Packetized elementary stream (PES) file

[wouter]

Hi,

For a forensic investigation I'm examining a DVR-recorder (http://www.samsung-security.com/Portals/0/GVIProductImages/369/SHR-2040_2042_Spec.pdf). This devices uses the Penta Micro MultiStream IV AT2041 (http://www.pentamicro.com/renew/sub/eng_catalog.php?boardid=board_eng_Download&mode=vi...&val=&CatNo=48) and Penta Micro MultiQuad II AT4012E chip.

I'm trying to play an MPEG_STREAM of 150 gb which was found on the device. I have made a small recording for test purposes, this is a 1 minute recording with three cameras. Rate 5 ips, video size cif(c) and quality mode very high.

the chip manufacturer (PentaMicro) told me the MPEG_STREAM file is a Packetized elementary stream (PES). Is it possible to convert this so it can be played?

Link to test MPEG_STREAM

[aedipuss]

doesn't really matter what the chip produces, as it was further encoded and recorded as mpeg4 per the samsung specs. but the sample isn't recognizable as a video of any type.

since you have the device, hit rewind and then play. if nothing plays the device is either broken or encrypted with a password as the unidentifiable video sample suggests.

[wouter]

No it isn't so easy as hitting the replay button! I need to play the complete stream, this isn't possible with the device.

I have found out that if the first four bytes of the headers are changed from 0x0000E001 to 0x000001E0, it is recognized as an mpeg sequence. Samsung probably generated their own header id.

I think the (or parts of the) file first need to be converted (also because the file is multiplexed) to MPEG before it can be played. I just don't know how....

I know for sure the file is not encrypted.

Please help!

[aedipuss]

at least in the sample there doesn't seem to be a recoverable mpeg of any kind, stream/program/or mpeg4. muxed or not - 6 different mpeg repair tools came to the same conclusion.

the machine is a recorder/player why wouldn't it play it?

[wouter]

it uses bookkeeping files which holds pointers and timestamps to the mpeg_stream. When I change a timestamp in the bookkeeping file, the stream can't be played anymore. So somewhere in the stream there's a check with timestamps.

Some of these bookkeeping files aren't available anymore.

For my research I need to play the whole stream.

example bookkeeping file:
corresponding bookkeeping file of the sample mpeg stream

[aedipuss]

according to the online manual - passwording is set on by default to 4321. if it was changed keep pressing mode and 5 together to reset to factory defaults.

then try the machine's backup utility. set it to avi and any computer should be able to play the resulting file you can write to an external usb hard drive.

if the data is too corrupted for the machine to read that's probably about all that can be done.

even the bookkeeping file appears to be unreadable. no database or hex editor can make any sense of the machine's files.

[wouter]

Already tried the backup utility. This function uses the bookkeeping files, so this method isn't working. The database is a Berkley db database, btree version. Files can be loaded and dumped under Linux using the db4.5_dump command, https://honeyman.nnov.ru/cgi-bin/man/man2html?db4.5_dump+1.
db files have for every second (Linux timestamps), for every camera, a pointer (supposedly) to the MPEG stream. These timestamps have to correspond with the timestamps in the stream (not clear how this is done). I will post the dumped db file tomorrow.

Here is some more info on PES:
http://en.wikipedia.org/wiki/Packetized_Elementary_Stream
http://dvd.sourceforge.net/dvdinfo/pes-hdr.html
http://www.zenith.com/sub_hdtv/mpeg_tutorial/pespckt.HTM

Interesting:

Among other things, the PES packet header may also contain timing references: PTS (presentation time stamp, the time at which a decoded audio or video access unit is to be presented by the decoder); DTS (decoding time stamp, the time at which an access unit is decoded by the decoder); ESCR (elementary stream clock reference).

Thanks for the help so far!

[aedipuss]

the manual doesn't say, but if the video was encrypted using a different password than the one you are using to access the machine would they still be unreadable? you may need to contact the manufacturer for that answer.

[wouter]

I contacted the manufacturer, no response yet.

Mean while, I think I found a program (mencoder for Linux) that is able to do something with the stream. It recognizes the size file format (RAWDV) and size (720x480).

Is there someone that knows this program who can help me?

[wouter]

No results with mencoder so far.

I am pretty sure it is not a PES file, but a raw dv file. I made a new test recording, with only one camera no sound and also exported this to DVR format with the system.

The MPEG stream and DVR file are almost exactly the same size. The structures of both files are very similar!

I have found a topic that matches my problem https://forum.videohelp.com/topic331833.html

When I rename MPEG_STREAM to MPEG_STREAM.dv and play this in VLC player I have exactly the same image as http://img507.imageshack.us/img507/3961/screenshotyj7.png




Exported dvr file
dvr.dvr

[wouter]

And the MPEG_STREAM (renamed to .dv)

mpeg_stream.dv