ufs and cr3

[Alandata Recovery]

ufs explorer pro 9.18, doesnt find cr3 files correctly.

 It finds the starts of the files and recovers them. 

But they are all 300-500 kb. cr3 files should be 20-30 MB. 

The problem is that it recognized the start of the cr3 but the cr3 contains an embedded jpeg. 

UFS then truncates the cr3 and extracts the jpeg as a jpg. 

Then it finds the next cr3 30mb further down...

--

Alandata Data Recovery -  (949)287-3282  
"Cleanroom Data Recovery of RAID, VMware, NAS, Linux, Tape, Disk, Forensics"

www.alandata.com   www.alandataRecovery.com

[DiskTuna]

If you're carving. File system based recovery should be okay.

Else try PhotoRec.

[Rames Lopes]

for cr3 files, use EaseUS Data Recovery Wizard 

--
Data Recovery Certification Group / for issue with google group please email sc...@myharddrivedied.com
---
You received this message because you are subscribed to the Google Groups "DataRecoveryCertification" group.
To unsubscribe from this group and stop receiving emails from it, send an email to datarecoverycertif...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/datarecoverycertification/85957b2f-260b-4c96-830e-abacca2c836dn%40googlegroups.com.

[jol qwerr]

basically you can create your own custom made file type (signature) search in UFS (and R-Studio)

[jpv...@gmail.com]

But arguably best in DMDE, see https://www.recoveryforce.com/forums/viewtopic.php?t=766 (Thanks Frank, forgot about that). You can try the DMDE scan sig I created, https://www.recoveryforce.com/forums/download/file.php?id=152.

--

Data Recovery Certification Group / for issue with google group please email sc...@myharddrivedied.com
---
You received this message because you are subscribed to the Google Groups "DataRecoveryCertification" group.
To unsubscribe from this group and stop receiving emails from it, send an email to datarecoverycertif...@googlegroups.com.

To view this discussion on the web visit https://groups.google.com/d/msgid/datarecoverycertification/CAKfZW8V6kXDpyh5EHg5fK7v8CbAGtM7TsATebn%2B78peupM__0A%40mail.gmail.com.

[jpv...@gmail.com]

sry I linked to v1 of the signature, in that case v2 worked better, https://drive.google.com/file/d/18q9ki0EYOpDD54NebfablltUhF3zsAWQ/view?usp=drive_link

[t...@desertdatarecovery.com]

I never thought I would see anyone recommending EaseUS in this group.

Spammy garbage software.

 

Tim Homer - Lead Engineer

Desert Data Recovery

t...@desertdatarecovery.com

www.desertdatarecovery.com

 

From: datarecovery...@googlegroups.com <datarecovery...@googlegroups.com> On Behalf Of Rames Lopes
Sent: Wednesday, October 4, 2023 5:50 AM
To: datarecovery...@googlegroups.com
Subject: Re: ufs and cr3

 

for cr3 files, use EaseUS Data Recovery Wizard 

To view this discussion on the web visit https://groups.google.com/d/msgid/datarecoverycertification/CAG68MtTSqy1yruGh2o%3DQR2ueRqC80UQVLZWCgYLjhyAsdar6cQ%40mail.gmail.com.

[juanvd...@gmail.com]

Apparently the Klennet carver is better than RStudio for pictures and cheap ?

 

From: datarecovery...@googlegroups.com <datarecovery...@googlegroups.com> On Behalf Of jpv...@gmail.com
Sent: Wednesday, October 4, 2023 3:54 PM
To: datarecovery...@googlegroups.com
Subject: Re[2]: ufs and cr3

 

But arguably best in DMDE, see https://www.recoveryforce.com/forums/viewtopic.php?t=766 (Thanks Frank, forgot about that). You can try the DMDE scan sig I created, https://www.recoveryforce.com/forums/download/file.php?id=152.

To view this discussion on the web visit https://groups.google.com/d/msgid/datarecoverycertification/em628ee63a-a3e6-478e-8988-de63e7491738%40desktop-8njf1hc.

[jpv...@gmail.com]

Yes, agreed.

Now I am always open to change my mind, for example I was surprised recently by RescuePRO for recovery of GoPro footage. So if EaseUS somehow works miracles on CR3 I'd like to know specifics. For example, getting them from a quick formatted NTFS drive using file system data scan is totally different from some scenario where files needed to be carved.

Since this is such a problem I will try to add CR3 to JpegDigger ASAP because exact carving of contiguous CR3s shouldn't be a big deal but mostly fails due to how most tools carve.

To view this discussion on the web visit https://groups.google.com/d/msgid/datarecoverycertification/004701d9f6cc%248d60e880%24a822b980%24%40desertdatarecovery.com.

[jpv...@gmail.com]

AFAIK it does not do CR3 and IMO in straight forward scenarios it may be overkill. If you need to carve photos from a hard drive or SSD, so NOT a memory card a camera is constantly writing to you're better of using R-Studio. So you can not really say A is better than B without looking at a specific scenario.

To view this discussion on the web visit https://groups.google.com/d/msgid/datarecoverycertification/04ba01d9f6ce%24cf175910%246d460b30%24%40gmail.com.

[wayne horner]

its a healthy drive where she accidentally deleted folders of pictures

its exfat

Alandata Data Recovery -  (949)287-3282  

"Cleanroom Data Recovery of RAID, VMware, Network Attached Storage, Linux, Tape, Disk, Forensics"

www.AlanData.com   www.AlanDataRecovery.com

--

Data Recovery Certification Group / for issue with google group please email sc...@myharddrivedied.com
---
You received this message because you are subscribed to the Google Groups "DataRecoveryCertification" group.
To unsubscribe from this group and stop receiving emails from it, send an email to datarecoverycertif...@googlegroups.com.

To view this discussion on the web visit https://groups.google.com/d/msgid/datarecoverycertification/85957b2f-260b-4c96-830e-abacca2c836dn%40googlegroups.com.

[jpv...@gmail.com]

Then file system based recovery makes most sense. Any half decent file recovery tool that examines file system for deleted entries should give similar result. exFAT should be able to tell the tool in advance if file is fragmented or not as this is recorded in directory. Bitmap should allow to tell recovery tool to determine if clusters are still 'free'.

Of course will fail IF clusters previously allocated to file were overwritten and/or if file is fragmented. In both cases carving won't do much good either and is impractical anyway. It also implies file type does not matter at all, fie system based recovery is file type independent.

------ Original Message ------

From: "wayne horner" <waynea...@gmail.com>

To: datarecovery...@googlegroups.com

Sent: 10/4/2023 6:10:33 PM

Subject: Re: ufs and cr3

To view this discussion on the web visit https://groups.google.com/d/msgid/datarecoverycertification/CAJEn65q%2Bayz2wt%3DuGuad91RKYo9O%2B7Rab0dfmb-by9-Bdd3paQ%40mail.gmail.com.

[Alandata Recovery]

rstudio tech creates mp4's ~30mb each

renaming cr3 allows them to open in explorer

yay

To view this discussion on the web visit https://groups.google.com/d/msgid/datarecoverycertification/CAJEn65q%2Bayz2wt%3DuGuad91RKYo9O%2B7Rab0dfmb-by9-Bdd3paQ%40mail.gmail.com.

[pbzcbf...@gmail.com]

Since the required 4 files have been recovered, albeit in two parts, could the two parts of each file be stitched together? Apparently, that's what PhotoRec users do.

[Alandata Recovery]

now the only rub is that it doesnt use the meta to give it a better name

it sees camera as cr3

it sees date taken as mp4

ufs uses that to sort and name but it make the cr3's 300kb

--
Data Recovery Certification Group / for issue with google group please email sc...@myharddrivedied.com
---
You received this message because you are subscribed to the Google Groups "DataRecoveryCertification" group.
To unsubscribe from this group and stop receiving emails from it, send an email to datarecoverycertif...@googlegroups.com.

To view this discussion on the web visit https://groups.google.com/d/msgid/datarecoverycertification/0d390888-bab1-4574-9eca-07c8c5a87fcfn%40googlegroups.com.

[jpv...@gmail.com]

In that case you can very easily create a custom signature that saves them as CR3 if you scan for ftypcrx rather then ftyp at offset 4.

------ Original Message ------

From: "Alandata Recovery" <in...@alandata.com>

To: datarecovery...@googlegroups.com

Sent: 10/4/2023 6:46:02 PM

Subject: Re: ufs and cr3

To view this discussion on the web visit https://groups.google.com/d/msgid/datarecoverycertification/CAH-%2BjWRi3kseYOSrYbz%3DvwgLQBzRQ%2B0Es9_%3D0KS3yS_6q9nHQA%40mail.gmail.com.

[Alandata Recovery]

i think the problem in making a custom signature is that it will truncate the file on the next header 300kb further down.

that would be a good experiment.

I have a 256mb vhd that I can share

https://drive.google.com/file/d/1rBsv21w3XR5C7yV8fiLb_HZFuCg4LPUr/view?usp=sharing

To view this discussion on the web visit https://groups.google.com/d/msgid/datarecoverycertification/em1e1730dc-a071-4841-9d55-199102920692%40desktop-8njf1hc.

[Mike - USBRecovery.co.uk]

Have you tried klennet  yet? 

The demo shows 4 JPGs

Status = Contiguous
Camera make and model = Unknown
Width = Width: 6000
Height = Height: 4000
Resolution = 6000x4000
Megapixels = 24
File type = JPEG

File location on media
file 0000000000000000 len 000000000019CE77 disk 0000000001466E00

I don't have a license to try an extract though. 

Fun fact - klennet doesn't open pc3000 vhdx files. 

[jpv...@gmail.com]

Yeah, JpegDigger too

To view this discussion on the web visit https://groups.google.com/d/msgid/datarecoverycertification/f51914d4-f0d1-4f1e-97d8-fc13c482ea09n%40googlegroups.com.

[jpv...@gmail.com]

DMDE with custom signature ini finds some CR3s

------ Original Message ------

From: jpv...@gmail.com

To: datarecovery...@googlegroups.com

Sent: 10/4/2023 10:12:18 PM

Subject: Re[4]: ufs and cr3

Yeah, JpegDigger too

[Alandata Recovery]

interesting that jpeg digger didnt find the last one

i suspect it needs to find a new header to trigger closing out the current find.

since the 4th file was the lsat file it doesnt find a trailing header...  maybe...

--

Data Recovery Certification Group / for issue with google group please email sc...@myharddrivedied.com
---
You received this message because you are subscribed to the Google Groups "DataRecoveryCertification" group.
To unsubscribe from this group and stop receiving emails from it, send an email to datarecoverycertif...@googlegroups.com.

To view this discussion on the web visit https://groups.google.com/d/msgid/datarecoverycertification/em2ab8dfc5-8278-44a5-b176-2101b37e21ba%40desktop-8njf1hc.

[Alandata Recovery]

rs didnt find the 4th one either....

[wayne horner]

its not finding it because windows overwrote it

there are some temp dirs that were created.

at 8:15 windows decided it needed to write a temp dir....

windows thought it needed one of these

and one of these

Alandata Data Recovery -  (949)287-3282  

"Cleanroom Data Recovery of RAID, VMware, Network Attached Storage, Linux, Tape, Disk, Forensics"

www.AlanData.com   www.AlanDataRecovery.com

To view this discussion on the web visit https://groups.google.com/d/msgid/datarecoverycertification/CAH-%2BjWS8aiKAGwoNZx62K0R8MbZM7XeSehvdRv23wQgifGWNFw%40mail.gmail.com.