Bosch .mp4 and .ind Files

Another interesting set of export files that perhaps should be easier to deal with…

My reason for posting this is that I don’t think these files are that common. Also, if you have been supplied an .mp4 file and an .ind file without any software link, you would have no idea that they relate to Bosch. You may mistakenly believe that they are standard files given the .mp4 container. So if you have stumbled accross this page after some Googling…. I hope it helps.

disk-contents

Each exported .mp4 file comes with an associated .ind file. The file name starts with the date/time and then an IP address suggesting that this is from an IP NVR system. Along with the files was a Rich Text Format document with a download link for software….I will come back to that in a bit.

Before clicking on the link then, what about the .mp4 video files? Unfortunately they could not be played in any of the usual players or through any media framework such as FFmpeg. MediaInfo could not detect any video/audio streams.

mediainfo-blank

The only player that could produce anything was Windows Media Player but the footage was extremely distorted and played in a smaller window than expected.

In_WMP_distortion

The only good piece of information from viewing this was the presence of an overlayed date/timecode in the bottom right corner. From reviewing this and then the data contents of the .ind files I have concluded that the date and time is actually hard encoded into the footage and the .ind files are data indexes for the file rather than a date/time index.

Before doing anything else then, time to have a look at the player link that was supplied on the disk within the RTF File.

web-notfound

Unfortunately, the link supplied was a dead end! A bit of googling however brought up the following:

http://products.boschsecurity.co.uk/en/GB/products/bxp/SKU15859929712962074379-CATMroot

BoschWeb

Using the software tab led me to the download of a fairly large application (85mb zipped).

If you are a regular reader you will know that I never install any software into my workstations without testing it in a clean Virtual environment first. I also now scan what files are going where using whatchanged.exe and also attempt to virtualise the application using Cameyo.

The install is for the complete suite which includes network viewer and configuration. Each separate application within the suite gets installed separately. These large suites are a real pain when you just need to watch the footage – especially for networks with tightly controlled installation restrictions.  Before we get onto the files newly loaded into my PC, and the result of the Cameyo, lets have a quick look at the software.

Upon first running, these dialogue boxes appear, suggesting that the full version has other functionality that is not being made available. I suspect some of that functionality could be to do with the import and export options.

software_licence

export_licence

When we finally get to the Player application, the usual File > Open functionality brings us playback.

player

The Player part of the software is just that – a player. Little functionality apart from the usual controls and a save jpeg button.

test

Saved jpeg image (pixelated) with the scan line highlighted

The jpeg gave me my first piece of information. It was exported from the software at 360px x 288px and the tell tale sign of the last scan line at the bottom suggested the original source to be an analogue camera.

At least I could see my footage and confirm the presence of a hard encoded date/time. Unfortunately I was unable to locate any method of reading the file information or extracting the video from within the software. So, before we try to figure that out – what about the Cameyo?

Cameyo_Options

This worked very well, creating a 111mb standalone application that I could move over into my clean system. This meant that I (or others) could play the footage without having to install all the software – Very handy if you wish to send this to people with restricted computer permissions. It should be possible to only install and virtualize the Player program which would keep the file size smaller but I have not tested the theory!

Back into the Virtual PC and I had a look through the ‘Whatschanged’ list of 900+ newly installed files! (And people wonder why Forensic Video Examiners get codec conflicts!)

There was a large amount of .dll’s and .ax multimedia filters. As a result I took a chance at playing the .mp4 file within Windows Media Player again – success!

It played within WMP at 704px x 576px but there was something not quite right though. The hard encoded date/time looked blocky and stretched. I opened the file within Graph Studio Next to take a look at what files and filters were being used to render the video.

GraphEditAX

FilterLocation

The properties of the VCS Video Decoder revealed the location of the specific .ax filter being used by Windows to read the video properly.

Whilst here lets have a look at how the video is being managed by the filter.

FilterOUT

Coming out of the filter was a 704px x 576px video…..but going in was a 352px x 288px stream!

FilterIN

From seeing the smaller video being attempted to play originally (the distorted one), and then the blocky date/time information in the larger undistorted view, I had pretty much guessed that the codec was upscaling automatically… This just confirmed it.

I ran the file through other software and of those that could read the directshow filter, all but one upscaled automatically. What about the one that didn’t….

Vdub_Dshow

Opening the file in Virtualdub with the directshow input driver brought a surprising result. The input window was 704px x 576px but it didn’t upscale the image. By using the crop filter to 352px x 288px I could quickly output the entire video as it was exported, and with no upscaling or added interpolation.

I could also remove all the duplicates as I had a constant structure.

In conclusion:

1. The software is able to be virtualised that will assist in making the original footage playable on a rights restricted Computer.

2. Extracting all the footage into a workable file appears to be only possible with the codec installed (as part of the suite).

3. Dealing with all the images as they were recorded is much easier when using Virtualdub rather than the limited functionality of the player.

That was another interesting one! As the footage appears to be using an old H263 codec, and the suite itself has been discontinued, it’s possible that there won’t be too many of these systems out in the wild. Hopefully Bosch identified the limitations of the suite and have improved matters with later releases.

Having to install software and codecs just to play a file is a big problem! Even worse is having software that falsely presents an image size larger than that exported.

Oh well, as I said at the start…. I hope the information here helps.

 

 

 

Advertisements
By Spreadys Posted in EEPIP

One comment on “Bosch .mp4 and .ind Files

  1. I have seen this “false size” effect quite some time. The video size is different from actual video data inside it. Sometimes is like in your case, with the picture filling 1/4 of the image. Other times, only half size (probably due to wrong deinterlacing settings). Stuff like this drives me crazy!

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s