Can someone point me in the direction of some articles/research of movie deletion and what happens to movies when there stored in unallocated space?
(ie pointers lost and stored as individual images?)
Thanks in advance
L
Movies are just files. There is nice video on this web site relating to What happens when files are deleted.
Files are not moved to unallocated space, but the space they are in becomes marked as unallocated
Well i have a deleted movie that has turned into JPEGS, so I'm assuming movies alter slightly on moving to unallocated.
Greetings,
Why did you start a new thread for this? It looks like we were already discussing this issue with you in another thread.
As mscotgrove points out, movies are just files. When they're deleted, they are treated like any other file. Two of the things that can happen are
1) The file system will no longer track what sectors on the disk make up the file. If the file is fragmented, you may not be able to reconstruct the whole file.
2) Some sectors may be reused, overwriting the original data.
There are a lot of detailed explanations of this. One of the best is Brian Carrier's _File System Forensics_. Most good computer forensics classes cover this early on as it is a foundational element.
-David
Well i have a deleted movie that has turned into JPEGS, so I'm assuming movies alter slightly on moving to unallocated.
What led to that conclusion? Could it be that the user extracted JPG images from the movie, and deleted both the movie and the JPGs?
I've come across the scenario in about 15 separate cases, full movies (including popular ones) are all images within unallocated space, secor after secor, in order. If scrolled through fast they have the full content of that movie , each image capturing a different screen by milimeters of movements.
This leads me to think movies are altered some how, or there is a movie format that this occurs? Possibly streaming a movie online and images stored in cash, which then are deleted??
I've come across the scenario in about 15 separate cases,
Interesting. Have you done any analysis to see what kinds of viewers the users may have used? Were there any temp files in the TIF folders?
Not really any analysis as it hasn't been needed until now. Current case is standard, windows media, avi player, VLC. I have not done any online checking to see what streaming websites have been used time is bit pressed.
Has anyone come across this? additionally, is anyone aware of online streaming services where images of the streamed content is stored in cash? This could explain it.
Many digital cameras that have video capability use an AVI format whereby individual frames are stored as jpegs. While allocated the user will see only a single AVI file. However, within that file each frame has a jpeg header. Thus, any file finder looking for the header will recognize each as a separate jpeg image file. Most of these cameras are creating 30 frames per second of video so you can see how they pile up.
As far as the "popular" movies go, it could be that they were converted by a program using a similar format.
I think you shold try and invesitgate the file system to see how these files have become part of the unallocated space. Look for deleted files - very easy with NTFS, and scan the whole disk for directory stubs if FAT32.
As everyone says, files are not changed when deleted.