Extracting MP3 frames from SD Card / Image

[ReinerSchweinlin]

Hello,

I was recording some MP3VBR with a Zoom H2, when all of a sudden, the device went out. On the SD card there is no obvious file, all file recovery-tools I found didn´t do any good (although they found everything else that was ever on this SD card....).

My idea now is to simply do an image of the 2GB SD Card and let some tool run over the raw data to simply extract MP3 frames... If I am lucky and the data is not wildly spread over the "surface" I might at least get some junks of the live concert...

Is ffmpeg a candidate for such a task?
or vlc?
any othe ideas?
how to get an image which wil work (tried testdisk, which seems to incoorperate dd, since the file ending is .dd)?

[LoRd_MuldeR]

Have you tried PhotoRec?
http://www.cgsecurity.org/wiki/PhotoRec

Despite its name, it supports much more file types than just Photo formats. According to the list, MP3 is supported:
http://www.cgsecurity.org/wiki/File_Formats_Recovered_By_PhotoRec#Multimedia

I used PhotoRec on a friends SD Card that had been formatted by accident. It made pretty good results in that case.

(In theory it should be straight forward to find MP3 frames, even if the meta information from the Filesystem are completely lost. That's because each MP3 frame starts with a Sync sequence that marks the beginning of a new frame. However there is absolutely no guarantee that the MP3 frames of your recording have been stored in sequence. If they are fragmented, your chances to restore the recording are low...)

[Ghitulescu]

Before any attempt to use any recovery tools, I would suggest (and that always means what I 'd do myself) to use a brand new SD card and lay a recording. Then analyse the format and the layout and the files within. If you can read them with a computer without any proprietary tool (from Zoom) then you may use any recovery tool, then rename the recovered file into .MP3.
I hope Zoom dropped their file system in favour of FAT32 for SD cards. Using tools designed for FAT32 on "unknown" partitions may damage them for good.

[ReinerSchweinlin]

Yes, tried it along with testdisk, It found a lot, but not the one I am looking for. I am afraid the file wasn´t closed, so there seems no complete record of it in the FAT. I am looking at the image of the SD card now and scaning with A HEX-Editor to find MP3 headers. Am I right that FF FB would be the Sync_Header of a MP3 frame?

[ReinerSchweinlin]

@Ghitulescu
Yes, it´s simple FAT, the purpose of the SD card is to use it as data-transfer to a PC so this part was easy :) Unfortunately, the zoom does not seem to tag the MP3 files it writes, I looked into another recording and there was no ID2-Header. So my hope now ist to simply look for MP3frames within the whole image, "demux" them to a new, single file and then I guess I will end up with all Mp3-Sounds in one peace, that are somewhere on the SD... At least, I could then listen for the peace I want, cut it out with some none. destructive MP3cutting tool and be good.... Probably not everything will be in order, probably something will be lost, but at least some could be recovered...

Could i tell ffmpeg or mplayer/mencoder to do this: Take this file, scan it für MP3-frames and put them in one peace into another file?

[LoRd_MuldeR]

You may use MPEG Audio Info (http://sourceforge.net/projects/lamexp/files/Miscellaneous/MPEG%20Audio%20Info/MPEGAudioInfo.2011-04-24.zip/download) to scan for MP3 frames, once you have dumped the image to a file.

However PhotoRec also works by recovering files by finding certain format-specific byte sequences (such as the MP3 frame Sync sequence). So it should be able to find+recover your MP3 files/frames, even if all FileSystem information was lost - if there still is anything to be found.

Also, many devices with Flash memory storage, which includes SD Cards, use big write buffers of volatile RAM, because writing to Flash memory is relatively slow. The data that still was in the write buffer (waiting to be written to the SD Card), when your device went off, is definitely lost, I think...

[Ghitulescu]

You'd know this for sure if you do a recording and watch its behaviour. If after pressing STOP the device reacts slowly or not at all, it may that it writes the RAM to SD, and thus the file must be lost if something happens just then (or for that matter before that).
Or watch the WRITE/ACCESS LED if it has one.
Don't confound this with normal function, as recording directly into MP3 needs the use of a buffer.

From another forum
Quick warning re battery operation
2008-09-26 08:12:33.......
- Seems that if the battery dies while you are recording the whole file is lost. Learned this the hard way when I lost some awesome jam recordings. You won't lose the whole file if you run out of space on your SD card, however.
.....

[Gavino]

Am I right that FF FB would be the Sync_Header of a MP3 frame?
The sync header itself is only 12 bits and has the value FFF.

See, for example:
http://en.wikipedia.org/wiki/MP3#File_structure

[ReinerSchweinlin]

Hy alltogether. Thanx for all the input. I did some more diging and it seems, that no data is on the SD (at least, none is found by photorec) and browsing with a hex-editor, looking for "fff" is not helping me. I get a lot of hits, but I have no means of doing something like this: "look for the headers, copy xyz bytes including the header, searhc for the next, copy it...".. I assume, that´s exactly what Photorec does, and it only finds three old files on the SD, which were test recordings of the same evening prior to the big (lost) one.

The buffer-explanation seems plausible. Odd is, that the recording ran for several hours (I assume 7... Wasn´t there when it ended), so my guess would be that at least some data should have been written (buffer flushed) in the meantime.

Would the idea "throw the whole SD-image at ffmpeg and tell it to treat it like a MP3, extract all Mp3 data" be worth investigating further? Or is it save to say that after Photorec even in Paranoia Mode didn´t find anything, I am out of luck?

Thanx again for your help :)