Recovering m4v Files

A place for general discussion of sleuthkit.org projects or other open source forensics software.

Moderator: carrier

Recovering m4v Files

Postby edjferg » Thu Feb 05, 2015 5:03 pm

I cannot determine how to recover m4v files deleted from a hard drive. Does TestDisk, Foremost, Photorec or Scalpel search and recover for m4v files? I've tried finding info for the config files but come up empty on what to do. I've also tried entering the m4v switch at the command line and in Autopsy but receive error messages when using that extension. Anyone have any suggestions?
edjferg
 
Posts: 1
Joined: Thu Feb 05, 2015 4:57 pm

Re: Recovering m4v Files

Postby Hoyt » Fri Apr 17, 2015 4:05 am

PhotoRec doesn't recognize .f4v files by default, but you can add the extension to the list. See the instructions here.
Hoyt Harness, CFCE
Hoyt
 
Posts: 73
Joined: Thu Dec 11, 2014 4:02 am
Location: Little Rock, AR

Re: Recovering m4v Files

Postby carrier » Fri Jul 10, 2015 1:17 pm

We're going to do some tests here to verify this will work (i.e. that we are giving it the right command line arguments) and will update the documentation on where to find the PhotoRec config file. Thanks.
carrier
 
Posts: 45
Joined: Thu May 15, 2014 3:31 pm

Re: Recovering m4v Files

Postby sidheshenator » Fri Jul 10, 2015 7:29 pm

Create a file photorec.sig in your home directory.
This photorec.sig file must contain the newline-delimited file signature/s of the file/s that you want to recover.
For example, a user wants to recover foo.bar. The header signature of foo.bar is 0x41414141.
The user must add a line -
bar 0 0x41414141

to photorec.sig where bar is the file extension, 0 is the signature offset, and 0x41414141 is the header signature.
sidheshenator
 
Posts: 3
Joined: Fri Jun 05, 2015 7:14 pm


Return to General

Who is online

Users browsing this forum: No registered users and 1 guest

cron