SANYO数码相机中被删除视频的恢复  

Recover the Deleted Video Data from SANYO Camera

作　　者：黄步根[1] 黄政[2] 刘建军[2] 

机构地区：[1]江苏警官学院,江苏南京210012 [2]南京市公安局网络安全保卫支队,江苏南京210005

出　　处：《信息网络安全》2011年第9期143-144,155,共3页Netinfo Security

摘　　要：MP4文件由一系列段组成,每个段的开头有1段长和段名,各占4字节,第1个段总是ftyp段,最重要的是mdat段,视频内容在此段,其数据关系在moov段,free段是空闲内容,用于填补数据簇。实验研究发现,SANYO数码相机拍摄MP4视频数据时的存储不连续,根据段分割为5个部分。根据MP4文件形成轨迹,结合MP4文件的结构可以恢复删除的视频文件。An MPEG-4 file is made of a number of discrete units called segments. The begin for every segment is the name and the length. The fop segment is always first. The most important part of an MPEG-4 file is the mdat segment, in which consist of the video data. However, the hierarchies of the mdat segment are in the moov segment. The free segment is used to pad the data cluster. It is found by experiment that the file created by SANYO camera does not storage sequentially, but in 5 parts. Researching the trace created by SANYO camera and the data structure of MPEG-4 file, we can recovery the deleted video file.

关 键 词：SANYO 视频 文件结构 文件存储 计算机取证 

分 类 号：TP309.3[自动化与计算机技术—计算机系统结构]