Video File Recovery - but cannot view the video - HELP

[pfkaplan1]

Priceless video of 90 yr old mom on SDHC Card, thought I copied it to laptop before deleting, but didn't. Recuva recovered the file, it said it was in excellent shape, recovered it to my laptop. Its an .avi file.  Tried to run it with a movie player and it came up with an error: 0xC00d36C4.  Does this mean anything to anyone?  I have an hour of interviewing her on this file ad I am sick about it... not to mention have to tell my family I deleted it!  Any insights appreciated. 

 

 

The recovered file is 2.15 Gbytes. Too large to attach.

 

PS> I am running windows 10

[Augeas]

Can you provide the starting cluster number of the file - from Recuva Advanced mode Info?

[pfkaplan1]

Thank you for any guidance you can offer. Here is the information from the  Recuva info  window re. this file:

 

 

Filename: _UNP0002.AVI  

 

Path: D:\DCIM\100MEDIA

 

Size: 2.15 GB (2,310,115,664)

 

State: Excellent

 

Creation time: 1/1/2014 12:43

 

Last modification time: 1/1/2014 12:43

 

Last access time: 8/23/2015 00:00

 

Comment: No overwritten clusters detected.

 

70500 cluster(s) allocated at offset 1969

 

 

(by the way, that is not the correct date of creation, the date on the video camera was not set up)

 

[Augeas]

Assuming that the card is formatted as FAT32, as most large capacity cards are, and that the cluster size is 32768 (2.5 gb / 70500).

 

The starting cluster is given as 0x07B1 - this is a vital clue. FAT32 was developed out of FAT16, and FAT16 had a two-byte field for the start cluster number. FAT32 needed four bytes, so two bytes were taken from a separate unused field and used for the high-order part of the address. When a file is deleted in FAT32 one of the things that the file system does is to zero the two high-order bytes of the cluster address.

 

When Recuva (or any recovery software) looks at the start cluster address of a deleted file it sees the low-order two bytes only. This address is obviously invalid: any data recovered from this start cluster onwards will also be invalid.

 

If you look at the first 256 bytes of the file in the Recuva scan you will be able to see if it's a valid avi file header or rubbish. It should be fairly obvious if the header is good or not (I don't know the file signature for an avi file, it will be easily Googleable). If the header is rubbish then the chances of recovery aren't good.

 

PS Header contains RIFF in the first four bytes and AVI LIST in bytes nine to sisteen.