SSF Files with BKPlayer.exe

The BKplayer.exe comes in a variety of flavours and is linked with various different file extensions. The specific one I am dealing with here has come on an optical disk which presents the contents as seen in the image below.

If things are looking different for you, you may find that your specific version is mentioned in another page:

Part 2

Part 3

Part 4

BKPlayer file and folder structure

Note the icon for the player. There are different versions with different icons. The specific version can be found be reviewing its properties.

BKPlayer File Properties

Wouldn’t it be great if companies placed their details in here along with some contact details? There are no company details anywhere on the player.

If you have a player that is single screen only but you appear to have files relating to different cameras then check this out! SSF Files with BKPlayer – Part 2

Within the DATA folder, there is a folder with a date/numbered naming convention, and then inside that there are two large files with the .ssf file extension. This must be our video!

First, lets see if the video will play with the player.

BKPlayer Interface

The player suffers with the usual lack of information with no ‘About’ or ‘Help’ area and no details on the video type or make-up.

In the top right corner of the interface, there is a folder icon that when selected gives the option to search for video. If you have copied the contents of the disk to your HDD in order to investigate the contents you can’t just navigate to the folder and select the file. You have to open the folder with the BKPlayer in and then the program itself will identify that there is a DATA folder. It will then present the SSF files to you for selection.

Finding the SSF Files!

It would appear that although the player supports multicamera playback, the person conducting the export in this case has created a file for each camera. Although this can cause a problem if viewing a number of cameras, its actually better when we come to start analyzing the video.

Effective playback using the BKplayer seems to be rather hit and miss. I noted that when paused and using the frame fw function, I could only move approx. 10 frames before it froze. Hitting play again would unfreeze it. This caused problems when trying to establish frame rate. I couldn’t move forward and count the image changes. One of the cameras also appeared to skip frames. This was an obvious concern and required further inspection.

The third icon down gives the ability to export an ‘avi’. By selecting this, the interface displays the time duration of the selected SSF file.

By reviewing the SSF Files I recorded that:

Ch03 had a time duration of 3 minutes 21 seconds,

Ch05 had a time duration of 3 minutes 19 seconds

Upon the creation of the new avi’s, these were examined in Gspot and MediaInfo. Both avi’s were Divx 5.0 format with the DX50 4CC code. Both had a GOP structure of IPPPP.

Ch03 – 4513 Frames, 22FPS, 3 minutes 25 seconds

Ch05 – 2509 Frames, 12FPS, 3 minutes 29 seconds

I finally compared the raw data from the avi’s to that in the original SSF’s.

Comparing Hex

We now have a problem. The footage has been transcoded, the duration’s have changed and when reviewing Ch05, it plays very slowly. For some reason the transcoding process has slowed it down – Its got the frame rate wrong!

The conclusion here is that those AVI’s are not worth much and are pretty unreliable.

Back to the SSF’s….

MediaInfo gives us some useful information:

Video
Count : 248
Count of stream of this kind : 1
Kind of stream : Video
Kind of stream : Video
Stream identifier : 0
Inform : 352*288 (1.222), AVC (PAL) (Baseline@L3.0) (1 Ref Frames)
Format : AVC
Format/Info : Advanced Video Codec
Format/Url : http://developers.videolan.org/x264.html
Commercial name : AVC
Format profile : Baseline@L3.0
Format settings : 1 Ref Frames
Format settings, CABAC : No
Format settings, CABAC : No
Format settings, ReFrames : 1
Format settings, ReFrames : 1 frame
Format settings, GOP : M=1, N=24
Internet media type : video/H264
Codec : AVC

As both SSF’s had been identified as H264 streams I used FFMPEG to wrap up the video into a standard avi container.

FFMPEG -i filename.ssf -an -vsync drop -vcodec copy -f avi out.avi

I told FFmpeg to wrap the video using avi (-vcodec copy -f avi) but to ignore the audio (-an) and most importantly to rewrite the Presentation Time Stamp (-vsync drop).

The resulting files played and scrubbed perfectly within Virtualdub when using the ffmpeg input driver. The I frames were also identified in the GOP structure. I also compared and verified the raw data was present in both the SSF and the new avi.

Scrubbing through the Video in Virtualdub (Imaged blurred on purpose)

Due to the timecodes being removed from the new avi, in order for it to play correctly, a frame rate needs to be established.

For Ch03, this was the total frames (4518) divided by the duration of the video in seconds (201). This equates to 22 FPS.

The result to all this was that I now had a correct piece of video that I could analyze effectively. There were two questions though…

Was it possible to analyze the original SSF before wrapping it into an avi and how to deal with the other camera that appeared to have an incorrect frame rate?

I have been using FFmpeg for a while but this seemed to be a job for FFprobe. This program, that comes along with FFmpeg, attempts to open an input file and then probe it for information. Its similar to a lot of video information tools and is actually used as a backend for a few of them. However, if you use it from the command line, you can see whats going on and get the information you require.

Although its possible to do the first bit here in Windows, I chose to do both in Linux. The reason is that in the second part, I am going to only output specific information into a text file. To do this I will use the GREP utility that is not as easy to get done in Windows.

ffprobe -show_streams -count_frames -pretty /home/david/Desktop/14263902.SSF > /home/david/Desktop/Stream-FrameCount.txt

The above  command results in a txt file being created with the following information… (remember when saving these from Linux to use in Windows – you have to change the encoding from Unix to Windows. That way your text will appear in the same format).

The text file:

STREAM]
index=0
codec_name=h264
codec_long_name=H.264 / AVC / MPEG-4 AVC / MPEG-4 part 10
profile=Baseline
codec_type=video
codec_time_base=1/50
codec_tag_string=[0][0][0][0]
codec_tag=0x0000
width=352
height=288
has_b_frames=0
sample_aspect_ratio=0:1
display_aspect_ratio=0:1
pix_fmt=yuv420p
level=30
timecode=N/A
is_avc=0
nal_length_size=0
id=N/A
r_frame_rate=50/2
avg_frame_rate=25/1
time_base=1/1200000
start_time=N/A
duration=N/A
bit_rate=N/A
nb_frames=N/A
nb_read_frames=4518
nb_read_packets=N/A
[/STREAM]

Obviously, we knew a lot of this from parsing the SSF file through MediaInfo but we didnt know the frame count until we created the .avi. By using this we can get the frame count directly from the original file.

Then it’s time to identify the GOP structure and individual frame types.

ffprobe -show_frames -pretty /home/david/Desktop/14263902.SSF | grep ‘pict_type\|coded_picture_number’ > /home/david/Desktop/FrameID.txt

This will output a text file showing each frame number and its associated frame type, part of it is seen below…

coded_picture_number=21
pict_type=P
coded_picture_number=22
pict_type=P
coded_picture_number=23
pict_type=I
coded_picture_number=24
pict_type=P
coded_picture_number=25
pict_type=P
coded_picture_number=26
pict_type=P
coded_picture_number=27
pict_type=P
coded_picture_number=28
pict_type=P

From this I can now verify my frame readings in Virtualdub. Comparing these resulted in a positive match.

If I had not used Grep to narrow down the output, my result for each frame would have been the text below:

[FRAME]
media_type=video
key_frame=1
pkt_pts=N/A
pkt_pts_time=N/A
pkt_dts=N/A
pkt_dts_time=N/A
pkt_duration=48000
pkt_duration_time=0:00:00.040000
pkt_pos=0
width=352
height=288
pix_fmt=yuv420p
sample_aspect_ratio=N/A
pict_type=I
coded_picture_number=0
display_picture_number=0
interlaced_frame=0
top_field_first=0
repeat_pict=0
reference=3
[/FRAME]

See the following posts for updates on dealing with FFprobe outputs

FFprobe and Powershell

Update on I frame Only Extraction

So, the first question was answered…It is possible to analyze the SSF file and obtain the information needed so you can create the wrapped avi along with a correct frame rate (by adding -r 22 to the ffmpeg command) and then verify the GOP structure between the two.

Lastly, the other camera that suffered with the missing frames.

As I stated earlier, the player was difficult to use in order to establish exactly what was going on and why it was skipping during playback. I followed the same methodology for this camera so I could now get the file out and check a few things. It would appear that the missing frames was as a result of a poorly instigated Video Motion Detection system. There are small gaps in the video when there is low movement. This is not clear in the player and does not come across when using the players inbuilt export to avi function. The export function doesn’t know there are gaps so it stretches the video to fit the time scale – thats why it appeared in slow motion. This is very important to note as it could cause a lot of confusion and misunderstanding if these exports are used.

There is a lot of information on FFprobe online and all the various options that it can output. Hope it helps!

Part 2 – The Single Player

Advertisements

19 comments on “SSF Files with BKPlayer.exe

  1. Pingback: FFprobe and Windows Powershell | Spreadys Space

  2. Pingback: SSF Files with BKPlayer.exe – Part 2 | Spreadys Space

  3. Pingback: SSS Files with BKPlayer.exe – Part 3 | Spreadys Space

  4. Pingback: SSF Files with BKplayer.exe – Part 4 | Spreadys.com

  5. Hello. I was looking for an application that could read ssf files. I searched for “BKPlayer.exe” and “Multi Backup Player”, but could not find it as a download on the Internet.

    For the benefit of other folks who might need a program that can read ssf files, I have placed an ssf player on my google drive, so others can download it. It came with my DVR card. The file name is SSF_STL_Stream_Format_CCTV_camera_video_player.zip. The download link is: https://docs.google.com/uc?id=0B0DonYAabkWAU0tPUlhzMEtLa1E&export=download

    FYI.

    • Thanks Kris, that one is a slightly newer version to one included in the BKPlayer.zip. As a result, I have added it to the collection. Thanks for posting.

  6. Spready,
    Having an issue loading some ssf files from a DVR we recovered.
    Exported them directly from the HD using UFS explorer and when I try to open any of them with bkplayer i get a file header corrupt message for every single SSF file. Dont know where to go from here.

    • Hi there, You ‘may’ have the ssf files that are not related to bkplayer. I am aware of a number of systems that store there data in ssf but actually export them as something different. The ssf is purely a container format for when they are inside the DVR. Have you tried hex analysis to confirm stream type etc? That may identify a method to play.

    • Hi there,
      its in the box widget down the right side of my blog… but to save you looking- its…. validate

      I had to put a password on to stop automated bot trawlers. They were eating my bandwidth!

  7. Hello,

    I have downloaded your version of the bkplayer. However, I try to play a video clip and it just hangs on ‘loading’.

    Grateful if you can provide some assistance.

    Thank you

    • Hi there
      As you can see, from the 4 posts dedicated to this overly complicated video file type, it’s not an easy one to specifically nail down and there are many variables.
      Have you tried all the players? Did the export come with a player that also suffered with the ‘loading’ error? Does the file size suggest there is video inside?

      Try some of the other players and if they are all bugging out then there is more work to do!
      Possibles:
      1. Its a new / different SSF but retains the same structure as the ones all linked to BKPlayer.exe
      2. Its a different file type, but just using the same file extension. Security companies do this a lot just to screw with us!
      3. The file is damaged / corrupted.

      If, after testing and hair pulling, you still require help then drop me a mail to david (a) forensicvideo.training and I will see what I can do.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s