Using Foremost in K...
 
Notifications
Clear all

Using Foremost in Kali Linux to recover .MP4  

Page 1 / 2
  RSS
mfino
(@mfino)
New Member

Hello,

I am trying to recover some accidently deleted files off an SD card. They were on a gopro. The files I am looking for are .MP4 files.

What I have done so far is create an image of the SD card using dcfldd. When I scan the .dd file using foremost, I am coming up with JPGs that are not on the SD card that were there, and I do not see any MP4 files to include the ones that are still on the card.

The closest I have gotten is that I edited the foremost.conf file and removed the # for MPEG. I came up with thousand of MPG files, but I cannot view any of them. This is a time sensitive matter. Any good help with clear instruction is appreciated. Thank you in advance!!

Quote
Posted : 09/08/2017 5:38 pm
jaclaz
(@jaclaz)
Community Legend

This is a time sensitive matter. Any good help with clear instruction is appreciated. Thank you in advance!!

I am not sure if the question is
How do I recover .MP4 files (from an image of a SD card I have made)?
or
How do I recover .MP4 files (from an image of a SD card I have made) exclusively by running Foremost and exclusively while running it on a Kali Linux?

I mean, you have the (hopefully) recovered volume/filesystem on a .dd image.

You should (could) throw at it each and every software available, not limit yourself to a specific tool.

Have you tried Photorec? (first tool I would personally try)
http//www.cgsecurity.org/wiki/PhotoRec

jaclaz

ReplyQuote
Posted : 09/08/2017 7:23 pm
mfino
(@mfino)
New Member

I have an SD card from a gopro.

I have made a .dd image of it using dcfldd (a program in kali)

I am open to use any software that is free, preferably on kali.

I need to recover .mp4 files that have been accidently deleted.

Do I need to edit for any special configurations for Photorec?

Thank you for your fast response and advice )

ReplyQuote
Posted : 09/08/2017 8:10 pm
jaclaz
(@jaclaz)
Community Legend

Do I need to edit for any special configurations for Photorec?

Thank you for your fast response and advice )

No, if it works it should be fully automated/automatic, it is normally (unless you script it) interactive, you have to make a few choices when the program is run.
See this step by step
http//www.cgsecurity.org/wiki/PhotoRec_Step_By_Step

What I recommend when using this kind of tools is to use the log option
http//www.cgsecurity.org/wiki/Scripted_run#PhotoRec

jaclaz

ReplyQuote
Posted : 09/08/2017 9:04 pm
mfino
(@mfino)
New Member

Thank you I will give it a go. I will let you know if i am successful or not.

ReplyQuote
Posted : 09/08/2017 9:11 pm
mfino
(@mfino)
New Member

a little more luck with photo rec, but not enough luck… any other suggestions?

ReplyQuote
Posted : 10/08/2017 4:17 am
jaclaz
(@jaclaz)
Community Legend

a little more luck with photo rec, but not enough luck… any other suggestions?

Try DMDE, there is a Linux version and you can try as suggested the almost fully functional Free version to see if it can find something *more* than photorec
http//dmde.com/
http//dmde.com/buy.html
I am not at all familiar with the console Linux version, (and you will need some time to get the hang of it) the Windows GUI one is a good program, it may (or it may not) recover *something more* than photorec though usually if photorec cannot find what is needed it means that either it is not there or it is there in a form that needs manual recovery.

jaclaz

ReplyQuote
Posted : 10/08/2017 4:48 pm
webyu
(@webyu)
New Member

a little more luck with photo rec, but not enough luck… any other suggestions?

when you deleted the MP4 Files From SD,Some MP4 Files may become to fragments data.

I Can recovery MP4 Video From GroPro,with my self-coded software,if you can send me the image file.Contact me if you need [email protected]

ReplyQuote
Posted : 11/08/2017 12:04 pm
mscotgrove
(@mscotgrove)
Senior Member

GoPro files are fragmented. Standard recovery programs will not work with GoPro SD cards

Use www.recovergopro.com

It has been written to just read deleted, formatted GoPro SD memory cards

ReplyQuote
Posted : 13/08/2017 4:19 am
slippery
(@slippery)
New Member

You can try scalpel, similar to Foremost. Available most distros.

ReplyQuote
Posted : 31/08/2017 4:40 pm
mfino
(@mfino)
New Member

So I tried goprorecovery and foremost. I retrieved the same from both. Foremost required a little more work, but I needed to be sure. Unfortunately, it looks like the video I am looking for stopped recording within 2 seconds of start. I need to confirm that the person who recorded it actually played more than 2 seconds back of the recording. If they say yes there should be more time to the recording, what are some steps I can take? Are there any? Or should I consider the recording lost?

ReplyQuote
Posted : 31/08/2017 4:57 pm
mscotgrove
(@mscotgrove)
Senior Member

Different GoPro cameras record slightly differently. The big issue that most GoPro modes record high and low resolution video streams interleaved. When the chip is deleted, or formatted, the fragmentation information is lost. Recovery programs that expect sequential data, fail.

Do you know which model camera was being used, and where there high and low res videos.

If high and low videos, are they both just 2 seconds long?

GoPro Recovery scans the whole memory chip for fragments and then reconstructs them, normally using the existing 'moov' data. With the optional Forensic option, unfinalised fragments can also be recovered. This can be extremely useful if the camera was used in an accident when recording may have stopped instantly.

If you received the 2 seconds in standard mode, this implies that the recording was only 2 seconds long.

Please contact me directly if you require anymore assistance.

ReplyQuote
Posted : 31/08/2017 5:16 pm
mfino
(@mfino)
New Member

Different GoPro cameras record slightly differently. The big issue that most GoPro modes record high and low resolution video streams interleaved. When the chip is deleted, or formatted, the fragmentation information is lost. Recovery programs that expect sequential data, fail.

Do you know which model camera was being used, and where there high and low res videos.

If high and low videos, are they both just 2 seconds long?

GoPro Recovery scans the whole memory chip for fragments and then reconstructs them, normally using the existing 'moov' data. With the optional Forensic option, unfinalised fragments can also be recovered. This can be extremely useful if the camera was used in an accident when recording may have stopped instantly.

If you received the 2 seconds in standard mode, this implies that the recording was only 2 seconds long.

Please contact me directly if you require anymore assistance.

It was a Hero 5 on a 32 GB chip

When you say both videos are you also referring to the .lrv file that if i change it to mp4 it plays the same thing?

yes both are just 2 seconds long

ReplyQuote
Posted : 31/08/2017 5:26 pm
mscotgrove
(@mscotgrove)
Senior Member

If the .lrv (Low Resolution Video) file looks the same, it does indicate only 2 seconds where recorded

Do you have the Forensic option?

ReplyQuote
Posted : 31/08/2017 5:56 pm
mfino
(@mfino)
New Member

If the .lrv (Low Resolution Video) file looks the same, it does indicate only 2 seconds where recorded

Do you have the Forensic option?

I do have the forensic version V1.51

ReplyQuote
Posted : 31/08/2017 6:09 pm
Page 1 / 2
Share: