HowTo: Fix filesize of rescued/carved media files

[peter_b]

This HowTo describes, how to fix the size of files carved out, using a data rescue tool like "Restorer2000 or Scalpel file carving tool.
These tools may extract too much data (or a fixed number of bytes) after the file header is found.
This results in media files which are larger than they actually should be. They just contain data garbage at the end.

Luckily, most of audiovisual file formats have information in their file header, where the data inside actually ends.

For example, I've rescued WAV files from an 8GB SD card - but the recovered files were 19GB in total.
Since there couldn't have been 19GB of WAVE files on an 8GB card, this clearly indicates, that the files were not truncated correctly.

We can use FFmpeg to rewrite the files, truncating them to their correct length, without losing any data - or necessity to re-encode lossy compressed audio/video.

Here's the command for FFmpeg to read a WAVE file, and copy its audio data as-is (without modifications) to a new output file:

Code: Select all

$ ffmpeg -i $OVERSIZE_WAV -c copy $OUTPUT_WAV

This creates a filesize-corrected copy of $OVERSIZE_WAV and writes it to "$OUTPUT_WAV".

For example:

Code: Select all

$ ffmpeg -i carved_0001.wav -c copy size_fixed-0001.wav

The parameter "-c copy" makes sure that data is copied and not (re-)transcoded or edited during the process.

On Linux systems, it's easily possible to write a 1-liner which loops over a set of files and create size-corrected copies:

Code: Select all

$ for FILE in *.wav; do ffmpeg_git -i $FILE -c copy $FILE-fixed.wav; done

The resulting files will be smaller and cleaner than the carved out versions.