Canon R6 CR3 format

[davey]

Hi Guys,

i`m having pita after recovery of CR3 files made with Canon R6 from 2TB Toshiba MQ04.
After headswap 99.7% of surface was imaged&scanned by every commercial tool i know (ufs, rstudio, klennet, etc.) but none of them can find even one these CR3s, while other files were recovered correctly (i.e. CR3 from Canon M50).

Is there any magic about this camera file format that i`m not aware of or any tool that is specialized in Canon R6`s?
Thanks for any tip

Regards,
Davey

[lcoughey]

How did you image it? With the SMR Toshibas, things can be difficult and messy.

[Joep]

I wasn't aware of this, would expect CR3 = CR3 (which in turn is pretty much structured like an MP4).

Lemme see if I can find some samples.

[Joep]

Do you have file system? If so, share a few R6 CR3 you recovered with file system (not carved).

[Joep]

When it comes to carving there's no difference M50 vs R6 made CR3 files. So something else is happening.

cr3-r6-m50.jpg (171.16 KiB) Viewed 46076 times

[davey]

How did you image it? With the SMR Toshibas, things can be difficult and messy.

PBA mode, as usual in MQ04 translator was corrupted. Image should be ok, other files (even ~1GB MP4`s), are valid on all surface (till the end of HDD capacity). No possibility of "normal" reading mode in this case.

Do you have file system? If so, share a few R6 CR3 you recovered with file system (not carved).

FS (mft) in this case is damaged beyond repair due to PBA reading, no CR3 samples :/ Cient sent me 3x photo from the same R6. Just compared file headers with yours - the same :/
No idea what`s going on, maybe some setting in camera itself involves file header change (but i doubt it), it`s still under investigation, i`ll share solution if found

Regards,
Davey

[davey]

... one more thing, all carved Canon R6 CR3's are 357KB, headers are correct. Samples attached.



Regards,
Davey

[Joep]

Seems to me carver makes an error.

m50 file structure is ftyp - moov - mdat
r60 file structure is ftyp - moov - free - mdat

It is as if the carver decides to end carving when it encounters the 'free' atom. I bet if it just continued and ignored the free atom the CR3 could be correct.

Can you share the intact ones, 3 or so, from his camera, I only have a few I got from internet? Perhaps we can come up with a EOF rule.

[davey]

Of course, i`ve sent You PM.

Regards,
David

[fzabkar]

It is as if the carver decides to end carving when it encounters the 'free' atom. I bet if it just continued and ignored the free atom the CR3 could be correct.

I notice that PhotoRec "recovers the mdat atom as a separate file". Would it be possible to use PhotoRec to carve the data and then stitch the two parts of each file together with a .bat script? That appears to be the approach taken by PhotoRec users.

https://git.cgsecurity.org/cgit/testdis ... file_mov.c