IFSEC – Pelco Exports

A visit to the Pelco display at IFSEC 2014

Reminder: I had 5 questions specifically relating to the exporting of evidential video from a Video Surveillance System.

I decided to look at Pelco’s new Digital Sentry VMS.

How easy is it to export evidential video from this  device?

Unfortunately, the Pelco display wasn’t designed to show off certain aspects of the equipment, such as Evidential Export. As such I was unable to conduct an export myself but was shown the interface and then forwarded an evidential export after the event. Whilst reviewing the interface during the show, I did however notice a very common issue with many manufacturers that results in a multitude of problems.

Many DVRs / NVRS / VMS’s etc have a number of export options. Most users do not know the difference.

Image of Export Options from the VMS

Image of Export Options from the VMS

What does a person use? A person with minimal knowledge will usually chose AVI, as that’s the term they know. However, the Codec of Video1 probably has to be the worst quality. A simple option here would be to have 2 tabs – Evidential Export, and Others. The option under Evidential Export should be the one that DOES NOT TRANSCODE. That would make things a bit simpler.

How easy is it for me to play the exported footage?

Quick answer – Very easy!

Snap 2014-07-12-18_03_32

Snap 2014-07-12-18_04_47

The Media Player started quickly with all 4 streams playing. A number of key points jumped out at me. The presence of milliseconds and frame number in each window. The scrub bar was quick and all the navigation buttons worked without a hiccup.

How easy is it to analyse and understand the format of the video?

The player not only tells me the time to the millisecond, but also the frame number, which is very handy for validation purposes. However that’s where it ends. There are no details on video format, resolution, Aspect Ratio, frame type etc. The menu option to show all the various overlays is very good, and it shouldn’t be too difficult to add some of this information in there.

Are there any functions to deal with the evidential video within the software?

For still images there are a number of options. When playing footage from multiple cameras, the save image function works by taking a grab of your interface window.

image4

After seeing that, I was concerned that a single image capture would do the same. It was a nice surprise to find that the single image capture takes the image size from the native resolution. So if you have a 1920×1080 video, that’s what you get as a Bitmap image.

The streams can be in any number of formats, depending on the camera being used. If the incoming stream is interlaced then there is no method within the software to deinterlace. I mention this again below…

It would be nice to see an image sequence option, but that goes for all manufacturer exports, not just Pelco.

For video, we have similar options to that found within the main VMS software.

Export Video options

Export Video options

To be honest, the two AVI options are a bit pointless but I can understand why they are there. They are installed in every Windows PC so playback would not then be an issue. The quality is another subject altogether! I have not gone through all the formats to assessing quality difference, dropped frames etc, but concentrated on the XPA. This option gives you the ability to extract a single camera stream from the executable, into the XPA Container, with no transcoding.

Is it possible to deal with the evidential video away from the software?

Yes (partly), although it’s not an obvious solution. By removing an individual stream from the executable, and placing it inside the Pelco XPA Container, it is possible to analyse some of the the raw video. I have reviewed a number of streams from an MJPEG Camera, an Mpeg4 Camera and a number of H264 encoded analogue streams and from an IP Camera.

MPEG4. During another review of the DS Media Player I could not correctly decode the stream correctly away from the software. The image suffered with corruption along the bottom. Only the DS Media player could read it correctly without distortion.

MJPEG. FFmpeg was able to read all the jpegs and deal with it as a native MJPEG file. Also Jpegsnoop was able to extract all the jpegs.

H264. FFmpeg again was able to deal with all the H264 streams with no problems. Frame count results with FFprobe matched the frame count displayed by the software. This is still early days and I need to conduct more analysis before anything gets posted due to one or two anomalies. The main one surrounds missing coded pictures.

missingValues-CodedPics

There are some other issues to do with frame type and I shall be looking into these in the future.

The H264 profile used during one of the encodings has resulted in the interlacing being correctly recorded. I believe it’s from an analogue camera, and then into an encoder prior to it hitting the VMS. The encoder has retained the field level signal. Each frame is correctly marked as being interlaced. As a result, it is very easy to quickly grab out the frames of interest and automatically de-interlace and resize to the correct Aspect Ratio. This is quite handy, and saves some considerable time in an analysts workflow.

Software Frame export on Right. FFmpeg Frame export with automatic de-interlacing using nearest neighbour and AR corrected at Export, on Left

If you only had one or two frames then using the software and then de-interlacing in something like Photoshop would be fine. If you required an entire sequence…..I know what I would chose. This does highlight another important point. The majority of footage from Video Surveillance Systems doesn’t reach the person who knows how to deal with it correctly. This is why we end up with interlaced images in the media!

As the H264 encoding had kept within the standard, it’s also possible to deal with the footage in Forensic Software such as Amped FIVE..

Amped

Loaded immediately into FIVE.

Conclusions

1. Exports need to be clearly defined. Any confusion only results in mistakes. Its often too late to identify that the wrong format has been exported. By the time its discovered – it’s been overwritten.

2. More details on the image would be good. Knowing how big, in data size, is nice for a network engineer, but for an investigator, the pixel measurements, the type of frame and the correct Display Aspect Ratio is required.

3. If software is capable of dealing with an interlaced stream, then this should be managed correctly. If de-interlacing is included within the software then this must be an option – not a default. As an analyst, I may want to chose a different de-interlacing method, but for the first responder, just producing a de-interlaced still image would be better than an interlaced one!

4. Exporting video from a playback utility is great. Its even better when the player is light and doesn’t need installing. A word of warning though, labelling and naming is very important. A lot of people may not totally understand the different between an Indeo AVI or a H264.

5. If it is possible to export the native stream – then allow it, and make it understandable.  A Date and Time subtitle export would be fantastic!

This is a good ‘lite’ player with some useful added benefits. With a bit of tweaking it could be great.

The information provided here has been supplied to assist the video security industry.

If anyone from Pelco wants to improve the systems using the information provided, please feel free to get in touch.

IFSEC Exports Index Page

Advertisements
By Spreadys Posted in EEPIP

4 comments on “IFSEC – Pelco Exports

  1. Hi,
    We have one exe file which contains the XPA file format, in it. We have extracted the stream data starting from 00000081 and played it using DS media player, but It failed to play the file. When I open the XPA file It shows unable to load XPA files.
    So I think we are not able to extract exact XPA files from exe.
    Can you tell me the start header sequence of XPA file?
    How can we extract the video stream from exe which contains the xpa file format?
    Is there any standard available for PXA format? We have searched on net but unable to find yet.
    Please help us out for above queries? Thanks in advance :-).

    • Hi Karen,
      it’s a difficult one without looking at the file you have.
      Many systems start their video data at different offsets, even when it’s the same make and model. As the Pelco VMS is able to deal with different video streams, encoded with different codecs, then without analysis it’s a bit difficult to assist.
      If you wish to outsource initial analysis, and identify extraction possibilities then please email me at david (a) forensicvideo.training

      • Hi,
        The video contents I am having are very sensitive and I cant share it with others. My basic concern is to decode xpa file. I have searched on Internet but didnt find any format pdf.
        So is there any tool available that analyses xpa file? Is it a media container or a video codec format?
        Is there any way I manually extract the file?
        If I am able to play the xpa file, I will share my code with you. Thanks in Advance 🙂 .

      • Hi again Karen. I am not aware of any tool unfortunately.
        The problem is that Pelco are one of the many companies who continue to ignore requests to ‘open’ their recording format. They quote privacy and security laws but to be honest, most of this is wrong. Video can be secured much better using other ways. Proprietary recording formats are put in for their own purpose.
        You can see some information here from Pelco’s knowledge base.
        http://buildingskb.schneider-electric.com/view.php?AID=14022

        As referenced in the blog article, if your xpa stream is from a standard camera and retained standard recordings then it ‘may’ be possible to decipher it.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s