[FFmpeg-user] Prove that video file does not have content removed or added
André Luís Duarte
andrelduarte at yahoo.com.br
Sat Jul 23 01:04:39 EEST 2016
I am involved with another project in computer forensic where I have to prove that several video files are intact (was not added or removed content). I thought it would be easy but I'm a little difficulty.
I thought of running ffprobe command to see the file characteristics and got the following output.
Input #0, avi, from 'sample01.AVI':
creation_time : 2012-05-15 17:37:35
encoder : SONY DSC MJPEG 0100
Duration: 00:00:46.27, start: 0.000000, bitrate: 2833 kb/s
Stream #0:0: Video: mjpeg (MJPG / 0x47504A4D), yuvj422p(pc, bt470bg/unknown/unknown), 320x240, 2735 kb/s, 30 fps, 30 tbr, 30 tbn, 30 tbc
title : SONY DSC MOVIE
Stream #0:1: Audio: pcm_mulaw ( / 0x0007), 11025 Hz, 1 channels, s16, 88 kb/s
I converted the video time duration (00:00:46.27) for seconds and got the value: (46*60)+27 = 2767 s
Give this value multiplied by the amount of 30 fps and obtained the following value: 2767 * 30 = 83610.
I thought the logic was right, but to see the amount of frames in the video with the command:
ffprobe -show_frames -select_streams v:0 sample01.AVI
I got a output information and the final of message is:
[FRAME]t message repeated 692 times
I understand the output for the command, the pkt_pos line = 16330824 has the number of the frames in the video file.
The calculated value (2767 * 30 = 83610) and read the value in the attribute (pkt_pos = 16,330,824) are vastly different.
Can anybody help me to see where the error? An is a interpretation or arithmetic error?
Please forgive the bad English!
More information about the ffmpeg-user