Repair a corrupt file to original mp4 file using hex editor

Question

I have a corrupt file which is .rsv file that my Sony camera produced. I have other reference files in format .mp4 which work correctly.

I have some IT knowledge and decided to inspect the two files using HxD editor. I found out that the .rsv file only contains data, whilst the mp4 is complete encapsulated with the header and footer sections.

I know where the header starts and ends for mp4 file and added it to the corrupt file, it looks something like this: (simplified)

....ftypXAVC....
XAVCmp42iso2....
uuidPROF!.O...i\
...@............
FPRF.... .......
...,APRF........

I don't understand what the footer looks like for mp4, I found that the original file had something, like moov but I wasn't quite sure where the footer begins. I tried to copy the section where I think is the footer and saved the file to mp4. I couldn't play back the video..

There is nothing on the internet about this except this https://orochena.net/howto/carving-with-scalpel/ that I might try.

Answer 1

Atom tree

There's no such thing as a footer in MP4 files. MP4 is basically a QT container and it's root sections called 'atoms' are:

• ftyp - let's call it 'header' for now
• mdat - the 'payload', the video data
• moov - let's call this the 'index' that allows a player to search in video data

These 'root' atoms (it's not an official term AFAIK) can branch into sub-atoms, you'll see the moov atom for example consists of several of these.

A tool like MP4 Inspector illustrates this branch structure nicely:

Each section is preceded by a 4 byte (Word) value that gives is the size of this atom. So for example an ftyp atom, the first 8 bytes may look like:

00 00 00 18 66 74 79 70

where 66 74 79 70 is 'ftyp' (ascii) and 00 00 00 18 is the size of the atom. This way we can walk the 'chain' of atoms:

So size of ftyp = 00 00 00 18 which in decimals gives 24. And indeed at offset 24 we find next atom.

The order of atoms is arbitrary although usually ftyp will be your first atom. However a player like MPCHC will happily play your video even if it finds mdat as first atom.

So, no footer

Anyway, a long story that I hope makes the point that there is no such thing as a footer in a MP4 container.

'Fixing' your files

ftyp:

If the only thing missing is an ftyp atom you can steal this from a video show with the same device and settings by simply inserting it using a hex editor.

mdat:

Absence of an mdat atom you can not fix. However even if you have only part of a mdat video it may still be possible to make it playable using either a hex editor if you have the moov atom or using a tool like untrunc if moov atom is missing.

moov:

A moov atom can often be 'generated' using a tool like untrunc, the tool require a 'reference file': a video made with same device or software with identical settings.

Bonus

A video that explains and repeats some of what I said + some examples of repairing a broken MOV/MP4 video using free tools only: https://www.youtube.com/watch?v=-4X-zpotg2M