As a result of a question on a Video Forensic forum, rather than give a limited answer, I thought I would attempt to post a more concise solution to dealing with proprietary video from surveillance systems.
Video Forensics is one field where the bigger the toolbox the better – the more software and hardware you have at your disposal, the more chances you have of getting to a quick result…and the first hurdle is getting something to play.
There is not one single solution available and I would be very wary of any company trying to sell you a system that purports to.
Having access to all three major Operating Systems does help. Windows is a must, and then a Linux distribution can be run from inside a Virtual Environment. Up until recently I used Ubuntu but have now moved to Linux Mint. I just prefer the interface and find it slightly cleaner.
Having access to a Mac may be more difficult but I am finding it increasingly helpful in certain situations and I will mention this and more on Linux later.
OK, firstly you need to organise yourself. You need to remember what you have used in the past and what works with what. The computer does all the hard work – so you don’t have to actually remember anything!
Over time you will receive an entire archive of proprietary players and files.
Every disk you get, save the player and an example of the video file. I use the following naming convention for my Software Folders:
The first part is the name on the player or the manufacturer, with the version number after this. Then, separated by underscores are the file extensions that the player plays.
I sometimes also place a text file in the folder with some notes in that can be added to over time.
The problem is that you end up with loads of players installed and loads of (what I call) RunOnly programs housed in your Software folder. (These are programs that don’t install – they run automatically from within their own folder).
To manage all of these and have some search facility, you can either use Windows itself or a file launcher/manager such as Berokyo.
Every program sits on a shelf and each program link has tags that are searchable. If I enter h264 into the search bar, only players that have been tagged with h264 will show up. If I start to enter Dedicated Micros – as I start typing, only players beginning with D will show.
You could have “shelves” for
Something like this is great for software, but what about example files?
In Windows 7, the search facility within each folder is really useful. Whilst in your Software archive folder, just enter .vvf (or whatever file extension you are looking for) in the search bar, and within seconds the folders appear containing the example footage, the players and your notes on each one.
Now, you may say that you could use this method for your players instead of a launcher like Berokyo. Alot of players can deal with a number of different file extensions and some, although they are not listed, do play others. A launcher is much more flexible.
You could also make your own launcher. There are many WYSIWYG (What You See Is What You Get), software builders available. For may years I have used Multimedia Builder. Although this has not been maintained for quite some time, it still works within Win7 (Not tested in Win8), and has very good user based support forum.
There are good online resources for Law Enforcement that can assist in obtaining proprietary players and these should be utilised whenever needed. One or two are only available from within national Police networks but some are located on the www and can be used if you are identified as law enforcement.
Media-Geek DME Resources
There are many more on my Useful Links Page.
This brings us nicely onto Standard Players.
These are either purchasable or freeware and are designed to play standard formats.
Windows Media Player(WMP)
These players fall into 2 different types
Those that have the video decoder built in those that don’t.
WMP uses codecs that are installed in your PC. If you do not have the codec, the video won’t play, or won’t play properly. When installing the player, it will also usually install a set of codecs aswell.
In contrast, players such as SMPlayer and VLC have their decoders built in. They use a library of filters to decode a video stream and play it correctly.
Elecard – Not free but this player does well in dealing with h264 video streams that have been ‘tweaked’.
I have also configured an SMplayer to include a number of Codec dll’s. See HERE!
These players use different decoder librarys so failing with one doesnt mean that another won’t work. They also have different capabilities regarding how the video is displayed or controlled.
IMPORTANT: How a video has been encoded, has an effect on how it gets decoded. In tests, using three different encoders to create a WMV 9 format video inside an ASF Container, there were varying amounts of distortion and frame dropping when tested inside a number of players. You may mistakenly assume that you have a corrupted video file, when in fact, its just that the player cannot decode it correctly.
Now then, to get the flexibility of a wrapped up freeware player into WMP, you can install the FFDshow Codec and Filter. This again helps out as its very configurable.
Remember – Dont install any of this stuff on your clean edit suite, all of this is for your playback system (Or within a Virtual Environment).
Proprietary players and codecs will eventually screw up your system. The power of virtualisation has now entered the software world. See HERE to learn how you can turn an installable player into a stand-alone ‘App’.
Warning: you may get a video play…you may think it is ok…is it? Are there other camera streams? Are you seeing all the frames? Check and check again before stating a fact! This is especially important when you end up using a player that was not specifically designed for that format. Is the player interpreting the video as the DVR manufacturer intended. Or, conversely, is the player giving you more information, and displaying the video correctly.
It’s at this point that Siraview needs to be mentioned. As far as I know, this is the only universal player designed specifically for surveillance video. Rather than using the manufacturers program or codec and hiding it behind an interface, Siraview decrypts the stream itself. This means you have far more control on the video rather than be restricted by the proprietary software. It deals with over 100 formats and is definitely worth looking at. Free trials are available for some testing. This is for PLAYBACK and visual assessment only.
If I am still having playback issues then I quickly take a look at the media and the data on a Mac. There are one or two programs now that can assist but a player with good results is MplayerX. This uses the FFMPEG and Mencoder libraries and I have had footage play in here and nothing else – on any other OS! (to my frustration – I still don’t know why).
Finally it’s off to Linux. There are many tools and players available for this OS and its way beyond the scope of this blog to go into them all but I have mentioned one or two in other blog postings:
Over the past few years, the Windows builds for ffmpeg and other command line tools have been made a lot easier to access and use. Also, the GUI front ends have been improved. My main weapon of choice at present is anotherGUI. I have also mentioned this HERE
A simple ‘ffplay’ of a file can sometimes save you lots of time. Quick guide to command line tools.
Lets get back to Windows….
Whilst doing all of this investigation into how to play the file – we should try to understand what it is and that will help us to narrow down the players we try?
The results from the file investigation can then be used in any reports.
In no particular order here are a few that I use:
Supereasy Codec Checker
AVIcodec – Not further developed but posted here as the site does contain a lot of very good links
The information held within the videofiles metadata may help you understand what the file is and this may push you towards one program rather than another. It is also quite usual for the video file to have some information held at the start of the data. This is only viewable in raw hex. There are lots of hex viewers / editors but I find this quick and easy to use.
HxD – Freeware Hex Editor
At the start of the file, held within the text, you may see remarks to the DVR used or the manufacturer. Using these details and then heading over to google may provide some useful information.
Getting deeper into hex…..you may also find that knowing the hex code for certain video formats helpful.
000001 = mpeg4 frame.
FFD8 = start of jpeg (for mjpeg streams)
Doing a search for these will assist in narrowing down exactly what video format you have.
So, say you establish that your video is made up of jpeg images.
Using a program like jpegsnoop will detect the jpeg files and you will be able to extract them.
On a connected note, a program like Defraser detects the hex code in a number of formats and Containers and is able to extract the streams. I have varying results with Defraser but on the times that it has worked I have been very grateful!
Talking of streams….
ASF streams – There are one or two manufacturers wrapping their archived footage into wmv files that actually contain more than one asf video stream. Each stream is a camera angle.
Microsoft Media tools include a stream editor that enables you to pull these apart into separate files. This is no longer available from the Microsoft site as the tools have been replaced by Microsoft Expression. You can still find it on various forums though.
So, after trying everything – I still cannot get the video play and have exhausted all my web research.
Its then a visit to the premises or a telephone call to the original video source owner. The research continues inside the DVR by looking at the model number, the motherboard number or even the chip make and ref numbers.
In all of the above, I have not mentioned Virtualdub (one of my favourites). Not only is this a player, it also gives me information and it can cut and extract video and still images. This is included in my Software Pack that is available from my BOX of shared files on the right.
Lastly, what about entire Hard Drives from DVR’s? Due to the thousands of weird and wonderful recording methods. It is not a simple option….but things are going to get easier. DVRx , by Amped, is being developed to assist in the reading, reviewing and extraction of DVR HDD’s. There are a few manufacturers that have thought about this and make their drives readable through some client software. It is also possible in some cases to manually carve the data out using Data Recovery tools. These are not easy options however.
- Save and structure the storage of files and video examples
- Don’t install inside a clean machine – use a virtual environment
- Attempt to virtualise player installs as you go
- A simple spreadsheet can be used to log and link to software / players etc
- Understanding and identifying the video type will help you in getting it to play
- If you are having problems, there is a good chance someone else in the world has also had the same issue. Google is your friend!
Please remember that this is just for your initial playback and investigation. For further in-depth analysis and clarification you are going to have to utilise some of the software’s more detailed functions or move over to dedicated Forensic Video Analysis Hardware and Software. A full list of these can be found HERE.
There is a search function at the top left of every page on Spreadys.com that can be used to see if your format or tool has been discussed before. I hope it helps?