As a follow up to my latest article, this time in eForensics magazine….
My latest walkthrough of an investigation, detailed in the article, involved a few FFmpeg commands that you may find helpful:
Can the FFmpeg library read a file?
ffmpeg -i thefile.ps
The -i denotes the input file. It is sometimes necessary to force a file to be read as a specific codec. To force a file to be read as h264, you would simply add -f h264 before the -i .
Initial probe of file:
ffprobe -show_format -show_streams -count_frames -pretty thefile.ps > thefilePROBE.txt
This command will output an easy to read text file showing the detected format, the detected streams, and if possible, the total number of frames.
To play individual streams within the file (example shows stream number 2):
ffplay -vst 2 thefile.ps
To play only a selected stream, -vst (number) can be placed before the file. -vst is short for Video Stream.
Extract streams from encapsulated file (example shows stream number 2):
ffmpeg -i thefile.ps -map 0:2 -vcodec copy -vsync 0 thefile_stream2.mp4
After identifying the the input file, the -map flag, followed by stream number, states that the output file must only contain that specific stream. The -vcodec copy directs the software not to transcode the output. The -vsync 0 directs that each frames timestamp is passed with its original timestamp. Finally the output file location and name is given.
Individual frame analysis of file:
ffprobe –i show_frames –print_format xml thefile_stream2.mp4 > thefilePROBE.xml
This will output a detailed list of every frame in a video file and place it into an xml datasheet.
Create macro block analysis Motion JPEG video:
ffmpeg -debug vis_mb_type -vismv pf -i inputstream.mp4 -vcodec mjpeg -q:v 2 -f avi thefile_stream2_Analysis.avi
Prior to identifying the input stream, the two flags here mark it to be read whilst showing the Macroblock type and the Predicted Frame Motion Vectors. After the input stream, the output codec has been marked as Motion JPEG with the highest quality parameter. Finally the –f avi directs the output format.
The Flags and Filters have now been changed in newer versions of FFmpeg. The most recent versions now utilise the codecview filter in order to visualise motion vectors:
ffmpeg -debug vis_mb_type -flags2 +export_mvs -i inputstream.mp4 -vf codecview=mv=pf -c:v mjpeg -q 2 -f avi output.avi
Create High Quality Mpeg2 files for PAL DVD Authoring:
ffmpeg -i inputstream.mp4 -vf "scale=iw*2:ih*2,pad=720:576:8:0,setdar=4:3" -c:v mpeg2video -b:v 6000k -minrate 4000k -maxrate 6000k -bufsize 2000k -dc 9 -flags +ilme+ildct -alternate_scan 1 -top 1 outputfile.mpg
After the Input stream, the -vf stands for video filter. The filter chain specified in this instance begins with the scale filter to increase the width and height by 2. Next, as the increased width does not meet the 720×576 PAL requirement size, the output has been padded by 8 pixels on either side. Lastly the Display Aspect Ratio has been set to 4:3. Following on from the Filter chain, I have a series of flags to set the encoding type and quality. The last set informs the muxer to create the output as interlaced.
Batch export of all ‘I’ frames from an MPEG video file into TIFF Images:
ffmpeg -i inputstream.mp4 -vf select=’eq(pict_type\,I)’ -vsync drop -f image2 -pix_fmt rgb24 C:/folder/video/framesfolder/frame%05d.tiff
Another Video Filter has been used here to select only the frames with a Picture Type of ‘I’. This is followed by -vsync drop to not include frames with a duplicate time code. The output has been set to a RGB24 TIFF Image format.