SSF Files with BKplayer.exe – Part 4

Before anyone says anything – I know I said I was going to be quiet for a while but this post was half done and I felt that it was something I couldn’t leave!! The saga of SSF Files continues.

Part 1
Part 2
Part 3

So, what does this version look like?

Disk Structure & Player Icon

Disk Structure & Player Icon

Snap 2014-03-11-18_41_05

Player Interface

Version

Version

When the player opens, it is initially blank. You need to hit the search button to navigate to a folder containing your SSF Files. If you have copied your files to another folder for analysis use, you will get two folder structures similar to that seen in the image above. When the footage first opens, it will be resized to fit the entire window. By double clicking the picture it scales to the recorded pixel dimensions. In the example examined here, the displayed dimensions were 352px x 240px. There is a date and time overlay that can be turned on or off in the settings.

There is also that wonderful ‘Convert to AVI’ button – We will come back to that later, after a look at the video data inside the SSF’s.

For the purpose of this analysis I have only looked at a single camera SSF file that was exported from a DVR along with this player. It may be possible to find Multi-Camera SSF Files that come with this player, and it may be possible to play other SSF Files with this Player.

Being pretty confident that these were some sort of mpeg, FFprobe was used to scan the file:

A quick FFplay confirmed playback and decoding of the h264 stream and then another FFprobe was carried out to obtain the frame details.

A quick recap:

Probe the file to obtain stream details:

ffprobe -show_format -show_streams -count_frames -pretty 
yourfile.ssf > yourfile-probe.txt

Probe the file to obtain frame details:

ffprobe -show_frames -print_format xml yourfile.ssf > yourfile-frames.xml

Confirm playback

ffplay yourfile.ssf

REMEMBER TO TEST & VALIDATE YOUR RESULTS – UPDATE YOUR SOFTWARE IF NECESSARY

SEE HERE FOR AN EXAMPLE OF WHEN OLD SOFTWARE CAN PROVIDE INCORRECT RESULTS

I then placed the stream into a container file for visual analysis. I tested both avi and mkv containers with no problems.

ffmpeg -i yourfile.ssf -vcodec copy yourfile.avi

All frames detected and scrubbed through forwards and backwards with no problems

Snap 2014-03-15-10_47_44

Now I know that it’s possible to deal with the images that make up the video, before I do anything else, it’s time to go back to the player. There was an important reason why….

When reviewing the original SSF file within the player initially, I used the Fw Frame control button to count through a second in time according to the overlay displayed. There were 15 frames per second. Using my new avi file, constructed through the ffmpeg method, and then selecting a playback speed of 15 FPS, resulted in an abnormal playback speed.

The first thing was to test the player’s ‘avi convert’ function.

avi-exp

I created two, one with the audio and one without.

First off, both methods created the same file, and both with an audio header! On attempting to extract the audio stream, the result was that the stream contained no data. Something to be aware of, if there are questions as to the presence of audio and why it was removed – It’s just the header – there may have been no audio to start with!

Secondly, look at the frame rate – it’s now 11FPS

avi-audio-fps

Whilst we have this image, look at the codec – it has been transcoded!

The transcoding is required because the date and time information are now overlayed on the video. By reviewing this, there were still 15 unique images in a second, but the avi had a timing of 11 images per second. This caused it to play back to slow.

I then guessed what the problem was – and went back to the player to confirm it.

Video Motion Detection

By watching the motion and the time in the player very carefully, it was possible to see points where persons stand still – and so does the time. There is no notification of this. The only visual confirmation is that the footage stops playing. I had originally thought that it was freezing. If you just leave it, when the next image is present, it will start playing again. I have had a quick scan through the video to find the date/time information but can’t isolate it at present.

So, in conclusion:

1. The new version has been added to the BKPlayer.zip in my shared files.

2. It is possible to extract and read the raw h264 using ffmpeg.

3. It is possible to create a transcoded copy of the video with the date and time overlay added using the players built in functions. As a result, it would be possible to use an NLE to cut this up, placing the appropriate time gaps in between the cuts.

4. The FFmpeg avi would not be suitable for video work if there are signs of VMD in the clip of interest. It may be possible to trim the clip (avoiding the VMD parts) to only have the part you are interested in, and then adjust that clip manually back to 15FPS in something like Virtualdub.

If the task of creating a copy of the video was completed quickly, with little analysis, there is a very high likelihood that these timing issues would be missed. The result could be a presentation format copy of the video that does not play correctly and has unexplained gaps.

It is a ‘timely’ reminder not to rush a job, but to understand what you have to start with and then validate any created files to ensure they playback correctly.

Advertisements
By Spreadys Posted in EEPIP

15 comments on “SSF Files with BKplayer.exe – Part 4

  1. Sounds like it may have been recorded using VFR, but they “over corrected” on the transcoded output; they included frame padding AND adjusted the frame rate.

    Another thing to point out is that the 352×240 image size is more than likely not the way the image should be displayed. This is one of those where recording an aspect ratio standard through the same path, using the same settings, would be helpful for confirmation; but I suspect it should be displayed 4:3, of course.

    Cheers my friend. Thanks for the brain fodder. 😉

    • Would you be able to help me understand how to copy a recording from bkplayer using a drump drive and then viewing it on my PC? I was able to backup something but the video would not play. The play button is greyed out. Please let me know.

      Thanks

      • Hi Natasha, is your interface the same as the one shown within this article or in parts 1,2 or 3? Let me know and I will do my best to assist.

  2. Pingback: SSF Files with BKPlayer.exe | Spreadys.com

  3. Thanks for responding. It looks like Part 2. Only there is nothing on the screen to view. In the file search window, there are no file names that comes up either, the window is empty.

    • In the image at the start of Part 2, there is an eject icon at the bottom of the main interface. This will bring up the File Search dialogue box.
      In the search path, you will need to direct that into the folder containing your .ssf files and this extension must be selected in the Search File dropdown.

      When these are selected and you hit Search, all th .ssf video files ‘should’ appear and you can hit the play button in the dialogue box.

      If this doesnt work, for some reason, then you could try to use the multicamera player that I detail in Part 1.

      If all that fails, then I’m out of suggestions at this point, let us know how you get on and we can try something else if it fails again!

  4. Thank you.
    I save the backup files on my desktop and followed the instructions you gave me. However, it says “(0)item found” and no files show up. Is there a specific procedure I can follow to copy the video from the recording for the specific period I need? The first time I saved it on my drump drive. When I try to save again it says no data but I know there were things recorded.
    Thank you

    • Hi Natasha,
      Sorry for the delay….been rather busy.
      I think we need to clarify is you have any .ssf files within your backup and if so, if the contain any data. Within the export folder structure you should have a folder that contains the .ssf files. If they are there – do they have a reasonable file size to suggest that they actually contain some data.
      If the answer is yes to that, and you are looking inside this folder when in the player then I’m not sure what the issue is at this time.
      If you don’t see any .ssf files then you will need to attempt the export procedure again.
      I’m sorry I cant help you any more than that.

  5. I have some ssf files pulled directly from a samsung dvr hard drive. No version of BK player will play them. It will say “header file corrupted”. Through ffplay i get a slew of “illegal short term buffer state detected” messages. The video will play (somewhat), but as you can imagine it is jumbled mess. If you could help me out in anyway i would appreciate it. This is for a local business that had a break in a few days ago, but for reasons beyond explanation have no access to the dvr interface.

    Thank you
    – Adam

      • Jason,
        it sounds like you have the raw extracts from a Samsung DVR? If they have not come with a version of BKplayer, and have been extracted by some method from a Samsung DVR then unfortunately, I am unaware of a standalone ‘player’ for these files.
        The only software that I know that can deal with this format is DVR Examiner:
        http://dmeforensics.com/blog/dvr-examiner-1-6-released/

        I believe that these should be exported using the Samsung DVR GUI into another container….
        Obviously, I may be way off the mark here and the files you have may be something completely different… but it definitely sounds like these are different to the SSF files dealt within this set of blogs.

  6. I have the same deal as Adam. Had digital forensics extract data off of a samsung DVR and first tried to re-encode them. After that failed I’ve been trying to find something that will play them but I always get the “header file corrupted” error with no results. Any insight you have is much appreciated.

    – B

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s