovery of video disks. It will scan the complete disk, and extract either a single large MPEG file, or many smaller mpegs, based on individual chapters. If the individual chapters are required, then the Separate video file chapters option should be selected. Different camcorders work in different way, so it may be best to try a recovery with ‘Separate video file chapters’ enabled and disabled.
Raw recovery can be done with a complete scan, but often the start of the disk cannot be read. It is therefore advantageous to determine where the data starts. There are two ways, one is to use view sector, and try different starting points, eg 20000, then 10000 and try and find the start by trial and error. The easier way is to us the built in function, Search for start sector. Once the start location is determined, and the options set (Split on possible file starts and Separate video file chapters) then a scan can be performed.
If after a period of time the scan moves very slowly, and comes up with a significant number of errors, the scan can be cancelled, and the reconstruction started.
MPEG reconstruction
If the raw recovery mode described above has been used, then the files will be a series of MPEG files. These can be double clicked and viewed Windows Media Player. However, they can not be written to a new DVD and played on a domestic video recorder. There are several options. There are many applications that can be used to create Video disks from MPEG files, and often such features are built into DVD burning programs such as Cyberlink Power Producer – 2 Gold. The CnW Rebuild video files (when complete) will allow mpegs to be merged, and a video disk image recreated.
