Forum

Post edited 3:40 am – December 15, 2009 by ahoog

Chrity,

This question has been coming up a lot more lately.  We have had one case which needed 2 videos recovered and it is very difficult.  In fact, we even have trouble carving files that we could see just by opening the .dmg file.  As you may already know, I posted some details at:

http://viaforensics.com/iphone…..ideos.html

Since the files are larger, they are not contigious.  I believe a combination of the wear-leveling algorithm and how the flash memory is structured/managed is making this a very difficult task.  We never were able to find the deleted videos but I put the following on R&D list so you might find them acceptable next steps:

1. To prove the deleted videos existed, I look for GPS coordinate which can be stored as part of the mp4 envelope.
2. I also was going to look for the time/date which is probably some sort of primitive integer format (for instance, in SQLite3, date/time is stored as a 4-byte 2’s compliment number which you can then convert to Unix epoch)

Also, bear in mind the 3g[s] videos have a container and then 2 mp4 streams, one for audio and one for video.  

If you make progres, please share your findings.  Thank and good luck.

Andrew Hoog

Chief Investigative Officer

http://viaforensics.com