DV (MiniDV and DVCAM): how Frame Witness recovers it

How it is found

Raw DV files (.dv) are captures from MiniDV and DVCAM camcorders. The stream is a run of frames, each made of 10 (525/60) or 12 (625/50) DIF sequences of 150 blocks of 80 bytes in a fixed order, and every block carries its own section, sequence and block number. Frame Witness walks a recording frame by frame and ends it at the first block out of place, so text or other data can never pass for DV. DV inside an AVI or MOV file is carved through those containers.

Measured on generated videos

Both generated DV (MiniDV and DVCAM) videos on the formats test image came back with identical SHA-256 in Frame Witness. The image holds one short generated video per format, stored contiguously among zero-filled space and decoys, with no file system. It shows that the format is found and walked to its exact end; it does not show how often real cards keep these videos in one piece.

What cannot come back

• Overwritten data. Bytes that new files replaced are gone for every program.
• Full and overwrite formats. A full format in Windows writes zeros over the volume; an overwrite format or a wipe does the same with other patterns.
• SSD TRIM. A drive that receives TRIM usually erases freed blocks itself.
• Encryption without the key. A BitLocker volume, or a phone with file-based encryption, cannot be read without its key.

Try it on your own source

Download Frame Witness for Windows (version 1.0.14, Authenticode-signed by Aurelio Avila, SHA-256 fa22d6c7f97da0b4e5efa889e5abb9e4d98815a9b76ac0087424944b21bad6c2). The free account gives a quick scan of the first 8 GiB, up to 100 results, previews and saving files up to 1 MiB each; full scans and larger files need a licence, with current prices on the pricing page.

Related

• Formats Frame Witness recovers
• Test results and how they were measured
• Recover overwritten or interrupted video on a card or dashcam