Where is my footage? (part I)

My customers often get confused when the file they repair…

• doesn’t contain stuff corresponding to the file name or extension,
• contains footage from several clips,
• or contains large swaths without footage, or are completely empty

And in this case, your confusion is legitimate, because after a storage failure, we have in a twilight zone as far as data storage is concerned: Normal assumptions are no longer valid.

In this post, I will try to explain what is going on “behind the scenes” and how the repair results can be optimized.

Disk, Data and Files

Through this serie of posts, I will use the terms “disk”, “data” and “files” very often, so let’s start defining what I mean and how I will represent them in the diagrams:

disk stands for physical storage, it can be your computer hard disk, an external hard disk, an SD memory card, or and USB pen drive, for example. It is represented by an area whose surface is the capacity.

data is represented by a colored area. For example, green is used for the biking video. Note that the dark green region at the right side represents the index of the video, whereas the light green is video media. Both are necessary for the video to be playable.

file is represented by a boundary and a bubble with the file name.

In a normal situation, your disk contains several files and looks like the diagram below:

• We have recorded 3 video clips: Biking, Joke and Party
• File boundaries match exactly the corresponding data
• Disk is getting filled from left to right, in rows from top to bottom.

Joke, not so funny

Now imagine that we don’t find the joke very funny after all, and we delete the video file.

Note that only the file has disappeared, the data is still written on the disk, but unreferenced. This is why recovering deleted files is possible in the first place:

Later we record more clips called Birthday and Concert. Let’s observe the new diagram:

• Birthday file has overwritten Joke data
• Birthday is one file but occupies two regions: We call that fragmentation.
• Concert is stored in one region, because line-breaks do not count as boundary.

Bottom line: Unreferenced data will be overwritten when new files are added. So whenever you experience a storage failure or data loss, stop using the disk immediately. Reading doesn’t harm, but writing will end up wiping definitively your lost data. Now we can’t recover Joke because Birthday is written on top of it.

IMPORTANT: When repairing data or video from a disk, always operate from a different disk!
This avoids writing to the damaged disk.

Unplayable videos

To be playable, a video file must contain media data (video and audio), an index, and be coherent.

• Without media data, the file is not just unplayable, it’s not repairable either.
• A file with media but without index can be repaired.
• A file with media and incoherent index can be repaired, but is unplayable.

The most typical corrupt videos are those that you find after a recording failure. The media data is present, but unlike a well-formed video file, the index is not here:

This is because the index is written at the end of recording, and if we experience a failure (battery dead, camera overheating, …) this will never happen.
Note also that those unplayable files can also contain some empty space at the end, where data was about to be written when recording stopped.

Disaster strikes!

Now the dreaded storage failure suddenly happens. We no longer see any file in the disk (or we have files with funny names, or files that are now unplayable).

The first thing to do is to quarantine the disk, to avoid writing on it. Because the data is still here, waiting to be recovered, but it is also vulnerable since it is unreferenced.

At this point, many people use a free or commercial data recovery utility to “undelete” the files.
The result is usually disappointing, because video files are difficult to recover due to their diversity, complexity and huge size.
You often end up with a few good files, and plenty of bad ones: (see diagram below)

• File boundaries do not match exactly the data regions
• “Biking” contains only half of the footage and is unplayable because index is not present.
• “Party” now contains footage from Biking and Birthday, and is unplayable for being incoherent.
• “Concert” is unplayable, because the missing bit makes the whole file incoherent.
• “Birthday” is empty!

Note that I’m using quotes to differentiate the recovered files (“Party”) from the original ones (Party). Indeed data recovery often mixes file names and contents, so after recovery, file name should always be taken with a grain of salt.

File sizes, however, are always a good indicator of what you can expect. A 160 kb file is too small to contain footage. A 16 MB file can contain a few seconds (or can be empty). A 160 MB file can contain several minutes of footage, …

We can also find combinations of the examples above, like a recovered file with footage from 3 or more clips, a recovered file with large empty regions and footage, …

Repair will give limited results

Even if you invest time (and money) in repairing those files, you will probably not get a satisfactory result. As we have seen before, the recovered files do not contain all the missing footage, and can also contain footage from several clips:

• Once repaired, “Biking” will just contain half of the original video.
• Once repaired, “Party” will contain some biking and part of the birthday video!
• Once repaired, “Concert” will now have the first songs.
• “Birthday” will not repair, it contains nothing!
• Party cannot be repaired. Parts of other clips are still missing.

But there is hope…

To achieve optimal results, we would need to recover files that match better the data regions, and then repair them.
Fortunately, this is possible, using our advanced repair tools, and I will explain it in the second part of this post.