Samsung and .sec files

Yet another file extension from Samsung! cd The exports look something like the folder structure here. Samsung have made things a little easier by including an index file but the .xml format can be a little temperamental. In older versions of Internet Explorer and inside Windows XP it has always worked with no problem. In other browsers and in Windows 7, you may not get what Samsung had anticipated. July 22 Update: A colleague from The Netherlands has helped out here with the following guidance on opening these in Win 7: “When opening the XML-index in Internet Explorer 10 using Windows 7, you can fix the view by enabling the following setting in IE10: Tools > Compatibility View settings > Display all websites in Compatibility View” xml-index This is what it should look like. It’s a handy index of what is on the evidential disk and what user created it. The hyperlink to the file is then shown. These .exe files are in a date formatted folder. inside-date-folderAlongside each .exe is a .sec file with the same name. In the Samsung index.xml file, the file size of each .exe is shown. In comparison, when viewing the .exe files within windows they are tiny! The files of matching size are the .secs. When running the .exe, the player loads into RAM. At the same time the player identifies a corresponding .sec file and also loads this. If you have files of some length then this can take quite some time. exe It is a very basic player and as such can be a little tricky to use on large files. In my experience, I have found that scrubbing or trying to review large files have caused it some problems. As such, I had to question whether it was easier to review the large streams out of the Backup Viewer? Yes! Firstly, from the file sizes and naming convention, it is pretty obvious that the .sec is the video stream. By dropping this into MediaInfo reveals all. mediainfo So, we have a standard h264/AVC stream. Before we get to ‘containing’ this, its worth having a loo at the raw data. hex This is quite common now and can help with identifying where a file has originated. In the header of the file before the start of the video is the model number of the DVR used. The SRD-1670D. The date and time information is held all at the end of the file, but without some serious reverse engineering, its pretty hard to get out. Whilst on the subject of time-codes, many companies now offer the ability to extract their video but hardly any offer the ability to extract the time information. Wouldn’t be hard for them to create a subtitle file…. just a thought! Anyway, back to the .sec file. As it’s a standard stream (thank-you Samsung for actually sticking with a standardised format), it can be contained within a file of your choice. Using FFmpeg to output into avi:

ffmpeg -i 0010600.sec -vcodec copy -vsync drop -fflags genpts -f avi 0010600.avi

Remember that if the frame makeup is critical then ffprobe can give you the entire frame structure and exact frame extraction can be carried out for image analysis.

vdub

The file will now scrub much better in other players. To give an estimation of time, its very easy to place a timecode over the top and adjust the frame rate in order to have some time referencing.

DISCLAIMER: the original timecode from the original export should be used for time accuracy if this is critical.

We have 89820 frames over a duration of 7 hrs 59 mins – The time was on the original index and the viewer. That’s 479 minutes.. or 28740 seconds 89820 / 28740 Equals 3.12526 FPS By using this frame rate in Virtualdub and adding on the TimeCode Generator, the review time was accurate within milliseconds.

vdubtc

I have found that for a number of small files, the time  / frame rate was much more accurate. The file used here was for an 8 hr duration so there was always going to be a bit of play in the variable recording speed.

For the smaller files, perhaps including a number of cameras, it may not be necessary to deal with the time. In those cases, a simple rewrap and then review of cameras in forevid offers a quick solution.

Dec 2013 Update: A newer version of the player seems to deal with large streams much better with immediate loading and a much faster scrub / search.

June 2015 Update: IMPORTANT!

If your new version of FFmpeg fails when you attempt a stream copy or transcode to Uncompressed – please obtain an older version from Zeranoes site – Link to 32bit versions.

http://ffmpeg.zeranoe.com/builds/win32/static/

The new version is a bit fussier on non standard formatting and, as such, can fail in the process.

Remember, it is still the users responsibility to validate the results and compare the output against the original.

As always, I hope it helps.

Advertisements
By Spreadys Posted in EEPIP

20 comments on “Samsung and .sec files

  1. Any idea if there is a discernible footer for these files? Looking at a bunch of SHR-7162 SEC files that I carved from unallocated space; however, I cannot quite figure out where each file ends.

    • Hi Tim,
      I have had a quick look at the two types of SEC file I have in my archive.
      From a SRD-1670 I have a file that presents itself as Cam6. At the end of the file is the index with each index marker starting with 05 80 80.
      From a SRD-852D I have a file that presents itself as Cam1. At the end of the file is the index with each index marker starting with 00 80 80.

      Its a guess that the first byte is the stream identifier.

      Prior to the index I cannot find any footer and by previewing a set of mpeg slices, I cannot identify the GOP hex. They will be there somewhere but it would take some considerable time to pull the files apart!

      The index markers may only be used within their export so I may be leading you down the wrong path!

      If this is something you do crack, please feel free to let me know and I can share throughout the community.
      Good luck and apologies I couldn’t help any further,
      Spready

  2. can some kind soul help me with this one,
    (I think this is the DVR (SRD-440 DVR))
    (the security software is set to record at 12 frames per second)
    The video clip is a few seconds over 2 minutes long. The SEC file plays in the “exe” provided, but the quality is atrocious.
    I want to see what the file looks like in a different player.

    this is the information from Media Info Lite ((cannot install the full version here))
    Format : AVC
    Format/Info : Advanced Video Codec
    File size : 10.3 MiB

    Video
    Format : AVC
    Format/Info : Advanced Video Codec
    Format profile : Baseline@L2.1
    Format settings, CABAC : No
    Format settings, ReFrames : 2 frames
    Format settings, GOP : M=1, N=12
    Width : 704 pixels
    Height : 288 pixels
    Display aspect ratio : 2.40:1
    Color space : YUV
    Chroma subsampling : 4:2:0
    Bit depth : 8 bits
    Scan type : Progressive

    and using the code from the posts above,
    >ffmpeg -i 10.sec -vcodec copy -vsync drop -fflags genpts -f avi 10.avi

    generates the following errors,
    [avi @ 0000000002be1860] Encoder did not produce proper pts, making some up.
    [avi @ 0000000002be1860] H.264 bitstream malformed, no startcode found, use the
    video bitstream filter ‘h264_mp4toannexb’ to fix it (‘-bsf:v h264_mp4toannexb’ o
    ption with ffmpeg)
    av_interleaved_write_frame(): Invalid data found when processing input
    frame= 1 fps=0.0 q=-1.0 Lsize= 6kB time=00:00:00.02 bitrate=2314.4kbits
    /s
    video:40kB audio:0kB subtitle:0kB other streams:0kB global headers:0kB muxing ov
    erhead: unknown
    Conversion failed!

    the -f h264 switch generates the same errors,

    running the -bsf:v h264_mp4toannexb switch
    (>ffmpeg -i 10.sec -vcodec copy -vsync drop -fflags genpts -f avi -bsf:v h264_mp4
    toannexb 10.avi)

    generates the following errors,
    [NULL @ 000000000546be80] Packet header is not contained in global extradata, co
    rrupted stream or invalid MP4/AVCC bitstream
    Failed to open bitstream filter h264_mp4toannexb for stream 0 with codec copy: I
    nvalid argument
    [avi @ 00000000003b1920] Encoder did not produce proper pts, making some up.
    [avi @ 00000000003b1920] H.264 bitstream malformed, no startcode found, use the
    video bitstream filter ‘h264_mp4toannexb’ to fix it (‘-bsf:v h264_mp4toannexb’ o
    ption with ffmpeg)
    av_interleaved_write_frame(): Invalid data found when processing input
    frame= 1 fps=0.0 q=-1.0 Lsize= 6kB time=00:00:00.02 bitrate=2314.4kbits
    /s
    video:40kB audio:0kB subtitle:0kB other streams:0kB global headers:0kB muxing ov
    erhead: unknown
    Conversion failed!

    advice much appreciated,
    thanks,
    RB.

    • Hi there,

      Take a look at a recent post titled,
      Update to MP4 or H264 and the constraints of containers

      This may be the issue.
      If still having problems and you are happy for me to analyze the footage, you can email me at analysis'(a)’spreadys.com

      Spready

      • part way!
        that solved getting it into a format I can play (vob/mpg)
        and it does look much clearer than loaded into the provided “exe” player,

        I am still trying to master the framerate and aspect switches, I am very much a beginner, some of the examples I have found generate buffer underrun, others don’t change the framerate, the people in the clip are still zipping about.
        Trying to change from 12 to 24 frames, and the video is “letterbox” when I think it should be 4:3, so it’s very short stumpy people zipping about…
        may this numpty beg an example for each issue?

        (I have about 40 clips I need to convert this way, with more created ever other day, so I’d really like to be able to get my head around it all.)

        thanks, RB

      • Ok, think I’m gonna have to look at a file to give you anything more. If that’s not possible then it may be a bit difficult to identify all issues.

  3. OK, just to clear up some recent threads…

    The Samsung DVR used here was an SRD-440. RB kindly sent me a file to test and he sent me a .BU file with an associated .db2 file. This was a bit of a surprise as in all older Samsung DVR’s, the .bu files can only be played back in the DVR. I mentioned this here, https://spreadys.wordpress.com/2014/07/21/ifsec-samsung-exports/

    It appears that Samsung have caught on, and the BU file is now playable due to it being a H264/AVC Stream conforming to a standard profile. I have updated the IFSEC Post mentioned above to highlight this change.

    Back to RB’s stream and the challenge was to get these files viewable in WMV format. They were all field based, at 704×288.

    The speed of playback is controlled by the Samsung software, using the .db2 file. As such, the metadata and timing information in the video stream was wrong. This caused speed issues and then quality issues when attempting to correct this.

    As a result, I found it necessary to force an input rate and generate a new Presentation Time Stamp BEFORE the input file.

    The following FFmpeg string did the job…

    ffmpeg -r 12 -fflags genpts -i FILE.bu -vf scale=704:528 -sws_flags lanczos -q:v 2 FILE.wmv

    Remember, this is for preview – analysis would be completed differently due to the scaling, the interpolation method, and the WMV compression!

    As its likely that RB may have quite a few .bu files in a folder, I placed this into a batch file to transcode the whole lot within a few minutes… more on batch files coming in a new post soon!

  4. Pingback: IFSEC-Samsung Exports | Spreadys.com

  5. Pingback: Samsung .bu exports | Spreadys.com

  6. Pingback: Update to Samsung .sec files | Spreadys.com

    • Hi Mike, it really all depends on your requirements. If you do not have any software such as Amped FIVE and are not within the legal community then it comes down to what you need it for. For legal use – you don’t really want to convert. If its for something else then you can transcode using ffmpeg as detailed in the post. If learning ffmpeg is a bit too much for the requirements then email me with details and I’ll see what i can do for you – david (at) forensicvideo.training

  7. I have two .sec files that I needed converted in order to view them. They come from an SDR-5100 DVR. I cant seem to figure out how to convert them into anything that Ican view and am unable to view the files on the DVR that they came from. Any suggestions, this is a bit over my head

    • Hi there..
      You should be able to view them with the associated .exe player that should have come with the .sec files. If you have not got these then there may have been a problem in the original data recovery / acquisition from the DVR. To confirm, if you have a video file that is workable, you can try MediaInfo. drop the .sec into this and it ‘should’ report back with a video stream and what sort of stream it is.

      If succesful (you have some video), then you could ‘try’ to rename it with the .264 file extension and using Media Player Classic. Some work, some work but a bit distorted, some don’t do anything!
      From there I’m out of easy / free solutions. If its a still a problem, and you need something doing – you can email an official request to david (a) forensicvideo.training

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s