GoPro Recovery (gpr.exe from CnW Recovery Developments Ltd)
GoPro Cameras
All current GoPro cameras will be
supported
GoPro produce a range of video cameras. Each one has
different ways that data is recorded, and so the recovery
process is different for each one. The notes below describe
some of the main features of each recording method.
o
GoPro Hero
o
GoPro Hero 2
o
GoPro Hero 3. Supports multiplexed low and high
resolution recording.
o
GoPro Hero 4. Supports multiplexed low and high
resolution recording.
o
GoPro Hero5. Supports multiplexed low and high
resolution recording
o
GoPro Hero 6. Supports multiplexed low and high
resolution recording and RAW photos
o
GoPro Hero 7 including GPS
o
GoPro Hero 8 including GPS
o
GoPro Hero 9 including GPS
o
GoPro Hero 10 including GPS
o
GoPro Hero 11 including GPS and greater than 4GG
files size
o
GoPro Hero 360 MAX
GoPro Base model.
This camera records data out
of sequence with the second part
of the logical file recorded first.
The video data does include JPEG
images, often used as a file
thumbnail
GoPro Hero 2
Technically it is very similar to
the Hero 3 described below, but
only supports high resolution video
GoPro Hero 3
This camera saves the video data with high and low
resolution physically interleaved on the memory chip. Once
all video data is saved, then both header blocks (ftyp and
moov) are written. To recover the data it is necessary to
determine which data block belongs to which data stream,
high or low resolution, and to which ftyp and moov atom. It
is not possible to do this type of recovery by data carving but
the GoPro recovery software is the result of extensive
development to resolve this problems. The result is
normally perfect low resolution video and extremely good high
resolution. Occasionally on FAT32 memory chips, there may be a
small glitch on high resolution video - a small problem we hope
ultimately to resolve. JPEG files may also be saved on the memory
chip.
To recover unfinalised, or truncated video it is necessary to
locate the start of a possible data run. This will be at the start
of a cluster, but there are at least two variations where the first
frame starts at offset 0, or offset 4. Once detected, the video
stream is then reconstructed, and the moov atom created to
allow the video to be played. This is currently under
development for the forensic version of the software including
separating two interleaved video streams.
GoPro Hero 4, Hero 5, Hero 6, Hero 7, Hero 8, Hero 9, Hero 10,
Hero 11 and Hero Max
The Hero 4/5/6/7/8 range is similar to the Hero 3 above except
the order of the atoms is different. On the Hero 4/5/6/7/8
/9/10/11 the ftyp is immediately followed by the mdat. At the
end of the recording, the moov atom is added. As in Hero 3
high and low resolution
streams are interleaved
give the same recovery
issues. JPEG files may also
be saved on the memory
chip. One significant
change with Hero 11 is that
files may be larger than
4GB, and obviously must
on exFAT rather than FAT32