About

Tag cloud

(all)

Archives

01 Jul - 31 Jul 2006
01 Aug - 31 Aug 2006
01 Sep - 30 Sep 2006
01 Oct - 31 Oct 2006
01 Nov - 30 Nov 2006
01 Dec - 31 Dec 2006
01 Jan - 31 Jan 2007
01 Feb - 28 Feb 2007
01 Mar - 31 Mar 2007
01 Apr - 30 Apr 2007
01 May - 31 May 2007
01 Jun - 30 Jun 2007
01 Jul - 31 Jul 2007
01 Aug - 31 Aug 2007
01 Oct - 31 Oct 2007
01 Nov - 30 Nov 2007
01 Dec - 31 Dec 2007
01 Jan - 31 Jan 2008
01 Feb - 28 Feb 2008
01 Mar - 31 Mar 2008
01 Aug - 31 Aug 2009
01 Sep - 30 Sep 2009
01 Jan - 31 Jan 2010
01 May - 31 May 2010
01 Jun - 30 Jun 2010
01 Aug - 31 Aug 2010
01 Sep - 30 Sep 2010

Links

Search!

Last Comments

Alvaro Oliver (StackBook Part 4 …): Hey! nice post. I just bo…
Tiago Gomes (Let's start again…): ok, now feel happy, you a…
Tiago Gomes (Let's start again…): ok, now feel happy, you a…
ir0nhide (StackBook Part 4.…): Very cool, nice work
Toby (Gigabyte, LCDs, a…): Good stuff, although now …
luke (StackBook part 3 …): what are you planing to u…
Toby (A quick rant...): Bastards
Hugh (StackBook Part 2 …): Nicely done, but you now …
gm (StackBook Part 2 …): Hmm, I plan to go a littl…
luke (StackBook Part 2 …): i cant help but wonder if…

Stuff

Powered by Pivot - 1.40.4: 'Dreadwind' 
XML: RSS Feed 
XML: Atom Feed 

I have it.

Wednesday 01 September 2010 at 11:12 am First part
Second part

This is an ongoing saga, and if you don't know what this is part 3 of, the previous two parts are linked above.

Right, so we know where the file starts, we know where it ends, and we know that the file should be pretty much linear as the card was empty. Screw the FAT, let's just read this thing from the clusters.

#!/usr/bin/env python
import sys
numReservedSectors = 38
bytesPerSector = 512
sectorsPerCluster = 8
numFATs = 2
fat1length = 7771648

def clusterToBytes(cluster):
    firstDataSector = (numReservedSectors * bytesPerSector) + (numFATs * fat1length)
    address = (((cluster - 2) * sectorsPerCluster) * bytesPerSector) + firstDataSector
    return address

print clusterToBytes(0x0005CDF3)



Bring in some values. Define a function to convert clusters to bytes.
From the first bit, we know where it starts.


File found: 4621 clusters (18 MB), start 0005CDF3



So run the program and we get:
1573685248 which is 0x5DCC8800

From the second bit, we know that it is supposed to end at 0x05EED5800. Then we found that the data really ends at 0x0614B3600.


start = 0x05DCC8800
middle = 0x05EED5800
end = 0x0614B3600

size = end - start

f = open(sys.argv[1],'r')
f.seek(start)
a = f.read(size)
f.close()

f = open("recovered.avi",'w')
f.write(a)
f.close()



Running this results in many more frames and a bigger audio track.

Here's the last frame:



and here's the video:

Recovered Crash Video final version from gm on Vimeo.

Linkdump