I have it.
Wednesday 01 September 2010 at 11:12 am First partSecond part
This is an ongoing saga, and if you don't know what this is part 3 of, the previous two parts are linked above.
Right, so we know where the file starts, we know where it ends, and we know that the file should be pretty much linear as the card was empty. Screw the FAT, let's just read this thing from the clusters.
#!/usr/bin/env python
import sys
numReservedSectors = 38
bytesPerSector = 512
sectorsPerCluster = 8
numFATs = 2
fat1length = 7771648
def clusterToBytes(cluster):
firstDataSector = (numReservedSectors * bytesPerSector) + (numFATs * fat1length)
address = (((cluster - 2) * sectorsPerCluster) * bytesPerSector) + firstDataSector
return address
print clusterToBytes(0x0005CDF3)
Bring in some values. Define a function to convert clusters to bytes.
From the first bit, we know where it starts.
File found: 4621 clusters (18 MB), start 0005CDF3
So run the program and we get:
1573685248 which is 0x5DCC8800
From the second bit, we know that it is supposed to end at 0x05EED5800. Then we found that the data really ends at 0x0614B3600.
start = 0x05DCC8800
middle = 0x05EED5800
end = 0x0614B3600
size = end - start
f = open(sys.argv[1],'r')
f.seek(start)
a = f.read(size)
f.close()
f = open("recovered.avi",'w')
f.write(a)
f.close()
Running this results in many more frames and a bigger audio track.
Here's the last frame:

and here's the video:
Recovered Crash Video final version from gm on Vimeo.