Movie or image?

Are you sure that is not just an AVI file. An example AVI file I am looking at has JPEG headers, and trailers every approx 16K. If you are searching for a sector starting FF D8 FF E? then you may find some, as you say, several seconds between them.

Do you have a AVI header "RIFF AVI LIST" ?

A large AVI could well be fragmented, but you may be in luck with a continous one

The search that I've initiated looks for JPG headers so id assume it wouldn't pick up avi headers. The unallocated images are i would estimate no more than 1 second apart and there are about 200 of them, with the occasional image missing(1 in 20) but apart from that scrolling through it looks like a movie.
The starting hex is the standard yoyu header (FFD8FFDB).

The header is FF D8 FF E? (not a second D8)

When it finds the JPEGs are they in following sectors, ie at the end of the previous one. If so, then it indicates that they are separate photos. )I have WebCam software that will do this, just write 'small' JPEGs every few seconds )

If you find JPEG starts in any area of a sector, then it is more likely to part of a movie.

Hi,

A quick explanation of movie file encoding may help explain the data you are seeing. There are a lot of standards and variations within the standards, but I'll try to just cover the basic principles, and then come back to the situation you are examining.

1. Raw Video
Totally raw video is just a series of frames. Without any compression, this is a large amount of data when stored as a file or a high data rate when transmitted, for any reasonable picture size and frame rate.
[Raw Video Data Frame 1]
[Raw Video Data Frame 2]
[Raw Video Data Frame 3]
…

2. Compressed frames
On step to reduce the transmission rate and/or storage size for a video file, is to compress each frame separately; For example, to code each image as a JPEG image. The MJPEG standard does exactly this (in one of its forms), as commonly used by old digital cameras for their 'movie mode' and by webcams, usually either at a fairly low resolution and/or low frame rate in order to keep the data rate or file sizes manageable.
[Compress(Raw Video Data Frame 1)]
[Compress(Raw Video Data Frame 2)]
[Compress(Raw Video Data Frame 3)]
…

3. Compressed sequences of frames
Compressing each frame individually does not take advantage of the fact that each frame in a sequence often only differs slightly from the previous one; Video coding techniques therefore often use this knowledge to reduce the overall data rate. This is done by independently coding every Nth frame as before, but for the frames in between a differencing is performed, and only the difference information is saved/sent as the data for that frame (and this is also typically further compressed). This differencing can be just in comparison to previous frame, to both previous and following frames, and a large range of techniques are used to compress this data further by use of predictive methods etc, and is known as inter-frame coding. The MPEG standard uses these techniques (and more).
A simple example would be
[Compress(Raw Video Data Frame 1)]
[Compress(Difference(Raw Video Data Frame 2, Raw Video Data Frame 1))]
[Compress(Raw Video Data Frame 3)]
…

For more detailed information on the above, search for information on Video Codecs on the web or many books will give good descriptions with pictures which will be much more informative than my quick summary above; Description of an MPEG codec is a good example.

To relate this back to your original question and the data stored on the disk.
- Given the above description of video compression, hopefully it can be seen that the encoded data may consist of a series of individually coded frames (such as for MJPEG) or occaisional individually coded frames with inter-frame coded frame data between (such as for MPEG video).
- Even when individually coded frames are present, they will not necessarily have typical image-file headers; in some cases the frame data can be carved out and a file header attached to view the image, in others the data format does not allow this.
- Additionally depending on the multimedia file format the data may have video and audio data interleaved within it.
- Further, for some multimedia data file/stream formats additional data will be interleaved, for example for an MPEG transport stream file the data will have been broken down into 188-byte chunks with headers attached, for transmission purposes, so this protocol has to be parsed prior to re-assembly of the data for decoding.
- Normally, if the header of the video file is available then the 'type' of compression used can be identified. This is because the video file will usually either confirm to a standard format, or be in a 'container' format such as AVI which itself supports many formats inside and uses a code (called the 'fourcc' code) to identify the codec which should be used to view the file (codec = "codec-decoder", i.e. a processing entity that converts raw video frames to the encoded data and back).

In terms of your orginal question regarding the data you are seeing, you have described

I've picked up images which look like they are from a .avi file, as the shots of the images are seconds apart and if scrolled fast its looks like a movie. Do you know what movie ext files do this when being deleted? or is this standard( ie movies deleted results in that movie being viewed as many images in unallocated until overwritten?)

As others have said, when a movie file (or any other file) is deleted the data itself is unaltered. The images could be part of a video file, but from your description it sounds more like they are a series of separate image files, e.g. maybe a sequence of images captured from a webcam?, and that the image files have been deleted, causing you to see a series of images in unallocated space which form a sequence.
They could also be part of a video file, though if all the image file headers are present, and all align to the start of a sector, this would seem quite coincidental, and it would only be possible to tell by examination of the data either side of the image itself for other multimedia file data or location of the file start for multimedia file header information.

Second question, is there software out that would put these images back into a movie? or would it be best for Court if i view each image as a separate image, and not state it was probably a movie before being deleted?

Yes there is plenty of software which can take a series of images and turn them into a movie. Whatever you choose, be careful with regard to compression, to avoid losing detail. Without further information, I would not state in court that this was "probably a movie", however I see nothing wrong with describing it as a series of images which appeared to have been captured sequentially, which can thus be viewed in sequence as a "movie" and then display it as such.

Hope the verbose description wasnt too much, and the above info helps.

Phil.

Thanks for all your replies, very helpful. Phil, thats just what i needed thanks for that. I will be going down the route of 'the x number of images could of been a movie' but there is no certain way of telling.

Regards
L