Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Any reason the data couldn't be carved out with photorec[0]? It even has flv built in, but even if it didn't, creating new types isn't hard. This type of datacarving seems exactly what that software was designed for, and it does so quickly with a wizard.

The taking of the 500K bytes for the has does seem like a smart way to differentiate between the undeleted files and the deleted ones, I'll keep that in mind if I am ever in such a crazy situation and it would be helpful.

[0] https://www.cgsecurity.org/wiki/PhotoRec#How_PhotoRec_works



Given that they mentioned there was a small bit of corruption at one point in the video, I think photorec might even do a better job.

My guess as to the cause of that corruption is that the file was slightly fragmented, but the fragments were pretty close together, and streaming video formats are resilient enough to tolerate some garbage in the middle of the stream.

IIRC photorec should be able to handle this.


The thing that tolerates the garbage is the decoder. The format says what’s valid and how to read/write it.

Depending on your platform and what codec is used during playback, the corruption may be handled differently. The player might crash.

Best to scrub the file and properly reformat to remove corruption.

Another crazy thing - if the corruption is indeed due to fragmentation, the garbage bytes may in fact be another customer’s data! Or your company’s data, or whatever, you just don’t know.

You’re handing out random blocks of your disk to a customer, embedded in a video.

Depending on the type of business you run, you might not want to do this.


> The thing that tolerates the garbage is the decoder. The format says what’s valid and how to read/write it.

The format also gives the decoder ways to re-synchronize with the stream. That isn't guaranteed to be possible for arbitrary formats.


Would be good to have that installed on the disk in future, but he mentioned he immediately put the disk in read only mode, so couldn't install new software


You don't need to have it installed on the disk, just run it from wherever.


It probably could've, and PhotoRec is iirc designed to ignore not-deleted files. (This also means that PhotoRec is useless if you formatted your drive, but scalpel still works.)




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: