Hex editing to save a mix (or, amateur file forensics 101) : 無料・フリー素材/写真
Hex editing to save a mix (or, amateur file forensics 101) / Schill
| ライセンス | クリエイティブ・コモンズ 表示-継承 2.1 |
|---|---|
| 説明 | This is a story about 0-byte .wav files and how you should always hit "stop" on your recording device so it updates the FAT, wave/RIFF headers and whatnot with the complete and correct file metadata. In my case, I forgot to hit "stop" and pulled the power. 😂I might have screwed this up further by first attempting to fix the volume in OS X's Disk Utility, vs. running DOS/Windows' chkdsk. If you're stuck with a 0-byte file and reading this in future, before touching anything else, put the device in write-protected mode if you have the option, and make a full image of the disk; then try the Windows chkdsk route and see if "automated" repair is possible. Here's a YouTube video about the chkdsk path.The Taperssection forums has a thread that may provide useful. Additionally, yonder for some wave/RIFF header details.A little historyMy first encounter with hex editing was as a kid, editing strings in computer games to make them say things they wouldn't normally. Later in the 90s, I did the same to make custom Windows autoload spash screens and sounds by modifying the executable from the "Plus!" CD. Code signing was not much of a thing back then. 😂Back to the present...I finished recording a live 4.5-hour DJ set at a local bar/lounge, and promptly unplugged my MicroSD-based audio recorder from its external power supply without thinking to hit "stop" first and finish the recording to disk. 😰Tech bitsThe Tascam recorder I use has an option to split recordings on the 2 GB file barrier. As this was a 4.5-hour recording, I had one 2 GB file intact and another one with a file size of zero bytes by the end of the night.I knew the data was somewhere on disk (this device can't have much of a RAM buffer or anything,) but whatever data was written wasn't being reflected in the volume's regular file system as you'd see in Finder / Explorer. It appeared the file's wave/RIFF header had not yet been written, either, but there was at least a FAT / directory entry for the file. (It's been a while; my knowledge of file systems is rusty at best.)RecoveryA relatively-inordinate amount of time and various FAT32 recovery tool attempts* later, I realized I could probably just find the raw wave/RIFF binary data via programs like HexFiend (Mac) and HxD (Windows), after creating a byte-for-byte image of the MicroSD volume in its entirety.Hex editing to the rescueBy searching for the bytes at the end of the first good file in the disk image and exporting from there through the end (effectively, copy/pasting "all bytes on this disk image minus the FAT and the first big 2 GB file"), I figured I'd have most if not all of the missing data left to sift through.From there, a "Raw Data" import from Audacity (since this slice lacked a wave/RIFF header) using Signed 16-bit PCM, Little-endian, 2 Channels (Stereo), 0 bytes offset, worked out pretty well. I got two different blocks of audio, recovering everything that was missing.There was one small corrupted block of a few seconds that I had to delete, but it seems the rest of the mix was intact. I suspect this corruption was from hidden spotlight files and other crap being written to the disk by OS X, and paradoxically, one recovery tool, clobbering this "unused" data taking space on disk. Boourns.Success?The mix itself was not the best, but it was the opportunity to recover needlessly-lost work, right a wrong, and maybe learn something that counted. 😉* Most recovery tools did not find the missing data, presumably because it wasn't referenced by the FAT, nor obviously identifiable as audio data - I'm guessing - without a wave/RIFF header. Active Partition Recovery's "Last Chance" scanning option did pick up on about 75 minutes of missing data, but what it pulled was ultimately not the right slice. |
| 撮影日 | 2019-01-06 21:08:09 |
| 撮影者 | Schill |
| 撮影地 |