MP4, MOV and 3GP: how Frame Witness recovers them

How they are found

MP4, MOV and 3GP are ISO base media files: a sequence of boxes (ftyp, moov, mdat). The scanner looks for the ftyp, moov, mdat and wide box names and follows the box sizes to the end of the file. HEIC and AVIF photos use the same structure and are told apart by their brand.

Fragmented clips

When a clip was stored in pieces and the file system no longer says where they are, Frame Witness uses the clip's own index: the moov box at the end lists the position and size of every sample. Starting from the first piece, it follows the video sample by sample and checks that each one is framed exactly where the index expects it. When the framing stops matching, it looks for the next piece, first nearby and then across the whole source, and accepts it only when several consecutive samples fit there. If more than one cut point remains possible, the result is marked as ambiguous. A rebuilt clip is a hypothesis: correct framing does not prove that the compressed bytes are the original ones, and the original files are never used as input. Since 1.0.10 this also works when a piece ends in the middle of a frame.

Interrupted recordings

An MP4 or MOV writes its index at the end of the recording. If the camera stopped before writing it, Frame Witness can rebuild an index with the help of a complete video recorded by the same camera with the same settings, which gives the codec configuration, the time scale and the frame duration. The media bytes are kept unchanged, the video track is rebuilt and the audio is not, and the result is labelled as a derived reconstruction, never as the original file.

Measured on generated videos

All 4 generated MP4, MOV and 3GP videos on the formats test image came back with identical SHA-256 in Frame Witness. The image holds one short generated video per format, stored contiguously among zero-filled space and decoys, with no file system. It shows that the format is found and walked to its exact end; it does not show how often real cards keep these videos in one piece.

What cannot come back

• Overwritten data. Bytes that new files replaced are gone for every program.
• Full and overwrite formats. A full format in Windows writes zeros over the volume; an overwrite format or a wipe does the same with other patterns.
• SSD TRIM. A drive that receives TRIM usually erases freed blocks itself.
• Encryption without the key. A BitLocker volume, or a phone with file-based encryption, cannot be read without its key.

Try it on your own source

Download Frame Witness for Windows (version 1.0.14, Authenticode-signed by Aurelio Avila, SHA-256 fa22d6c7f97da0b4e5efa889e5abb9e4d98815a9b76ac0087424944b21bad6c2). The free account gives a quick scan of the first 8 GiB, up to 100 results, previews and saving files up to 1 MiB each; full scans and larger files need a licence, with current prices on the pricing page.

Related

• Formats Frame Witness recovers
• Test results and how they were measured
• Recover overwritten or interrupted video on a card or dashcam