MP4$Video$Authen/caon$Using$...
Transcript of MP4$Video$Authen/caon$Using$...
![Page 1: MP4$Video$Authen/caon$Using$ …old.dfrws.org/2015/proceedings/presentations/DFRWS2015-pres6.pdfMP4$Video$Authen/caon$Using$ File$Structure$and$Metadata$ $$ Jake$Hall$ MP4/3GP$Video$](https://reader031.fdocuments.us/reader031/viewer/2022022514/5af120277f8b9abc788e0cff/html5/thumbnails/1.jpg)
MP4 Video Authen/ca/on Using File Structure and Metadata
Jake Hall
![Page 2: MP4$Video$Authen/caon$Using$ …old.dfrws.org/2015/proceedings/presentations/DFRWS2015-pres6.pdfMP4$Video$Authen/caon$Using$ File$Structure$and$Metadata$ $$ Jake$Hall$ MP4/3GP$Video$](https://reader031.fdocuments.us/reader031/viewer/2022022514/5af120277f8b9abc788e0cff/html5/thumbnails/2.jpg)
MP4/3GP Video
• Video Coding Formats – H.264 – MPEG-‐4 Part 10 – Advanced Video Coding (AVC)
• File Container Format – MP4 – 3GP, 3G2
![Page 3: MP4$Video$Authen/caon$Using$ …old.dfrws.org/2015/proceedings/presentations/DFRWS2015-pres6.pdfMP4$Video$Authen/caon$Using$ File$Structure$and$Metadata$ $$ Jake$Hall$ MP4/3GP$Video$](https://reader031.fdocuments.us/reader031/viewer/2022022514/5af120277f8b9abc788e0cff/html5/thumbnails/3.jpg)
Movie Atoms
• QuickTime File Format Specifica/on • Allow the media and the descrip/on to be stored separately
• Size > Type > Data • Parent / Child Nes/ng Conven/on
![Page 4: MP4$Video$Authen/caon$Using$ …old.dfrws.org/2015/proceedings/presentations/DFRWS2015-pres6.pdfMP4$Video$Authen/caon$Using$ File$Structure$and$Metadata$ $$ Jake$Hall$ MP4/3GP$Video$](https://reader031.fdocuments.us/reader031/viewer/2022022514/5af120277f8b9abc788e0cff/html5/thumbnails/4.jpg)
Original Go Pro Hero 3+ Black
![Page 5: MP4$Video$Authen/caon$Using$ …old.dfrws.org/2015/proceedings/presentations/DFRWS2015-pres6.pdfMP4$Video$Authen/caon$Using$ File$Structure$and$Metadata$ $$ Jake$Hall$ MP4/3GP$Video$](https://reader031.fdocuments.us/reader031/viewer/2022022514/5af120277f8b9abc788e0cff/html5/thumbnails/5.jpg)
Parsing
• 4 bytes @ 0x00 – size of atom – 32 bytes • 4 bytes @ 0x04 – type of atom – ^yp
• File Type Compa/bility
![Page 6: MP4$Video$Authen/caon$Using$ …old.dfrws.org/2015/proceedings/presentations/DFRWS2015-pres6.pdfMP4$Video$Authen/caon$Using$ File$Structure$and$Metadata$ $$ Jake$Hall$ MP4/3GP$Video$](https://reader031.fdocuments.us/reader031/viewer/2022022514/5af120277f8b9abc788e0cff/html5/thumbnails/6.jpg)
Parsing
• 4 bytes @ 0x20 – size of atom – 22742 bytes • 4 bytes @ 0x24 – type of atom – moov • 4 bytes @ 0x28 – size of atom – 108 bytes • 4 bytes @ 0x2C – type of atom – mvhd – Movie Header Atom
![Page 7: MP4$Video$Authen/caon$Using$ …old.dfrws.org/2015/proceedings/presentations/DFRWS2015-pres6.pdfMP4$Video$Authen/caon$Using$ File$Structure$and$Metadata$ $$ Jake$Hall$ MP4/3GP$Video$](https://reader031.fdocuments.us/reader031/viewer/2022022514/5af120277f8b9abc788e0cff/html5/thumbnails/7.jpg)
^yp @ 0x00 moov @ 0x20 • mvhd @ 0x28 • udta @ 0x94
• FIRM @ 0x9C • LENS @ 0xB0 • CAME @ 0xE8 • SETT @ 0x100 • AMBA @ 0x110 • free @ 0x190
• trak @ 0x214 • tkhd @ 0x21C • tref @ 0x278
• tmcd @ 0x280 • edts @ 0x28C
• elst @ 0x294 • mdia @ 0x2B0
• mdhd @ 0x2B8 • …
71 atoms in total
![Page 8: MP4$Video$Authen/caon$Using$ …old.dfrws.org/2015/proceedings/presentations/DFRWS2015-pres6.pdfMP4$Video$Authen/caon$Using$ File$Structure$and$Metadata$ $$ Jake$Hall$ MP4/3GP$Video$](https://reader031.fdocuments.us/reader031/viewer/2022022514/5af120277f8b9abc788e0cff/html5/thumbnails/8.jpg)
Using Atomic Parsley to Render Original Go Pro
![Page 9: MP4$Video$Authen/caon$Using$ …old.dfrws.org/2015/proceedings/presentations/DFRWS2015-pres6.pdfMP4$Video$Authen/caon$Using$ File$Structure$and$Metadata$ $$ Jake$Hall$ MP4/3GP$Video$](https://reader031.fdocuments.us/reader031/viewer/2022022514/5af120277f8b9abc788e0cff/html5/thumbnails/9.jpg)
Examples of Unique Atom Data
![Page 10: MP4$Video$Authen/caon$Using$ …old.dfrws.org/2015/proceedings/presentations/DFRWS2015-pres6.pdfMP4$Video$Authen/caon$Using$ File$Structure$and$Metadata$ $$ Jake$Hall$ MP4/3GP$Video$](https://reader031.fdocuments.us/reader031/viewer/2022022514/5af120277f8b9abc788e0cff/html5/thumbnails/10.jpg)
Adobe Premiere Structure Change
![Page 11: MP4$Video$Authen/caon$Using$ …old.dfrws.org/2015/proceedings/presentations/DFRWS2015-pres6.pdfMP4$Video$Authen/caon$Using$ File$Structure$and$Metadata$ $$ Jake$Hall$ MP4/3GP$Video$](https://reader031.fdocuments.us/reader031/viewer/2022022514/5af120277f8b9abc788e0cff/html5/thumbnails/11.jpg)
Original vs. Premiere
![Page 12: MP4$Video$Authen/caon$Using$ …old.dfrws.org/2015/proceedings/presentations/DFRWS2015-pres6.pdfMP4$Video$Authen/caon$Using$ File$Structure$and$Metadata$ $$ Jake$Hall$ MP4/3GP$Video$](https://reader031.fdocuments.us/reader031/viewer/2022022514/5af120277f8b9abc788e0cff/html5/thumbnails/12.jpg)
ffmpeg Structure Change
![Page 13: MP4$Video$Authen/caon$Using$ …old.dfrws.org/2015/proceedings/presentations/DFRWS2015-pres6.pdfMP4$Video$Authen/caon$Using$ File$Structure$and$Metadata$ $$ Jake$Hall$ MP4/3GP$Video$](https://reader031.fdocuments.us/reader031/viewer/2022022514/5af120277f8b9abc788e0cff/html5/thumbnails/13.jpg)
Original vs. ffmpeg
![Page 14: MP4$Video$Authen/caon$Using$ …old.dfrws.org/2015/proceedings/presentations/DFRWS2015-pres6.pdfMP4$Video$Authen/caon$Using$ File$Structure$and$Metadata$ $$ Jake$Hall$ MP4/3GP$Video$](https://reader031.fdocuments.us/reader031/viewer/2022022514/5af120277f8b9abc788e0cff/html5/thumbnails/14.jpg)
Comparison With Other Devices Panasonic Lumix DMC TS-‐5 LG G3
Samsung Galaxy S5
Samsung Galaxy S4
Samsung Galaxy S3
![Page 15: MP4$Video$Authen/caon$Using$ …old.dfrws.org/2015/proceedings/presentations/DFRWS2015-pres6.pdfMP4$Video$Authen/caon$Using$ File$Structure$and$Metadata$ $$ Jake$Hall$ MP4/3GP$Video$](https://reader031.fdocuments.us/reader031/viewer/2022022514/5af120277f8b9abc788e0cff/html5/thumbnails/15.jpg)
Notes
• Forensic Analysis of Video File Formats by Gloe, Fischer, Kirchner – hkp://dx.doi.org/10.1016/j.diin.2014.03.009
• QuickTime File Format Specifica/on – hkp://developer.apple.com/library/mac/documenta/on/QuickTime/QTFF/qnf.pdf
• Atomic Parsley – hkp://github.com/wez/atomicparsley