FFmpeg commands used within eForensics magazine article

As a follow up to my latest article, this time in eForensics magazine….

Click the magazine to access a free copy

Click the magazine to access a free copy

My latest walkthrough of an investigation, detailed in the article, involved a few FFmpeg commands that you may find helpful:

Can the FFmpeg library read a file?

ffmpeg -i thefile.ps

The -i denotes the input file. It is sometimes necessary to force a file to be read as a specific codec. To force a file to be read as h264, you would simply add -f h264 before the -i .

Initial probe of file:

ffprobe -show_format -show_streams -count_frames 
-pretty thefile.ps > thefilePROBE.txt

This command will output an easy to read text file showing the detected format, the detected streams, and if possible, the total number of frames.

To play individual streams within the file (example shows stream number 2):

ffplay -vst 2 thefile.ps

To play only a selected stream, -vst (number) can be placed before the file. -vst is short for Video Stream. 

Extract streams from encapsulated file (example shows stream number 2):   

ffmpeg -i thefile.ps -map 0:2 -vcodec copy -vsync 0 thefile_stream2.mp4

After identifying the the input file, the -map flag, followed by stream number, states that the output file must only contain that specific stream. The -vcodec copy directs the software not to transcode the output. The -vsync 0 directs that each frames timestamp is passed with its original timestamp. Finally the output file location and name is given.

Individual frame analysis of file:

ffprobe –i show_frames –print_format xml  thefile_stream2.mp4 > thefilePROBE.xml

This will output a detailed list of every frame in a video file and place it into an xml datasheet.

Create macro block analysis Motion JPEG video:

ffmpeg  -debug vis_mb_type -vismv pf -i inputstream.mp4 
-vcodec mjpeg -q:v 2 -f avi thefile_stream2_Analysis.avi

Prior to identifying the input stream, the two flags here mark it to be read whilst showing the Macroblock type and the Predicted Frame Motion Vectors. After the input stream, the output codec has been marked as Motion JPEG with the highest quality parameter. Finally the –f avi directs the output format.

2015 Update:

The Flags and Filters have now been changed in newer versions of FFmpeg. The most recent versions now utilise the codecview filter in order to visualise motion vectors:

ffmpeg -debug vis_mb_type -flags2 +export_mvs -i inputstream.mp4 -vf 
codecview=mv=pf -c:v mjpeg -q 2 -f avi output.avi

Create High Quality Mpeg2 files for PAL DVD Authoring:

ffmpeg -i inputstream.mp4 -vf "scale=iw*2:ih*2,pad=720:576:8:0,setdar=4:3" 
-c:v mpeg2video -b:v  6000k -minrate 4000k -maxrate 6000k -bufsize 2000k 
-dc 9 -flags +ilme+ildct -alternate_scan 1 -top 1  outputfile.mpg

After the Input stream, the -vf stands for video filter. The filter chain specified in this instance begins with the scale filter to increase the width and height by 2. Next, as the increased width does not meet the 720×576 PAL requirement size, the output has been padded by 8 pixels on either side. Lastly the Display Aspect Ratio has been set to 4:3. Following on from the Filter chain, I have a series of flags to set the encoding type and quality. The last set informs the muxer to create the output as interlaced.    

Batch export of all ‘I’ frames from an MPEG video file into TIFF Images:

ffmpeg -i inputstream.mp4 -vf select=’eq(pict_type\,I)’ -vsync drop 
-f image2 -pix_fmt rgb24 C:/folder/video/framesfolder/frame%05d.tiff

Another Video Filter has been used here to select only the frames with a Picture Type of ‘I’. This is followed by -vsync drop to not include frames with a duplicate time code. The output has been set to a RGB24 TIFF Image format. 


One comment on “FFmpeg commands used within eForensics magazine article

  1. Pingback: eForensics Magazine Article | Spreadys.com

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google+ photo

You are commenting using your Google+ account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )


Connecting to %s