Featured Post

Welcome to the Forensic Multimedia Analysis blog (formerly the Forensic Photoshop blog). With the latest developments in the analysis of m...

Monday, May 20, 2013

Timestamps in FIVE

 A few weeks ago, Amped released a new update for FIVE that includes a 64 bit version of their software. A week later, they released another update with some other improvements and a few new tools. One of the features that they updated is the Write Timestamp filter. As they note in their blog post, "Sometimes when you export a video that comes from a proprietary DVR format from CCTV you may lose the date and time information that was impressed on the native format when playing it. With the Write Timestamp filter you can manually add back the date and time information so you can quickly locate events of interest at known times."

All of this presupposes that you know what the correct time should be.

First published in 1988, ISO 8601 is the international standard for the worldwide exchange and communication of date- and time-related data. Thus, the ISO 8601 standard date format is commonly used in metadata. Complicating matters a bit are those standards bodies that cover the metadata space. The Dublin Core™ Metadata Initiative, or "DCMI" for example, is an organization supporting innovation in metadata design and best practices across the metadata ecology. The DCMI listing for date defines the property as "A point or period of time associated with an event in the lifecycle of the resource." By this definition, the property includes time information, not only date. More importantly, the DCMI recommends that date information be stored according to the W3CDTF profile of ISO 8601. This format normally lists time zone and precision. This data is often believed to be missing by those who lack the ability to peek into stored binary formats. But, if you have the data and the means to decode it, then you have what you need to rebuild these timestamps in FIVE.

One confusing element to many has to do with Coordinated Universal Time (UTC) or Zulu time (Zulu time is the term for UTC used by western military agencies). When the time is deliberately expressed in UTC, as is often the case with DVRs produced in Asia and sold to the west, then W3CDTF/ISO 8601 indicates that you use "Z" for the timezone designator, e.g., 2012-03-15T12:12:04Z. Many CCTV systems standardize on always using UTC because its consistent worldwide. That practice is helpful when carving data from storage devices as it makes sorting and searching more convenient.

Thus, if you are able to carve out and parse this information, then getting this information back into your video is where the Write Timestamp filter comes in. It's as simple as data entry, as they explain in their blog post.

If you would like to learn how to carve this type of information from CCTV storage drives, I'm hoping to do a workshop on this topic at next summer's NATIA conference in San Diego. 

Enjoy.

No comments: