Samsung and .sec files

Yet another file extension from Samsung! cd The exports look something like the folder structure here. Samsung have made things a little easier by including an index file but the .xml format can be a little temperamental. In older versions of Internet Explorer and inside Windows XP it has always worked with no problem. In other browsers and in Windows 7, you may not get what Samsung had anticipated. July 22 Update: A colleague from The Netherlands has helped out here with the following guidance on opening these in Win 7: “When opening the XML-index in Internet Explorer 10 using Windows 7, you can fix the view by enabling the following setting in IE10: Tools > Compatibility View settings > Display all websites in Compatibility View” xml-index This is what it should look like. It’s a handy index of what is on the evidential disk and what user created it. The hyperlink to the file is then shown. These .exe files are in a date formatted folder. inside-date-folderAlongside each .exe is a .sec file with the same name. In the Samsung index.xml file, the file size of each .exe is shown. In comparison, when viewing the .exe files within windows they are tiny! The files of matching size are the .secs. When running the .exe, the player loads into RAM. At the same time the player identifies a corresponding .sec file and also loads this. If you have files of some length then this can take quite some time. exe It is a very basic player and as such can be a little tricky to use on large files. In my experience, I have found that scrubbing or trying to review large files have caused it some problems. As such, I had to question whether it was easier to review the large streams out of the Backup Viewer? Yes! Firstly, from the file sizes and naming convention, it is pretty obvious that the .sec is the video stream. By dropping this into MediaInfo reveals all. mediainfo So, we have a standard h264/AVC stream. Before we get to ‘containing’ this, its worth having a loo at the raw data. hex This is quite common now and can help with identifying where a file has originated. In the header of the file before the start of the video is the model number of the DVR used. The SRD-1670D. The date and time information is held all at the end of the file, but without some serious reverse engineering, its pretty hard to get out. Whilst on the subject of time-codes, many companies now offer the ability to extract their video but hardly any offer the ability to extract the time information. Wouldn’t be hard for them to create a subtitle file…. just a thought! Anyway, back to the .sec file. As it’s a standard stream (thank-you Samsung for actually sticking with a standardised format), it can be contained within a file of your choice. Using FFmpeg to output into avi:

ffmpeg -i 0010600.sec -vcodec copy -vsync drop -fflags genpts -f avi 0010600.avi

Remember that if the frame makeup is critical then ffprobe can give you the entire frame structure and exact frame extraction can be carried out for image analysis.

vdub

The file will now scrub much better in other players. To give an estimation of time, its very easy to place a timecode over the top and adjust the frame rate in order to have some time referencing.

DISCLAIMER: the original timecode from the original export should be used for time accuracy if this is critical.

We have 89820 frames over a duration of 7 hrs 59 mins – The time was on the original index and the viewer. That’s 479 minutes.. or 28740 seconds 89820 / 28740 Equals 3.12526 FPS By using this frame rate in Virtualdub and adding on the TimeCode Generator, the review time was accurate within milliseconds.

vdubtc

I have found that for a number of small files, the time  / frame rate was much more accurate. The file used here was for an 8 hr duration so there was always going to be a bit of play in the variable recording speed.

For the smaller files, perhaps including a number of cameras, it may not be necessary to deal with the time. In those cases, a simple rewrap and then review of cameras in forevid offers a quick solution.

Dec 2013 Update: A newer version of the player seems to deal with large streams much better with immediate loading and a much faster scrub / search.

June 2015 Update: IMPORTANT!

If your new version of FFmpeg fails when you attempt a stream copy or transcode to Uncompressed – please obtain an older version from Zeranoes site – Link to 32bit versions.

http://ffmpeg.zeranoe.com/builds/win32/static/

The new version is a bit fussier on non standard formatting and, as such, can fail in the process.

Remember, it is still the users responsibility to validate the results and compare the output against the original.

As always, I hope it helps.

By Spreadys Posted in EEPIP

36 comments on “Samsung and .sec files

  1. Any idea if there is a discernible footer for these files? Looking at a bunch of SHR-7162 SEC files that I carved from unallocated space; however, I cannot quite figure out where each file ends.

    • Hi Tim,
      I have had a quick look at the two types of SEC file I have in my archive.
      From a SRD-1670 I have a file that presents itself as Cam6. At the end of the file is the index with each index marker starting with 05 80 80.
      From a SRD-852D I have a file that presents itself as Cam1. At the end of the file is the index with each index marker starting with 00 80 80.

      Its a guess that the first byte is the stream identifier.

      Prior to the index I cannot find any footer and by previewing a set of mpeg slices, I cannot identify the GOP hex. They will be there somewhere but it would take some considerable time to pull the files apart!

      The index markers may only be used within their export so I may be leading you down the wrong path!

      If this is something you do crack, please feel free to let me know and I can share throughout the community.
      Good luck and apologies I couldn’t help any further,
      Spready

  2. can some kind soul help me with this one,
    (I think this is the DVR (SRD-440 DVR))
    (the security software is set to record at 12 frames per second)
    The video clip is a few seconds over 2 minutes long. The SEC file plays in the “exe” provided, but the quality is atrocious.
    I want to see what the file looks like in a different player.

    this is the information from Media Info Lite ((cannot install the full version here))
    Format : AVC
    Format/Info : Advanced Video Codec
    File size : 10.3 MiB

    Video
    Format : AVC
    Format/Info : Advanced Video Codec
    Format profile : Baseline@L2.1
    Format settings, CABAC : No
    Format settings, ReFrames : 2 frames
    Format settings, GOP : M=1, N=12
    Width : 704 pixels
    Height : 288 pixels
    Display aspect ratio : 2.40:1
    Color space : YUV
    Chroma subsampling : 4:2:0
    Bit depth : 8 bits
    Scan type : Progressive

    and using the code from the posts above,
    >ffmpeg -i 10.sec -vcodec copy -vsync drop -fflags genpts -f avi 10.avi

    generates the following errors,
    [avi @ 0000000002be1860] Encoder did not produce proper pts, making some up.
    [avi @ 0000000002be1860] H.264 bitstream malformed, no startcode found, use the
    video bitstream filter ‘h264_mp4toannexb’ to fix it (‘-bsf:v h264_mp4toannexb’ o
    ption with ffmpeg)
    av_interleaved_write_frame(): Invalid data found when processing input
    frame= 1 fps=0.0 q=-1.0 Lsize= 6kB time=00:00:00.02 bitrate=2314.4kbits
    /s
    video:40kB audio:0kB subtitle:0kB other streams:0kB global headers:0kB muxing ov
    erhead: unknown
    Conversion failed!

    the -f h264 switch generates the same errors,

    running the -bsf:v h264_mp4toannexb switch
    (>ffmpeg -i 10.sec -vcodec copy -vsync drop -fflags genpts -f avi -bsf:v h264_mp4
    toannexb 10.avi)

    generates the following errors,
    [NULL @ 000000000546be80] Packet header is not contained in global extradata, co
    rrupted stream or invalid MP4/AVCC bitstream
    Failed to open bitstream filter h264_mp4toannexb for stream 0 with codec copy: I
    nvalid argument
    [avi @ 00000000003b1920] Encoder did not produce proper pts, making some up.
    [avi @ 00000000003b1920] H.264 bitstream malformed, no startcode found, use the
    video bitstream filter ‘h264_mp4toannexb’ to fix it (‘-bsf:v h264_mp4toannexb’ o
    ption with ffmpeg)
    av_interleaved_write_frame(): Invalid data found when processing input
    frame= 1 fps=0.0 q=-1.0 Lsize= 6kB time=00:00:00.02 bitrate=2314.4kbits
    /s
    video:40kB audio:0kB subtitle:0kB other streams:0kB global headers:0kB muxing ov
    erhead: unknown
    Conversion failed!

    advice much appreciated,
    thanks,
    RB.

    • Hi there,

      Take a look at a recent post titled,
      Update to MP4 or H264 and the constraints of containers

      This may be the issue.
      If still having problems and you are happy for me to analyze the footage, you can email me at analysis'(a)’spreadys.com

      Spready

      • part way!
        that solved getting it into a format I can play (vob/mpg)
        and it does look much clearer than loaded into the provided “exe” player,

        I am still trying to master the framerate and aspect switches, I am very much a beginner, some of the examples I have found generate buffer underrun, others don’t change the framerate, the people in the clip are still zipping about.
        Trying to change from 12 to 24 frames, and the video is “letterbox” when I think it should be 4:3, so it’s very short stumpy people zipping about…
        may this numpty beg an example for each issue?

        (I have about 40 clips I need to convert this way, with more created ever other day, so I’d really like to be able to get my head around it all.)

        thanks, RB

      • Ok, think I’m gonna have to look at a file to give you anything more. If that’s not possible then it may be a bit difficult to identify all issues.

  3. OK, just to clear up some recent threads…

    The Samsung DVR used here was an SRD-440. RB kindly sent me a file to test and he sent me a .BU file with an associated .db2 file. This was a bit of a surprise as in all older Samsung DVR’s, the .bu files can only be played back in the DVR. I mentioned this here, https://spreadys.wordpress.com/2014/07/21/ifsec-samsung-exports/

    It appears that Samsung have caught on, and the BU file is now playable due to it being a H264/AVC Stream conforming to a standard profile. I have updated the IFSEC Post mentioned above to highlight this change.

    Back to RB’s stream and the challenge was to get these files viewable in WMV format. They were all field based, at 704×288.

    The speed of playback is controlled by the Samsung software, using the .db2 file. As such, the metadata and timing information in the video stream was wrong. This caused speed issues and then quality issues when attempting to correct this.

    As a result, I found it necessary to force an input rate and generate a new Presentation Time Stamp BEFORE the input file.

    The following FFmpeg string did the job…

    ffmpeg -r 12 -fflags genpts -i FILE.bu -vf scale=704:528 -sws_flags lanczos -q:v 2 FILE.wmv

    Remember, this is for preview – analysis would be completed differently due to the scaling, the interpolation method, and the WMV compression!

    As its likely that RB may have quite a few .bu files in a folder, I placed this into a batch file to transcode the whole lot within a few minutes… more on batch files coming in a new post soon!

  4. Pingback: IFSEC-Samsung Exports | Spreadys.com

  5. Pingback: Samsung .bu exports | Spreadys.com

  6. Pingback: Update to Samsung .sec files | Spreadys.com

    • Hi Mike, it really all depends on your requirements. If you do not have any software such as Amped FIVE and are not within the legal community then it comes down to what you need it for. For legal use – you don’t really want to convert. If its for something else then you can transcode using ffmpeg as detailed in the post. If learning ffmpeg is a bit too much for the requirements then email me with details and I’ll see what i can do for you – david (at) forensicvideo.training

  7. I have two .sec files that I needed converted in order to view them. They come from an SDR-5100 DVR. I cant seem to figure out how to convert them into anything that Ican view and am unable to view the files on the DVR that they came from. Any suggestions, this is a bit over my head

    • Hi there..
      You should be able to view them with the associated .exe player that should have come with the .sec files. If you have not got these then there may have been a problem in the original data recovery / acquisition from the DVR. To confirm, if you have a video file that is workable, you can try MediaInfo. drop the .sec into this and it ‘should’ report back with a video stream and what sort of stream it is.

      If succesful (you have some video), then you could ‘try’ to rename it with the .264 file extension and using Media Player Classic. Some work, some work but a bit distorted, some don’t do anything!
      From there I’m out of easy / free solutions. If its a still a problem, and you need something doing – you can email an official request to david (a) forensicvideo.training

    • Many of the sec types were using an audio codec that was not officially finalised and supported. I think they did it to avoid licencing! The issue is that although it can sometimes be extracted – decoding it was very hard due to the unknown parameters.
      I don’t have any solution unfortunately.

      • Hey, do you know how to extract the audio from the sec file? Because when I get information of my SEC file with -hide_banner it says the file does not contain audio. But when I play it as a SEC I can hear audio.

      • Hi there, apologies for delay – for some reason notifications were going direct to spam!

        There are 2-3 versions that use an old audio codec that was integrated into another one.
        Unfortunately, this old format is not recognized by many systems.
        The audio can sometimes be extracted but not decoded without byte level analysis to identify various parameters.

        If you are an Amped FIVE User, please submit to Support and they will attempt to identify the type and decoding opportunities.

  8. Hi. I backed up some surveillance footage from a Samsung CCTV security system that I now need to pass on to the police to allow them to continue their investigations. The only problem is, the files were backed up in .sec format and the only formats the police will accept are m4v, m4a, mp3, mp4 or avi. I’m on a Macbook Pro (the original files came from a PC). I’ve tried downloading FFMPEG but my Mac won’t allow me to install it, I can’t find any other way to convert the files over. Can anyone help? Thanks so much.

    • Hi Kylie, thanks for contacting..

      I am pretty confused that the police have told you that they cannot accept the original native format…
      This is the evidencial export and all other ‘versions’ should come from that. There must be a chain of custody between the original and all other copies / versions.

      As a consequence, may I suggest that you inform them that each .sec file is supplied with the player.. the .exe that has the same filename as the .sec.
      They can then play the footage.

      If they need to process this for other uses, they can do so using standard Forensic Video Analysis Software, such as Amped FIVE, or utilizing video processing tools such as FFmpeg.

      I have traveled throughout the world, training police in CCTV Evidence and have never known of a police force that asks the owner to process the evidence for them.
      The evidence should be processed within a forensic framework and as such is the legal authorities responsibility.

      If for any reason, your exports have not completed with an associated player (the .exe program), then let me know and we should be able to solve this pretty easily.

      let me know how you get on, over on email – david(a)forensicvideo.training

  9. Thanks for that info! I’m in Australia, our local police are sadly massively under resourced. The original footage has been viewed by the attending officer however they simply don’t have the manpower to come out and go through the hours of footage and do the backups themselves. It’s not a major crime (this is theft of property), so perhaps they reserve their limited time and resources for more pressing matters *winks* I will talk to the officer assigned to my case and let him know what you mentioned above. Thanks again, much appreciated 🙂

    • No problems… And just to confirm, you can export and supply the footage to them in the chunks needed to save them coming put, but just make sure it’s in the native format (the sec). This then ensures you haven’t changed it since the time it was recorded. If it does then require processing, this is the bit that is usually managed by the investigative agency. Good luck..

      • Hi Spready,

        I am in Australia and in a similar situation as above (CCTV footage for Police) just wanted say thank you for this blog post and information you have shared. Has helped me figure out what I need to do.

  10. Hello there! I’m a little out of my depth in regards to understanding how video formatting/conversions work so I hope that my question is a simple one.

    The /sec video file I am working with contains what I thought was a burned in timestamp from security footage. I see we have an original .sec dvd and an .avi converted dvd and the .avi was being used in reference to this example. For legal reasons, the time stamp needs to be on the file and is when previewing the footage in a media player, but when the file is dragged into editing software to be cut into manageable sizes ( to highlight the important sections) the time-stamp disappears, leading me to believe that it may be separate from the main footage. It also exports without this time-stamp present. The video software is VideoPad and I am not able to test it on my end as I am not the one handling the footage directly on my own machine. If there isn’t something glaringly obvious that I’m missing, I don’t expect to get a concise fix, but I thought I would give it a shot!

    • Hi Ash,
      lets ensure we are dealing with a Samsung .Sec export here…

      You should have 2 files.. The .sec file, which should have the larger file size (It contains the video…and
      The .exe player.
      They will have the same filename (just different extensions).

      If you have anything different to this then its a different export format.

      Most timecodes like what you describe are proprietary embedded.
      there are forensic techniques that enamble the extraction of timecodes and then writing these to subtitle tracks BUT due to the thousands of methods utilized by the surveillance business, each one is trial and error.

      If you want to drop me an email with what you have – I may be able to assist a bit more..
      david(a) forensicvideo.training

    • Hey there, Most Forensic Video Applications such as Amped FIVE will not need to convert these for use. They should reviewed and used without extra processing if possible.

  11. hi, very helpful blog! i’m trying to decode a .bu file from a xrn-1610s. the file was wrongly exported as backup but i can’t open it. i tried with ffmpeg but no luck. can u help me? thx!!

    • Hey there,
      Apologies for the delay – some WordPress notifications were going to Spam.
      There are only a few old .bu files that are decodable outside of the DVR.
      If you cannot see any video in ffmpeg then it made need a very close inspection to identify if anything is possible.

Leave a comment