Jump to content
CCleaner Community Forums
Sign in to follow this  
pfkaplan1

Video File Recovery - but cannot view the video - HELP

Recommended Posts

Priceless video of 90 yr old mom on SDHC Card, thought I copied it to laptop before deleting, but didn't. Recuva recovered the file, it said it was in excellent shape, recovered it to my laptop. Its an .avi file.  Tried to run it with a movie player and it came up with an error: 0xC00d36C4.  Does this mean anything to anyone?  I have an hour of interviewing her on this file ad I am sick about it... not to mention have to tell my family I deleted it!  Any insights appreciated. 

 

 

The recovered file is 2.15 Gbytes. Too large to attach.

 

PS> I am running windows 10

Share this post


Link to post
Share on other sites

Can you provide the starting cluster number of the file - from Recuva Advanced mode Info?

Share this post


Link to post
Share on other sites

Thank you for any guidance you can offer. Here is the information from the  Recuva info  window re. this file:

 

 

Filename: _UNP0002.AVI  

 

Path: D:\DCIM\100MEDIA
 
Size: 2.15 GB (2,310,115,664)
 
State: Excellent
 
Creation time: 1/1/2014 12:43
 
Last modification time: 1/1/2014 12:43
 
Last access time: 8/23/2015 00:00
 
Comment: No overwritten clusters detected.
 
70500 cluster(s) allocated at offset 1969
 
 

(by the way, that is not the correct date of creation, the date on the video camera was not set up)

 

Share this post


Link to post
Share on other sites

Assuming that the card is formatted as FAT32, as most large capacity cards are, and that the cluster size is 32768 (2.5 gb / 70500).

 

The starting cluster is given as 0x07B1 - this is a vital clue. FAT32 was developed out of FAT16, and FAT16 had a two-byte field for the start cluster number. FAT32 needed four bytes, so two bytes were taken from a separate unused field and used for the high-order part of the address. When a file is deleted in FAT32 one of the things that the file system does is to zero the two high-order bytes of the cluster address.

 

When Recuva (or any recovery software) looks at the start cluster address of a deleted file it sees the low-order two bytes only. This address is obviously invalid: any data recovered from this start cluster onwards will also be invalid.

 

If you look at the first 256 bytes of the file in the Recuva scan you will be able to see if it's a valid avi file header or rubbish. It should be fairly obvious if the header is good or not (I don't know the file signature for an avi file, it will be easily Googleable). If the header is rubbish then the chances of recovery aren't good.

 

PS Header contains RIFF in the first four bytes and AVI LIST in bytes nine to sisteen.

Share this post


Link to post
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

Loading...
Sign in to follow this  

×
×
  • Create New...