Recovering H.264 video files with Defraser 1.3.0 for free ?

H264 is a codec, ie type of compression used - and not the file structure.

What type of files are the good ones, eg do they have FTYP, MOOV and MDAT segments?

Sorry for the OT oops , but this is interesting

… an open source project coming from the Nederlands Forensisch Instituut (NFI).
….
I found that this plugin or at least its draft is available (although under developement) in the sources of the 1.3.0 version. However, it was removed in the binaries of the 1.3.0 and 1.3.5 versions.
….

An Open Source project (seemingly released under BSD license) without source. 😯

Unless I am mistaken the sources of the 1.3.5 have not been released at all.

jaclaz

@Jaclaz
Sorry, I should have written "a formerly open source project".
The authors of NFI Defraser do not describe their project as being open source ; it's just that I could find the sources for the 1.3.0 version. The BSD licence does not force any author to (re-)distribute the sources of a software, not to (re-)distribute it at all. It just fix how a software should be redistributed if it is.

@Forensic Focus readers
As Jaclaz mentionned, it's right that the sources of the 1.3.5 version are not available from Sourceforge.net. But as 1.3.5 suggests a minor version and the 1.3.0 should be quite similar.

In the features of the NFI Defraser 1.3.5 project on Sourceforge is written
"The new plugin for H264 is available for free for law enforcement in
the Netherlands. Outside the Netherlands the license is sold for
895 euro for maintenance and further updates."

The H264 detector was already in the 1.3.0 version (with source code), but was work in progress. I assume the NFI team realized that recovering H.264 videos was harder than for common video files because as Michael mentioned it, H264 a codec and not the file structure.
This might explain why they decided to sell the plugin once finished. Currently, I don't know how far from completion was the source of the H.264 plugin in the 1.3.0 version.

@Michael (mscotgrove)
I believe that I may find the FTYP segments, as I had previoulsy run scalpel, which found detected lot of MPEG signatures. I'm going to scan again the full drive with Defraser as I believe the scan was interrupted due to power failure. Then, I'll be able to look closer at hexadecimal signatures. I have currently no idea about the type of the files.

The manual doesn't tell about the container ; just that files have are either ".264" or ".nvr"
It's on page 23 http//shop.monacor.at/attachments/FLE/DMR286_1840_1880_2860-GB.pdf

The drive has a second partition, formatted ext2, which references the videos using one log file per day. Those files are binary and I don't know about their inner structure.

I believe your software would be very useful if it was able to work on an image of a partition independantly from the file allocation table. In my case the partition of unknown type was cloned to an NTFS image file.

@Jaclaz
Sorry, I should have written "a formerly open source project".
The authors of NFI Defraser do not describe their project as being open source ; it's just that I could find the sources for the 1.3.0 version. The BSD licence does not force any author to (re-)distribute the sources of a software, not to (re-)distribute it at all. It just fix how a software should be redistributed if it is.

Sure, not at all an issue with your description ) , but in my perverted mind, if you host a project on sourceforge.net you should also provide the source to it, or - if you prefer - ONLY open source projects should be hosted on sourceforge.

BTW it is also in the terms of the site
http//slashdotmedia.com/terms-of-use/

7. SourceForge.net Submissions/Content

When you submit, post, upload or otherwise provide Code to SourceForge.net, you must designate promptly the software license pursuant to which licensees, including Slashdot Media, obtain rights with respect to such Code. Except as otherwise expressly permitted by these Terms, any Code submitted to SourceForge.net must be licensed to Slashdot Media and other licensees under a license that is compliant with the Open Source Initiative (“OSI”)’s Open Source Definition (http//www.opensource.org/docs/osd) or certified as an “OSI-Approved License” (http//opensource.org/licenses).

And of course an essential part of the Open Source Definition is that the Source should be made available, most probably the Authors consider the "plug-in" a separate project that they "sell" separately.
And it is very possible that also the "plug-in" is actually Open Source, and BSD licensed, but only available in exchange for several hundred bucks, nothing "wrong" in "Commercial, BSD licensed" software.
But still the source for the 1.3.5 version (without the plug-in) is seemingly missing, and this is not anymore "Open Source".

Sorry for the OT oops .

jaclaz

More than three days now that I'm running Defraser 1.3.0 trying to extract videos that are H.264 encoded. I selected a few potential container formats.

Defraser displays "Running detectors on my-image-of-the-drive.img" and the progress bar seems frozen at one third of the total.

The drive was imaged as a 1 Tb NTFS file.
I assume that using a huge file rather than a raw drive doesn't help, but I had no other choice as Defraser runs on Windows and requires a file. It's maybe not the best tool for my needs.

The processor is running at 1,86 GHz and the total RAM is 4 Gb.
I assume the software is interpreted and hence slower.

Because I wonder if Defraser will ever be able to recover anything, I'm looking for alternatives, maybe semi-automatic techniques.

I assume the first thing to do is to list the locations of potential H264 videos.
But which file signature to take as I don't know the container ?

From this thread, as well as from Garry Kessler's file signatures, I guess that "00 00 00 01 67" as well as "00 00 00 ? 66" could be good candidates to carve H264 videos, but any other other technique to list the locations of either the containers or the bitstreams would be much welcome.

@mscotgrove Do you think that your software could be adapted to recover videos from "RAW" partitions (which were not previously in NTFS nor FAT)?

Zul22 - I sent you a PM

My software will work with raw images

As far as I know, a file signature is not enough - you need to know the codec, and reconstruct ftyp and moov segments as well. Not a trival task. It can be helped if you do have a valid working sample.

@mscotgrove

Thanks.
Reconstructing H264 videos doesn't seem easy…
Thank you for the PM and your proposal. I'll try your software.

Unfortunately, I don't have any valid file example as the partition type is not detected by gParted. So, I have to scan for possible video signatures.

What type of files are the good ones, eg do they have FTYP, MOOV and MDAT segments?

I carved the drive image using "ftyp", "moov" and "mdat", generating 10 Kb files.

The first bytes after "ftyp", "moov" and "mdat" are random.

Is it possible that the H.264 bitstreams are not encapsulated and is there a way to reconstruct the full bitstream (unfragmented), in order to include it afterwards in a container?

If you have roughly the same number of ftyp, moov and mdat tags on a disk, it is likely that they are encapsulated.

ftyp are normally only 0x14 to 0x24 bytes long

moov atoms have a structure that will be consistent for the video recorder, and will have
groups of data preceded by 4 byte tags

mdat often looks like random data, the headers for audio and video can be 'subtle', but may just be a length which is different for every frame.