Post edited 3:40 am – December 15, 2009 by ahoog
Chrity,
This question has been coming up a lot more lately. We have had one case which needed 2 videos recovered and it is very difficult. In fact, we even have trouble carving files that we could see just by opening the .dmg file. As you may already know, I posted some details at:
http://viaforensics.com/iphone…..ideos.html
Since the files are larger, they are not contigious. I believe a combination of the wear-leveling algorithm and how the flash memory is structured/managed is making this a very difficult task. We never were able to find the deleted videos but I put the following on R&D list so you might find them acceptable next steps:
1. To prove the deleted videos existed, I look for GPS coordinate which can be stored as part of the mp4 envelope.
2. I also was going to look for the time/date which is probably some sort of primitive integer format (for instance, in SQLite3, date/time is stored as a 4-byte 2’s compliment number which you can then convert to Unix epoch)
Also, bear in mind the 3g[s] videos have a container and then 2 mp4 streams, one for audio and one for video.
If you make progres, please share your findings. Thank and good luck.
Andrew Hoog
Chief Investigative Officer
http://viaforensics.com