-1

A 60 GB external USB drive was formatted by someone. I copied the bytes one-by-one by dd command to a file and named it backup.dd file. Then I used photorec to recover the files. Many smaller files are recovered except one specific big mpeg video.

The strange thing is that the largest recovered file is a swf flash file of 1.6 GB in size which shouldn't be there. Nobody remembers such a file. That's strange.

Anyways, what else can I do to recover the missing file?

UPDATE

The missing mpeg video which is not recovered by any tool, should be the largest one. It should be larger than 2 GB or 3 GB.

Looks promissing

The Wondershare Recoverit software suggested by the accepted answer is actually showing me the big videos which I was looking for. I'm seeing them, but I cannot push the recover button since I didn't purchase the software yet. It looks promising:

Wondershare Recoverit screenshot: found big videos

Megidd
  • 289

2 Answers2

1

This might not be practically doable. What has likely happened is the file has been dispersed over multiple parts of the disk, with the filesystem being used to link the parts. This indexing has likely been destroyed when the file system was formatted.

Photorec and similar work by looking for file signatures and then reading as much as they can. This works well for images and videos where there is no fragmentation but breaks down where the file is fragmented.

In order to further your endeavours you have the very difficult (almost impossible) task of finding the missing fragments and reassembling them. It may depend a bit on the format of the mpeg video, but if its a highly compressed format, there are likely to be very few, if any, markers to help with this.

I've never tried it, so its not a recommendation but the advanced version of Wondershare Recoverit purports to be able to scan, match and merge video fragments. The reviews seem to indicate its legitimate, but be careful of automatic rebilling of your credit card each month if you don't cancel.

davidgo
  • 73,366
0

Finally, with Wondershare Recoverit, 1h17m out of a 1h27m video is recovered. Meaning only the last 10m of the video is not recovered.

Timeline of what I tried

  1. The first thing I did with the formatted external drive was to make a copy of the raw data by:
sudo dd if=/dev/sdb of=backup_vfat.dd status=progress
sudo sync
  1. The backup_vfat.dd file was more than 60G. I placed it inside a Windows drive and ran Wondershare Recoverit on the whole drive. This way, only 27m of the 1h27m video was recovered. The details are here:

A video of 1h27m duration, only plays up to 27m

  1. I used dd command to copy the raw bytes into an external drive by:
sudo dd if=backup_vfat.dd of=/dev/sdb status=progress
sudo sync
  1. I ran Wondershare Recoverit on the external drive. Then, 1h17m of the 1h27m video is recovered. I don't have the last 10m of the video. That's the best I could do.
Megidd
  • 289