Jump to content

Recovering large MKV-files


Hockey

Recommended Posts

Hi

I accidentally deleted a 3Gb video recording from OBS on my D-drive. File was a MKV-file. Recuva managed to find it in an excellent condition, but when i try to play it, it only comes up with errors (0xc00d36c4 in default Windows player, long wait before sudden stop in VLC).

Do Recuva have problems with these file types or is there something im doing wrong?

Link to comment
Share on other sites

Some more info:

Drive is NTFS, an SSD partitioned into C and D (and a couple of system recovery partitions).

I did do a Deep scan, found the correct file and recovered. File should have 1 video track and 4 audio tracks, 3h 57 sec long.

It's been a month since i accidentally deleted it, but i havn't written anything to that partition of the drive since then. I tried recovering the file 1-2 days after deletion, but with the same result as now.

I've included the Info and Header that recuva displays for the video file.

File info.txt

Link to comment
Share on other sites

  • Moderators

Although you ran a deep scan the info (very handy, I wish everyone would do this) shows details returned by a normal scan (Recuva runs a normal scan before a deep scan). A file found during a deep scan has no file or folder name, and only one primary extent. The info here is taken from the entry in the MFT.

The file header seems to have the correct four-byte signature for an MKV file. I can't say whether the rest is valid, but I would assume that if the file signature is intact then it's likely that the rest of that cluster is intact also. But I could be wrong, of course. There are enough clusters to make up 3gb too.

The file header comes from the start of the first data cluster. With TRIM enabled the deleted data clusters should have been cleared. Is TRIM enabled on this drive?

Apart from that I'm running out of ideas. After around byte 140 or so the header is zeroes. Is this relevant? Is the rest of the file like this? I don't know.

Ultimately Recuva will just recover - copy in other words - whatever is in the allocated clusters, so there's no tweak to do it any better.

Link to comment
Share on other sites

I did some more research on the drives. They are 2 M.2 SSDs set in Raid 0, so TRIM shouldnt be enabled (Can't run TRIM on Raided SSDs to my knowledge).

The recovered file won't be played back by any software, Handbrake won't reencode it or OBS won't remux it, so i think its broken.

The compression in the file is quite large since it's not much change of the picture (DnD-game recorded of roll20.net), hence the 3Gb size of a 3 hour video. Same setting in any other game produces 100Gb+ files.

I'll try to contact an IT-company at home and see if they have more advanced tools for data recovery. For now ill just refrain from using that partition.

Link to comment
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
×
×
  • Create New...

Important Information

By using this site, you agree to our Terms of Use.