Featured Post

Welcome to the Forensic Multimedia Analysis blog (formerly the Forensic Photoshop blog). With the latest developments in the analysis of m...

Monday, May 19, 2014

FFmpeg and Libav problems

Yesterday, Larry Compton wrote an excellent piece on the caution necessary when converting proprietary files. This topic is on everyone's mind.

To add my two cents to the conversation, I'm seeing more proprietary file types than standard these days. Thus, the amount of time spent researching the player, the codec, the container, the contents ... testing the player/file playback ... verifying frame counts, looking at the GOP, verifying, testing, re-testing ... and so on ... is rather burdensome.

If you're not checking and re-checking, testing and re-testing, you may be open for a challenge later on. Sometimes, FFmpeg moves so fast, you miss those vital cues that something's amiss. As Larry points out, if you see red or yellow text, you've got issues worthy of investigation.

Because FIVE uses FFmpeg, I'm always worried that the basic user will accept at face value what is created through the Load filter when using the Change/Convert tools. DON'T!!! You're an analyst. Test. Re-test. Verify. Sure, FIVE is easy and fast. But, nothing is perfect ... especially when dealing with some of the most dodgy evidence known to the justice system - proprietary digital CCTV files. If the converted file has a different frame count than the original, the conversion didn't work correctly. If your converted file's I Frames aren't in the same place as they were in the original file ... etc. With FIVE's support, you can bring these issues up to the developers. I may send them a few clips per week for further analysis of the conversion issues that come up.

Moral of the story ... check your work, test your theories, verify your tools.

No comments: