Hi Folks,
I am attempting to recover a deleted video nasty from an iPhone 3GS (model A1303) using Scalpel 2.0.
The results are a little confusing as we have a large number of files 10MB in size.
I know that scalpel can only carve files if they are stored as one file (i.e. not split up & stored all over the memory chip).
Does anyone know how an iPhone stores video files?
Is Scalpel the right tool for this job?
What are the results actually telling us?
I was thinking that the files may have to be reconstructed. I looked at Defraser but I think I am barking up the wrong tree!
Your thoughts would be most appreciated
What is the type of video, AVCHD, 3GP, MOV, AVI etc
Hi,
It was recorded using the iPhone so we think its an .mov file
Regards.
Is the device running iOS 4+ and is PIN protected? If so, the unallocated space will be encrypted and the recovery of deleted video won't happen unless the unallocated space is decrypted.
My software will attempt to process fragmented .MOV files as part of the carving process. The success rate is very varied. It will not cope with any encryption that Hitman mentioned.
nsbuck - I am sending you a PM
I have the same problem with PhotoRec, some mov files are readables while others do not.
Mscotfrove what is the name of the software you are talking about ?
CnW Recovery
I'd also take a look at Defraser from NFI http//defraser.sourceforge.net/
Also worth a read is this white paper that I co-wrote with Kevin Mansell http//
Well there is only one method to get the data back of any iPhone if you had the proper backup of the data that you have been created before losing your iPhone data. While transferring files different devices such as iPod to iPhone, you can also use
Thankyou for your input,
We have managed to recover one of the videos discribed and the audio file, but still working on getting both of them to align with each other, however in the great scheme of things, it is not that important.
The second video of interest we have only partially recovered, I think that this could be down to a missing header and possibly an incomplete video (i.e the iPhone has fragmented the video and stored sections all over the memory), therefore we have to attempt to knit together fragments.
Regards,
Neil