I might be missing an obvious option here but for the life of me I can't see it.
IEF doesn't appear to be able to export out video files.
The report creates the strip thumbnails of the video files so one would assume that it can indeed decode the files themselves, but I can't find an option to export or even play the files.
Strange thing is it exports and (attempts) plays the carved video files it find, but not the existing ones.
Is this by design, anyone had luck exporting video files from IEF?
Hi Adam,
This is currently by design, due to the potential size of video files, we only currently pull out key frames rather than save the entire video to the case file, which could potentially create a huge case file.
However, due to a number of customers wanting the full video (such as yourself) and don't mind the potential large case file size, we'll be adding an option to save entire videos to the case so they can be exported later on.
Since the carved video is just fragments, we save the entire fragment to the case.
Hope that explains it, I know it doesn't help you right now. Your best bet is to go into Encase or other forensic suite and export the file from there, by going to the file specified in the Source column in IEF.
Let me know if you need anything else, feel free to contact me directly at jad(at)magnetforensics(dot)com.
Best regards,
Jad
Thanks Jad
In this instance the frames clearly show the content is not of interest so there is no issue. If the client really wants them as you suggested I can use Xways to export them out, I was mainly wanting to check I wasn't missing something obvious in the export options.