Using Foremost in K...
 
Notifications
Clear all

Using Foremost in Kali Linux to recover .MP4

19 Posts
5 Users
0 Reactions
5,737 Views
(@mfino)
Active Member
Joined: 8 years ago
Posts: 14
Topic starter  

So I tried goprorecovery and foremost. I retrieved the same from both. Foremost required a little more work, but I needed to be sure. Unfortunately, it looks like the video I am looking for stopped recording within 2 seconds of start. I need to confirm that the person who recorded it actually played more than 2 seconds back of the recording. If they say yes there should be more time to the recording, what are some steps I can take? Are there any? Or should I consider the recording lost?


   
ReplyQuote
(@mscotgrove)
Prominent Member
Joined: 17 years ago
Posts: 940
 

Different GoPro cameras record slightly differently. The big issue that most GoPro modes record high and low resolution video streams interleaved. When the chip is deleted, or formatted, the fragmentation information is lost. Recovery programs that expect sequential data, fail.

Do you know which model camera was being used, and where there high and low res videos.

If high and low videos, are they both just 2 seconds long?

GoPro Recovery scans the whole memory chip for fragments and then reconstructs them, normally using the existing 'moov' data. With the optional Forensic option, unfinalised fragments can also be recovered. This can be extremely useful if the camera was used in an accident when recording may have stopped instantly.

If you received the 2 seconds in standard mode, this implies that the recording was only 2 seconds long.

Please contact me directly if you require anymore assistance.


   
ReplyQuote
(@mfino)
Active Member
Joined: 8 years ago
Posts: 14
Topic starter  

Different GoPro cameras record slightly differently. The big issue that most GoPro modes record high and low resolution video streams interleaved. When the chip is deleted, or formatted, the fragmentation information is lost. Recovery programs that expect sequential data, fail.

Do you know which model camera was being used, and where there high and low res videos.

If high and low videos, are they both just 2 seconds long?

GoPro Recovery scans the whole memory chip for fragments and then reconstructs them, normally using the existing 'moov' data. With the optional Forensic option, unfinalised fragments can also be recovered. This can be extremely useful if the camera was used in an accident when recording may have stopped instantly.

If you received the 2 seconds in standard mode, this implies that the recording was only 2 seconds long.

Please contact me directly if you require anymore assistance.

It was a Hero 5 on a 32 GB chip

When you say both videos are you also referring to the .lrv file that if i change it to mp4 it plays the same thing?

yes both are just 2 seconds long


   
ReplyQuote
(@mscotgrove)
Prominent Member
Joined: 17 years ago
Posts: 940
 

If the .lrv (Low Resolution Video) file looks the same, it does indicate only 2 seconds where recorded

Do you have the Forensic option?


   
ReplyQuote
(@mfino)
Active Member
Joined: 8 years ago
Posts: 14
Topic starter  

If the .lrv (Low Resolution Video) file looks the same, it does indicate only 2 seconds where recorded

Do you have the Forensic option?

I do have the forensic version V1.51


   
ReplyQuote
(@mscotgrove)
Prominent Member
Joined: 17 years ago
Posts: 940
 

Have you tried 'Process fragments and partial files?

You tend to get lots of small files, but sometimes some significant ones as well


   
ReplyQuote
(@mfino)
Active Member
Joined: 8 years ago
Posts: 14
Topic starter  

Yes I have a lot of fragmented files or at least what appears to be… but they are all 2 seconds, some sound like repeats and I do not see videos with that, some also sound like parts of two videos? any suggestions?


   
ReplyQuote
(@mscotgrove)
Prominent Member
Joined: 17 years ago
Posts: 940
 

Are you still using the original memory chip?

Has anything been written to card, such as a recovery program trying to undelete?

Would it possible to ftp me an image of the memory chip? I have a site that I can give you an account for. Please contact me directly if you would like that option


   
ReplyQuote
(@webyu)
New Member
Joined: 8 years ago
Posts: 2
 

If you really Want your Video Files Back,
You should consider to Seek a One-to-One solutions.
As worked on data recovery for ten years,I havn't ever see two cases with the same problem.

Why the video only play 2 seconds? Because you only have the top part of MP4 File.

So I tried goprorecovery and foremost. I retrieved the same from both. Foremost required a little more work, but I needed to be sure. Unfortunately, it looks like the video I am looking for stopped recording within 2 seconds of start. I need to confirm that the person who recorded it actually played more than 2 seconds back of the recording. If they say yes there should be more time to the recording, what are some steps I can take? Are there any? Or should I consider the recording lost?


   
ReplyQuote
Page 2 / 2
Share: