Extracting VOB file from raw .dd disk image

[jumpjack]

My HD/DVD recorder broken up.
I want to recover data from the HD, which is working and visibile to my Windows XP, which is not able to understand the format of the hard disk.

I extracted a raw .dd image from the drive, and I see a lot of occurrences of this sequence:
00 00 01 BA 44 00 04 00 04 01 01 89 C3 F8 00 00 01 BB 00 12 80 C4 E1

It should mark VOB or VRO files:

http://filext.com/file-extension/VRO
http://file.fyicenter.com/File-Extension-VOB-Video-Object-Files.html

Can I extract them with any software?

[xenex]

jumpjack-

Although I have not used it myself, I believe I have found a program that will do exactly what you need. See this:

http://www.cgsecurity.org/wiki/PhotoRec

"PhotoRec works with hard disks, CD-ROMs, memory cards (Compact Flash, Memory Stick, SecureDigital/SD, SmartMedia, Microdrive, MMC, etc.), USB memory drives, DD raw image, EnCase E01 image, etc."
"PhotoRec searches for known file headers. If there is no data fragmentation, which is often the case, it can recover the whole file."

I have nothing to do with this program, but it is GPLv2 free software and the description leads me to believe it might work for you. Hope it helps.

-xenex

[jumpjack]

jumpjack-

Although I have not used it myself, I believe I have found a program that will do exactly what you need. See this:

http://www.cgsecurity.org/wiki/PhotoRec
Thanks, I tried and it "quite" works: it successfully found several GBs of MPG files (not VOB); but there's a major issue I have to try to fix now: a single multi-GB file contains dozens of clips from different recordings, all mixed together!!! :mad:
So somewhere on the disk there should be a "map". I don't know if I'll ever be able to find and even decode it! :-(

[Ghitulescu]

IIRC, all the recordings are put together into a single big VRO file (which has the same format as a regular VOB, similar to a standard MPEG-2 since it contains no additional tracks, like multiaudio or subtitles).
I think TMPGenc DVD Author can read VRO (at least this is what I use) but I think it still needs the IFO to set the chapters/movies.
Or you can recover the VRO and split it with a MPEG-2 editor (there must be I-frames at the beginning of each recording, so even the simplest one should work). Beware at DAR changings though. It's a lot of work, but at least you'll have everything recovered.

[jumpjack]

What are "DAR changings"?

Anyway, the tool also recovered two IFO files, which I guess are not enough to "remap" the MPEG chunks...

Do VRO files have a "mapping feature" for their contents?!?

[xenex]

DAR is "display aspect ratio" as some videos are in 4:3 and some in 16:9 ratios.

Try this - rename the largest MPG file you recovered to VR_MOVIE.VRO and the largest IFO file to VR_MANGR.IFO.

The IFO file is the "map" so to speak for the VRO file. Try to load this into TMPGenc DVD Author as Ghitulescu said. This will probably be able to find all of the chapters / recordings.

I cannot guarantee this is correct, but I read it from the specs here:

http://en.wikipedia.org/wiki/DVD-VR

Good luck.

-xenex

[jumpjack]

I have only two IFOs for a couple dozens of MPEGs, there's something wrong here... :-(

[Pata]

Using scalpel maybe your program, maybe boot from a live cd and using scalpel.
Here some links:

http://www.howtogeek.com/howto/15761/recover-data-like-a-forensics-expert-using-an-ubuntu-live-cd/
http://www.forensicswiki.org/wiki/Tools:Data_Recovery

Good Luck

//Pata

[Ghitulescu]

Try to find another recorder (same model preferred), make sure you saved a duplicate of the HDD and see if it recognises it (there are chances, albeit a few, since the HDD is not the original and they may require either a hack or a new formatting - google for your own model to see details).
Unless it's a Chinese [clone], any serious recorder uses its own format (Sony, Pioneer, Panasonic etc.), recovery tools for FAT/NTSC/extfs are not suitable and can damage it. Stop using them unless you know exactly what you're doing. Never let them perform irreversible changes.

[jumpjack]

Try to find another recorder (same model preferred),

This results in getting the disk formatted...


make sure you saved a duplicate of the HDD and see if it recognises it (there are chances, albeit a few, since the HDD is not the original and they may require either a hack or a new formatting - google for your own model to see details).

I created an image using testDisk and mounted it as a virtual drive with OSFMount.
System does not recognize it, just like it did when physically connected the drive.

[qoute] Stop using them unless you know exactly what you're doing. Never let them perform irreversible changes.[/QUOTE]

As i said, I'm playing with its image. :D

[jumpjack]

For the records, I'm trying this program:
http://www.advanced-file-recovery.com/smart-price.htm

It's digging into the image, and progress gauge says it found 1722 files up to now (50% done), to be compared to 800+ files found by photorec.
Unfortunately, photorec is free, but Advanced File Recvery costs 40 bucks.
It's not that much if you have precious files to recover, but this is not my case (I guess for 40$ I could buy DVDs for those 4-5 movies I have on the HD :) )

[Ghitulescu]

For the records, I'm trying this program:
http://www.advanced-file-recovery.com/smart-price.htm

It's digging into the image, and progress gauge says it found 1722 files up to now (50% done), to be compared to 800+ files found by photorec.
My 500GB HDD from the SAT PVR, which stores each recording in a file + 3 descriptors/indexes (ie 4 files and 1 directory for each recording) is much below 400 files. A HDD-DVD-recorder genearlly use either a single file for all recordings + some indexes, or a file for each recording plus a master index. 800+ files are a bit too much, let alone 1700+, unless, of course you had stored photos and MP3s.

Concerning the HDD reformat, yes I know, that why I explained this in that message, however there are tricks not to let the recorder perform it (I know for Panasonic, for Pio one needs the service disc, no experience with Sony or JVC, the last should be like Panny).

[jumpjack]

Never mind, the program ended finding 3000+ JPG files.... but I didn't store ANY image in the disc; indeed, opening each file results in... nothing!
Don't understand.

In the meantime, I found "scalpel for Windows", but I have to investigate about its use, its a commandline tool.

[Ghitulescu]

Never mind, the program ended finding 3000+ JPG files.... but I didn't store ANY image in the disc; indeed, opening each file results in... nothing!
Don't understand.

.... recovery tools for FAT/NTSC/extfs are not suitable and can damage it. Stop using them unless you know exactly what you're doing.

That's why .... :)

[jumpjack]

So why does it find thousands of files?!? It looks like an hoax: being a payware, it makes you believe it finds thousands of your precious files, so you eventually buy it to be able to save those files... then you find out they're just fake!

[jumpjack]

False positive: it found over 3000 JPEG files... but there wasn't ANY JPEG file on the hard disk, program just "invented" them.
No VOB or MPEG found.

[jumpjack]

False positive: it found over 3000 JPEG files... but there wasn't ANY JPEG file on the hard disk, program just "invented" them.
No VOB or MPEG found.

[Pata]

Look at this video instruction. At 14:35

http://revision3.com/hak5/commandv

Scalpel conf
https://github.com/int0x80/anti-forensics/blob/master/scalpel.conf

For vob
MPG|VOB y 2500000 \x00\x00\x01\xba \x00\x00\x01\xb9

[jumpjack]

Cool tip, I'll give it a try.
Thanks.