Many digital cameras that have video capability use an AVI format whereby individual frames are stored as jpegs. While allocated the user will see only a single AVI file. However, within that file each frame has a jpeg header.
This is great information. Is there anything that supports this, or that can be referenced in the future? I found the following
http//
http//
http//
I'm having trouble seeing where the individual frames are provided as JPGs, though…
These are most likely motion jpeg files or jpeg 2000.
Good link here to the file format specification here
http//
and also a quick introductory power point
http//
Yes you will find these files a lot when dealing with digital cameras, if the file is not completely contiguous you will be missing the header and just carving out the single frames.
Its also worth noting that video editing software can output these files with no fuss. So seeing a 'well known' movie file like this could be an indication that the movie has undergone conversion using this type of software.
As far I am aware the use of these jpeg2000 files does not have much baring on the container format being used, in which case there could be varying file signatures, extensions, headers etc associated with these kind of movie files. ie. you could find these inside an avi or an mpeg etc.
gmarshall beat me to the answer… I've had this happen on several cases. You're not alone on this one.
Many digital cameras that have video capability use an AVI format whereby individual frames are stored as jpegs. While allocated the user will see only a single AVI file. However, within that file each frame has a jpeg header. Thus, any file finder looking for the header will recognize each as a separate jpeg image file. Most of these cameras are creating 30 frames per second of video so you can see how they pile up.
As far as the "popular" movies go, it could be that they were converted by a program using a similar format.
Walter,
Do you have any information that documents this, or can be referenced?
Thanks!
No documented information about this… sorry. I've worked lots of cases, and I've had this happen probably 10 or 15 times.
This should be relatively easy to re-create.
1) Create a set of test videos. I'd start with a RAW AVI captured via firewire. Convert the RAW AVI into Divx, Xvid, wmv, VOB, MPEG-2, etc.
- I think the cases that contained these hits had lots of home movies. I'd guess RAW AVI videos are more likely to allow this to happen. Although it's possible the keyframes (http//
- The original poster could use allocated video files from the case where this is occurring. as a test data set.
2) Use EnCase, FTK, or Scalpel (or some other carving utility) to carve for graphic image files (JPG, gif, BMP, etc) from the test video files. They don't have to be put into unallocated space. You should be able to carve from the allocated file directly.
- I cannot say for 100% that it was a JPG file that was carved. Could have been another image file type. I carve for all of them.
note We can spend hours arguing over video file formats, containers, technologies, etc. All my statements are generallities.
I hope that helps.
Walter
Maybe we are talking about "Motion JPEG"
http//
It seems like also QuickTime can use/uses something like this.
And AMV, though not "open" has been "reversed".
However. (
Unlike the video formats specified in international standards such as MPEG-2 and the format specified in the JPEG still-picture coding standard, there is no document that defines a single exact format that is universally recognized as a complete specification of “Motion JPEG” for use in all contexts. This raises compatibility concerns about file outputs from different manufacturers.
having a quick look at the FFMPEG page
http//
reminds me of the geekish saying
I love standards, there are so many of them…
wink
jaclaz