Broken/proprietary MPEG file format - detected as PES stream, looks like TS

[snvy]

Hi everyone! Hope you're having a great day

I'm currently working on recovering a few dozen gigabytes of video from an old TV set top box [Ferguson DF9000 PVR].
The internal hard drive of the PVR which the recordings have been stored on seems to have a proprietary filesystem onboard, but after imaging the drive I am able to play back parts of the recording data by splitting the image.

Now here's the problem: the files at first seem corrupted, refusing to play on VLC/MPC-HC or playing only corrupted audio. ProjectX recognizes the files as PES streams and detects corrupted video and audio. Changing the settings or the direct stream type did not help.

As no software helped I opened the files in a hex editor and started analyzing them with my limited knowledge of the MPEG specification. None of the files contained any MPEG-PS headers. The only useful and correct data I could find were the PES packets. The audio packets seem to be ok and they all have fixed lengths, however the video packets all have the length in the header set to 0, which seems to only be possible when stored as MPEG-TS. It also looks like the cause of the video refusing to play in most of players. There are no occurrences of any of the valid TS sync bytes in the files.

The furthest I have gotten in the recovery process is to find and remove all audio PES packets with a script leaving only the video packets as a result, then force ProjectX to process the resulting file as ES video. The video now plays with significantly less drops, which I assume is due to bypassing the limit of 65k bytes per PES packet, which would not be an issue if this was a TS file.

Is there anything else I could try? I have left sample files in the attachments [1 is 720x576i, 2 is 544x576i, 1_fixed is the ES video only version I managed to create].

Thanks in advance for any help!

[october262]

Hi everyone! Hope you're having a great day

I'm currently working on recovering a few dozen gigabytes of video from an old TV set top box [Ferguson DF9000 PVR].
The internal hard drive of the PVR which the recordings have been stored on seems to have a proprietary filesystem onboard, but after imaging the drive I am able to play back parts of the recording data by splitting the image.

Now here's the problem: the files at first seem corrupted, refusing to play on VLC/MPC-HC or playing only corrupted audio. ProjectX recognizes the files as PES streams and detects corrupted video and audio. Changing the settings or the direct stream type did not help.

As no software helped I opened the files in a hex editor and started analyzing them with my limited knowledge of the MPEG specification. None of the files contained any MPEG-PS headers. The only useful and correct data I could find were the PES packets. The audio packets seem to be ok and they all have fixed lengths, however the video packets all have the length in the header set to 0, which seems to only be possible when stored as MPEG-TS. It also looks like the cause of the video refusing to play in most of players. There are no occurrences of any of the valid TS sync bytes in the files.

The furthest I have gotten in the recovery process is to find and remove all audio PES packets with a script leaving only the video packets as a result, then force ProjectX to process the resulting file as ES video. The video now plays with significantly less drops, which I assume is due to bypassing the limit of 65k bytes per PES packet, which would not be an issue if this was a TS file.

Is there anything else I could try? I have left sample files in the attachments [1 is 720x576i, 2 is 544x576i, 1_fixed is the ES video only version I managed to create].

Thanks in advance for any help!

are the files encrypted (copy protected) ??

[johns0]

All the files are corrupted and only plays broken audio with no video.

[hech54]

That's one of a half dozen identical European cable TV boxes. In Germany they were branded as SagemCom. They ARE encrypted.

[snvy]

are the files encrypted (copy protected) ??

They ARE encrypted.

They don't seem to be, the video and audio can be played back with only minor corruption which would usually not be the case for a fully encrypted stream [also, the 'scrambling control' in the PES headers is set to 0, which I guess is used to represent that the files use copy protection]

That's one of a half dozen identical European cable TV boxes. In Germany they were branded as SagemCom.

The PVR I have was one of those boxes that had the main selling point of being "open", so it had way less restrictions on the usage such as allowing firmware modifications and not encrypting recordings. Later models of these devices actually had a USB port which allowed to make unencrypted recordings on external hard drives to a ts format. There also seems to have been at least one community-made tool to read the recordings from my model, but it seems to be lost to time due to it's niche .

The only thing I hope for is that the format used by the drive was also used in other boxes [as you said, they were more or less identical] and there's still some documentation/knowledge around about similarly structured formats, just under a different model