Searching for IFrame

[msr999]

Hi,

I want to recover iframes from deleted mpeg files. Since files can be fragmanted, it might be too difficult to recover complete files. So, I am looking to just recover iframes that can give glimpse of the actual video file. I might not be able to recover all iframes but as many as i can.

Since I will be looking at raw data from a disk, I will not know if it belongs to a mpeg file or not. I will need to search the disk for a bit patter to detect the begining of an iframe. I am thinking I should search for picture layer start (0x0010) and then see if the next 3 bits are 001. This will tell me if it is begining of an iframe.

Does this make sense? Is this workable? Assuming this can work, If I do find the begining for an iframe how can i calculate how big the iframe is? Can I figure out how to decode this iframe to display data?

I am new to video. So i sound stupid please excuse me. Appreciate your help.

Thanks a lot.
msr

[blutach]

First try recovery software, to see if you can recover the file. Recuva is free. If that is no good, you can look for picture start codes (0x 00 00 00 01). The next 10 bits are the temperal seq number and the next 3 bits determine the frame type (001=I frame). Then, you will need to retreive the whole sector plus other sectors making up the frame.

If you do this manually, you will go grey before you are finished.



Regards

[msr999]

Thanks. Problem with recovery software is they dont work well if the file is fragmented. They will only recover the first part of the fragmanted pieces.

Anyway, how can I calculate the length of the frame once I find the picture start code?

Thanks,
MSR

[msr999]

I am assuming that data is stored in consecutive sectors. If an iframe is fragmented and stored in non-contiguous sectors then I can't completely recover it but if it stored in contiguous sectors I am hoping I can, provided I know the length. Hence the question how to calculate the length of the frame and second part is how to decode it given that I wouldn't know what codec was used to encode the original media. Currently, I am thinking I will run it through all popular codecs and see if any one of them can successfully decode it.

[blutach]

Why would the data be stored consecutively? It almost never is (unless you did a defrag immediately before deleting, in which case, your argument against recovery programs is spurious).

You need to look here for details of MPEG encoding, to find out frame lengths etc. That info is also stored on sourceforge somewhere.

Regards