I have a client who needs some deleted video recovered from a video camera with an embedded 40GB "mini" hard drive. It seems that this would be possible with access to the hard drive, but I hate to take a screwdriver to this video camera until I talk to someone that maybe has dealt with the same problem. Any thoughts? Thanks All!
Try connecting to a USB port on a PC. I have successfully imaged such drives, and then recovered the files (using my CnW Recovery software), but there are many other ways to do this.
Get the drive image, and then work on the data
If the PC cannot see the drive, it will be necessary to take the camera to bits
You're right. Silly me for not just trying to plug it in. Too many years of being a "don't touch the power switch" and "make sure you use a write block" guy. Anyway, both WinHex and FTK Imager recognize the physical media, so making an image will be a piece of cake. Then, we'll see about recovering deleted video files, but we'll cross that bridge when we come to it, which may be in a few hours. Thanks!
The disks I've seen have been FAT32. Don't forget that a FAT32 when deleted takes away the uper 16 bits of the cluster pointer so attention is required to recover files with clusters more than 64K
I was able to recover deleted files on a sony 30gig camera. I used FTK to carve the disk.
Thanks mscotgrove and zerolift. I own a camera similar to that of the client and was able to do some practicing on that. Making an image of the physical hard drive was a piece of cake. Although FTK only was able to recover 1 of the 3 video files that I purposely deleted as a test.
Zerolift, you mentioned that you used FTK to "carve" the disk. Out of the file types that FTK can carve, video doesn't seem to be one of them. Did you use the actual FTK "Data Carve" engine, and if so, which file category encompasses video? When I processed the image in FTK (no data carving, just regular processing and indexing), FTK recognized all 3 video files that I deleted as "deleted files", but I was only able to export out 1 of them. The 2nd deleted video file seems fine in FTK but the exported file comes up with an error when you try and play it. The 3rd file has a logical size of the correct size but shows a physical size of 0, so of course there is nothing to export. Thanks Zerolift for any additional insight.
I wish I could be notified when posts are responded to.. Sorry for the 1 month late reply… I was able to recover the file with no issue so maybe I was just lucky. What was your final result?
The client decided not to go forward with the project, so no final result really. I just have my results with my test camera which was as I indicated earlier. I'm glad you were able to recover video files with no problems. Leads me to believe that if it ever comes up again, that I should have pretty good luck. Thanks for the reply!