R-Studio fails to identify some AVI files (merges two files together)
Posted: Fri Jun 05, 2020 11:55 pm
In some instances R-Studio fails to identify valid AVI files, instead merging them with the one before. Attached below is a ZIP archive containing two RAR archives[1], each containing a 2.7GB AVI file extracted by R-Studio 8.7 [2] and affected by this issue. Each file contains in fact two valid and complete files. As mentioned in that other thread, those files appeared in the “Extra found files” virtual directory for the second partition of a 500GB HDD, called “Système”, whereas the original files were in fact located on the third partition, called “DATA” ; and so on “DATA” are the 4 actual files corresponding to those 2 composite files as identified by R-Studio in “raw file carving” mode. Using WinHex I compared each file with its counterpart, to check if they were strictly idendical (they were), then initialized (filled with 00) the contents except 64KB from the header and 64KB from the footer.
The files with these headers were identified :
The files with these headers were not :
On file 0537928.avi, the second original AVI file starts at offset 1465663488.
On file 0537932.avi, the second original AVI file starts at offset 1468846080.
For each one of these composite files, there's no slack space between the two valid file that they contain, meaning, file 2 starts right after the end of file 1.
[1] It was necessary to shrink the size enough so that it would be accepted ; apparently the limit for RAR files is ~250KB (I couldn't find any accurate information on that matter in the FAQ, which seems to be a generic one for all forums using the same template).
[2] It may have improved in the mean time, but I had enough issues when I updated to 8.10 that I decided to stick with 8.7 until there was significant incentive to update again.
The files with these headers were identified :
Code: Select all
– beginning of 0537928.avi
52494646C03B5C57415649204C495354
7E2200006864726C6176696838000000
ECA20000000000000000000010010000
50400300000000000200000000000000
D0020000300100000000000000000000
00000000000000004C49535494100000
– beginning of 0537932.avi
524946466ECE8C57415649204C495354
7E2200006864726C6176696838000000
ECA20000000000000000000010010000
A7D50200000000000200000000000000
D0020000800100000000000000000000
00000000000000004C49535494100000
Code: Select all
– middle of 0537928.avi
5249464636095840415649204C495354
D82200006864726C6176696838000000
C2A20000D58603000000000010090000
D1970100000000000200000000001000
D00200002C0100000000000000000000
00000000000000004C495354DC100000
– middle of 0537932.avi
52494646D23F8240415649204C495354
C22200006864726C6176696838000000
ECA20000FBD902000000000010090000
F7160200000000000200000000001000
80020000620100000000000000000000
00000000000000004C495354DC100000
On file 0537932.avi, the second original AVI file starts at offset 1468846080.
For each one of these composite files, there's no slack space between the two valid file that they contain, meaning, file 2 starts right after the end of file 1.
[1] It was necessary to shrink the size enough so that it would be accepted ; apparently the limit for RAR files is ~250KB (I couldn't find any accurate information on that matter in the FAQ, which seems to be a generic one for all forums using the same template).
[2] It may have improved in the mean time, but I had enough issues when I updated to 8.10 that I decided to stick with 8.7 until there was significant incentive to update again.