±Partners and Sponsors

±Your Account


Nickname
Password


Forgotten password/username?


Membership:
New Today: 1
New Yesterday: 9
Overall: 26783
Visitors: 73

±Follow Forensic Focus

Join our LinkedIn group

Subscribe to news

Subscribe to forums

Subscribe to blog

Subscribe to tweets

Playing or converting .stream files from DVR / CCTV

Computer forensics discussion. Please ensure that your post is not better suited to one of the forums below (if it is, please post it there instead!)
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
Go to page 1, 2  Next 
  

Playing or converting .stream files from DVR / CCTV

Post Posted: Thu Aug 22, 2013 3:34 am

Hi,

I wonder if anyone could help.

I have a HDD from an old DVR CCTV setup which I need to extract the data off of. As the previous DVR equipment is broke, I first attempted to put the HDD in number of another DVR setups, including the exact same model of DVR, however each time either the drive was not recognised or requested to be reformatted.

I have connected the HDD to linux and been able to extract a number of .stream files from its linux ext3 formatted file system. I have tried every application I can think of to open these .stream files without luck including (Quicktime, VLC, MPlayer, Linux built in players etc). I have also searched online, and although I could find the default player for the model DVR the HDD is from, it was still unable to play the .stream file.

Does anyone know of a way to play the .stream files or to convert (even if forensically unsound) to another common video format?

Thank you in advance for any help,
Leo  

Leo2011
Newbie
 
 
  

Re: Playing or converting .stream files from DVR / CCTV

Post Posted: Thu Aug 22, 2013 3:51 am

- Leo2011

Does anyone know of a way to play the .stream files or to convert (even if forensically unsound) to another common video format?

Yes/No. Shocked
homepage.ntlworld.com....swers.html

See if this is of use Confused :
sourceforge.net/projects/defraser/

do search on the board for previous threads related to defraser.

jaclaz
_________________
- In theory there is no difference between theory and practice, but in practice there is. - 

jaclaz
Senior Member
 
 
  

Re: Playing or converting .stream files from DVR / CCTV

Post Posted: Thu Aug 22, 2013 4:03 am

Hi,
It is a common problem with CCTV, Aswami Ariffin wrote an interesting paper about it.
You could contact him (use google) and ask for the paper, I know it's LEA only.

I can give you the following advice:
- try to use an other CCTV device, same model, and make an export of a video with the most original data. So no export to avi/mpg etc, just an export with it's own viewer.
- I hope you got a separate data file and viewer executable
- have a look at the header of the data file and do a search on the harddisk buildin the CCTV
- you can also look for another part of the video if a header is added to the data file or you don't have a separate data file
- export some of the data out of the original CCTV harddisk and see if you can load it into the viewer software. Probably you have to play without to export the right structure out.
- If it works you could export data from the broken CCTV device and load it into the viewer software.

I tried this workaround a couple of times and it works sometimes.
The software Jaclaz mentioned can be usefull too, but it can be a problem if the CCTV stores the data on his own way.  

kbertens
Member
 
 
  

Re: Playing or converting .stream files from DVR / CCTV

Post Posted: Thu Aug 22, 2013 4:32 am

Hi, thank you both for your replies.

@jaclaz
Thank you for the advice when asking questions, as you can see this is one of my first posts so I appreciate any advice to ensure my comments and questions conform to the ForensicFocus community standards.

I have downloaded and tried defraser. Once I had created a new project and added one of the .stream files, it scanned the file and lists 694 MPEG-4 Video/H.263 files with various offsets and lengths. Going through these no frame previous or video keyframes are generated as the 'decoding failed'. I have also tried exporting the file to VLC and Windows Media Player, both unfortunately are still unable to play the file. Any ideas?


@kbertens
Thank you for your advice also. I have exported the video from the same model DVR and as expected it outputs the data and video viewer separately. Unfortunately, it has converted the data to a .DV4 file rather than the raw stream file, I could take the HDD out of this DVR and extract the data in its raw format again if you think it may help - but i'm guessing i'd end up in the same situation, with .stream files unable to be opened or used. I'll have a look now into the file headers of the DV4 file and see if I can manipulate those on a .steam file to get it working in the player, and continue with the rest of your suggestions and keep you informed.  

Leo2011
Newbie
 
 
  

Re: Playing or converting .stream files from DVR / CCTV

Post Posted: Thu Aug 22, 2013 4:43 am

- Leo2011

@jaclaz
Thank you for the advice when asking questions, as you can see this is one of my first posts so I appreciate any advice to ensure my comments and questions conform to the ForensicFocus community standards.

Naah, that was just a kidding remark Very Happy , it's not a "standard".

- Leo2011

I have downloaded and tried defraser. Once I had created a new project and added one of the .stream files, it scanned the file and lists 694 MPEG-4 Video/H.263 files with various offsets and lengths. Going through these no frame previous or video keyframes are generated as the 'decoding failed'. I have also tried exporting the file to VLC and Windows Media Player, both unfortunately are still unable to play the file. Any ideas?

No, unfortunately it is a hit and miss game AFAIK, and defraser has seemingly some issues, at least the "free" version.
Maybe if you could post the exact Model/Make of the CCTV recorder (and any other meaningful info, firmware revision, if available, etc.), someone might have specific previous experience to share.

jaclaz
_________________
- In theory there is no difference between theory and practice, but in practice there is. - 

jaclaz
Senior Member
 
 
  

Re: Playing or converting .stream files from DVR / CCTV

Post Posted: Mon Jan 06, 2014 2:32 pm

I had a DVR last year from a premises which exported files in .dv4 file format. Problem was the entire contents of the hard disk were required but we could not keep the recorder.
I cloned the hard drive forensically to ensure I had an exact copy of the original disk then attached the clone to a linux computer system.
i then copied all the .stream files from the clone drive to a FAT32 hard disk, obviously keeping the folder structure intact.
I then renamed the .stream files to .dv4 and the proprietary player downloaded from the recorder was able to play the files.

I have had another recorder since then which although visually looked different still downloaded files in .dv4 format and showed raw files as .stream files unfortunately all versions of the .dv4 player that i have failed to give pictures .

The above is definately worth a try!  

Paulw
Newbie
 
 
  

Re: Playing or converting .stream files from DVR / CCTV

Post Posted: Tue Jan 07, 2014 5:32 am

Thank you for the feedback.  

kbertens
Member
 
 
Reply to topicReply to topic

Share this forum topic to encourage more replies



Page 1 of 2
Go to page 1, 2  Next