Recovering iPhone 3GS video files

While it is possible to recover video files from the iPhone 3GS, it is not a simple task. After considerable research, here’s what I’ve found:

1. Partial recovery is possible
2. Metadata recover (date/time, GPS, etc.) is also possible even if the video is not recoverable
3. Due to wear-leveling algorithms, recovery of the full videos is not always possible.

Point 3 is what is really making things difficult.  The larger the the file is, the more fragmentation occurs which Apple (and other vendors) implement in an attempt to use the storage evenly to avoid disproportionally wearing out parts of the drive.  One researcher I collaborate with stated:

“The spare data at the end of the blocks holds the key.  We at least figured out that the available data sheets are wrong.  We can piece together information based on available logical sector numbers, but they are sometimes missing or corrupted.”

A lot of research will have to go into the closely guarded wear-leveling algorithms different vendors use in order to recover the larger files.

Also far as the specific 3Gs video file format, we pieced together the file signature/magic numbers for the file format.  They are:

Header: 0000 0014 6674 7970 7174 2020 0000 0000

Footer: 2f00 0004 0066 7265 6500

After the footer, there is a series of all 0′s but we have not determined if it is a fixed amount or dynamic based on file size.  Stay tuned for more updates.