Avigilon .ave files

I have had a few emails surrounding these files over the last few months so thought it worthwhile to share my findings.

First up, hopefully your .ave files have been supplied to you with some software. This test footage came with a standalone player. Image 12

Why? Well although the player is downloadable….

http://avigilon.com/support-and-downloads/for-software/software-updates-and-downloads/

apparently you need a licence key!

Image 13

I would love to have tested this, but unfortunately a number of the download install links failed during my testing. If it does start working and you give it a go – if you do require a licence key – please add a comment and let me know.

Note to Avigilon – After an Evidential Export, the next most important task is to facilitate immediate playback of that footage. Players should be immediately available online, they should not require a licence and should not require installing. Remember – most corporate computers are behind very secure and controlled IT systems. 

UPDATE (22/10/15) – Thanks to a bit of research by another analyst, the following FTP site gives a link to a standalone Player:

ftp://ftp.avigilon.com/ACC/ACC_5.6.2.14/

That makes things a little easier!

OK, where was I?

Image 002

The standalone version of the player supplied with my test export reports version 5.4.2.16.

After running the player, and then opening an.ave file, the standard player interface appears.

Image 001

Date and Time Overlay, Timeline scrub bar, player controls etc etc…

With a right click, and selecting camera properties, we get some useful information. The camera was a H264 ONVIF Standards compliant and it was recording at 720×480.

Image 003

Again, under the right click options we get an export frame function.

Image 004

This is worth highlighting due to the controls that a user has in exporting images. A user can control the region,format, resolution, and colour and intensity levels.

The result being that it would be possible to receive an uncompressed image, exported from this player – but it being cropped, re-scaled and having incorrect colour and levels. Worrying.

Up in the top right, we have some options hidden away under a settings icon.

The first one of note being “Authenticate Images”.

Image 005

Image 006

The important information here is that the software is reading 531 frames. We can use this information later…

For now though, what information is under ‘Player Settings’.?

Image 007

Knowing that these settings are here could be important, especially if you are dealing with an interlaced source. Another issue, that could affect validation processes, is the display quality. Taking a screen grab of a correctly scaled image and comparing that to exports or recovered video data is often a way to assess video quality and identify any player processing. I think i’ll change this to Maximum – why would I want to see an image of a lower quality than the original?

Nowhere could I find any method to export the video… until I received a friendly nudge to check out the small + icon in the top left.

Image 008

So, that’s where the EXPORT was hiding!

Image 009

There are a number of options for export format. In the example above I have used TIFF images. Be careful of the resolution options. In the next export test I chose AVI…

Image 010There is a choice of codec, with none being uncompressed – so it should be the same as the original! There is no choice for original – No transcoding.

At the end of every export, a little message appears. The frames exported match the number of ‘authentic frames’.

Image 011

Now that we have some exports to use in our analysis, lets dig a little deeper into this .ave file.

The camera stated that it was an ONVIF Compliant H264 – that’s a good start point as hopefully this means that the stream is a standard H264.

To make things easier, I have conducted all my analysis and file quality comparisons in Amped FIVE.

After dropping the .ave file into FIVE, it has opened immediately, using the Directshow video engine. All initially appeared OK but after taking a look at the frame count..

Test_AVE_Native_2-151019001405

This read 453 frames. How many were reported by the software as authentic? – 531!

With 78 frames missing it is clear that Directshow is not reading the H264 correctly. Before doing anything else, what about the TIFF sequence?..

ACC Export - 2015-10-18 17.43.50-1-151019001349

These dropped in without any issues… what about the uncompressed AVI?..

ACC Export - 2015-10-18 17.45.04-151019001341

Again, no issues…. but…. they were different. Look at the Histogram and values. The AVI was much darker.

I mixed the two (The TIFF and the AVI), and had a look at the difference. I have accentuated the difference here to make it visible. If they were the same – it should all be black.

Video Mixer-151019001358

So, Directshow misses frames and the TIFF’s and the AVI are different…. Back to the .ave file!!

This time I loaded the .ave into FIVE using FFmpeg to wrap the stream. This is completed from within the Interface using the Convert DVR tool.

Test_AVE_Native_2.ave-converted-151020235838

We now have 533 frames!… i’ll come back to that in a moment but the raw data was read perfectly.

It would appear that both the Tiff and AVI exports go through some level adjustment during the export from the player. Not a big deal for many tasks but it could interfere with analysis and enhancement of small details. The difference is more than I would expect from a standard YUV to RGB conversion.

Where have those extra 2 frames come from? The last 2 frames in the rewrap are duplicates. This is due to the embedded presentation time stamp (PTS) holding the last frame for that duration.

I checked the timing by adding in the timecode to match the player.

Add Timestamp-151019001453

This was frame accurate with the milliseconds matching the player, the AVI and the TIFF sequence.

So, in conclusion….

  • The player has its faults but the functionality of the exports are suitable for validation purposes.
  • The exports do suffer with some hidden processing during transcode.
  • The H264 stream can be read by Directshow but be careful of missing frames.
  • FFmpeg can rewrap the stream and the PTS is read correctly.

As always, I hope this helps in the never ending, but rewarding, challenge of Forensic Video Analysis.

Advertisements
By Spreadys Posted in EEPIP

12 comments on “Avigilon .ave files

  1. Great post. The hidden processing you’re seeing during export is the Display Adjustments button below the preview image. To disable enhancements and leave the original image contrast as-is, minimize the black level and maximize the white level. I’ve asked others before and found that Avigilon supports variable frame rate in legacy AVI files by bumping the frame rate to 120 so the video can seamlessly transition from 15 to 30 or any other number. Instead of duplicating frame data, it uses more precise timestamps. Some brittle software may not handle that properly.

    • Thanks for the info on the levels. I left these as default. It’s strange that the software assumes some adjustments are needed. Yes, the 120 fps is getting common. It does cause some hiccups with some software. Luckily FIVE uses frames rather than time.
      Thanks again, your info on levels will be of help to many readers.

      • You’re welcome. My understanding of contrast adjustments is as follows. To a large extent you can consider the analogy of digital photography with consumer JPEG and professional RAW which defers some processing. Best capture of detail and optimal viewing on a monitor by the human eye have different constraints. Good cameras attempt to keep as much dark contrast as possible without saturating bright areas. Some cameras will stretch the contrast at capture time to make it look good on a monitor out of the box. Others will try to remain as close to the original sensor image as possible and allow the VMS to fine-tune the desired contrast range when viewing or exporting. Since most Avigilon cameras provide HDR images it becomes their defining feature, especially if you test the Change Image Region button and focus on darker or brighter areas.

    • There is an FTP link in the post that takes you to the standalone player. I believe that this does not require a key.
      If you find that it does, you will have to contact Avigilon.
      If that’s the case, please let me know and I will do some enquiries myself.

  2. Hi,

    Thanks for the info, finally managed to open the .ave files I had access to. Just wanted to let everyone know that the link to the FTP is not valid anymore (they removed the folder), but if you navigate one level up you can still find the different available versions.

    ftp://ftp.avigilon.com/ACC/

  3. This is fantastic…and yes, looks like the latest [09/28/2016] standalone player edition is 5.10.0.16 which doesn’t require a license (Windows 10 Pro prompts that it cannot verify publisher and tries to deny installation…click on “More Info” and “Run Anyway”) can be found here: ftp://ftp.avigilon.com/ACC/ACC_5.10.0.16/AvigilonControlCenterPlayerStandAlone-5.10.0.16.exe

    Thanks very much for publishing this important and useful information!!

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s