Test results and how they were measured

What these numbers are

Measured on images and media we prepared ourselves; not an independent corpus and not a certification. Every figure is copied from a test receipt, and the source lists each receipt with its SHA-256. "Identical" means the recovered file has the same SHA-256 as the original. Originals are used only to score the results, never as an input to the scan.

Formats image

One short generated video per container (17 in total, made with validation/make_formats_image.py), each stored once at a 1 MiB boundary of a zero-filled image, plus decoys that only resemble video and 8 MiB of random bytes. Result: 17 of 17 identical; none of the decoys was reported as a video.

Windows-formatted disk images

Three 2 GiB virtual disks, formatted by Windows, holding the same six test videos (H.264 and HEVC, 60 to 403 MB, with one pair written in alternating blocks so that both are fragmented; on the exFAT image the pair is interleaved in small blocks, as a GoPro writes its MP4 and LRV files): FAT32 and exFAT after a quick format, NTFS with the files deleted. The images were left unchanged by the scan.

A real USB stick

Verbatim STORE N GO, 62 GB USB stick, FAT32: six H.264/HEVC test videos (60-403 MB) copied, two of them written in alternating 8 MiB blocks so both are fragmented, then a Windows quick format. Result with the Frame Witness 1.0.9 engine: 6 of 6 recovered with identical SHA-256 and decoded to the end; one further .webm remnant (1.8 MB) decodable, not one of the six; 4 contiguous and 2 rebuilt from the video index, 0 unreadable bytes, scan read directly from the stick in 4.3 hours.

Fragmented test images

16 generated videos, one per format, cut into pieces among random data with no file system. Version 1.0.10 recovered 13 identical with the pieces in order and 12 with the pieces shuffled, up from 6 and 4.

Limits of these tests

All images and media were prepared by us; none is an independent or blind corpus. These results describe these images; they are not a recovery rate for real devices. Not tested yet: physical SD cards, hard drives, SSDs (only emulated), failing hardware, Windows 10 and phones.

Repeating them

The generators are in the validation folder of the source (make_formats_image.py, the VHD scenarios, prepare_test_stick.py). Each receipt and its SHA-256 is listed in validation/seo-evidence.json.

Try it on your own source

Download Frame Witness for Windows (version 1.0.14, Authenticode-signed by Aurelio Avila, SHA-256 fa22d6c7f97da0b4e5efa889e5abb9e4d98815a9b76ac0087424944b21bad6c2). The free account gives a quick scan of the first 8 GiB, up to 100 results, previews and saving files up to 1 MiB each; full scans and larger files need a licence, with current prices on the pricing page.

Related

• Formats Frame Witness recovers
• Quick format vs full format: what can be recovered
• Recovered media you can document