[FFmpeg-user] Prove that video file does not have content removed or added

[André Luís Duarte]

Hi guys

I am involved with another project in computer forensic where I have to prove that several video files are intact (was not added or removed content). I thought it would be easy but I'm a little difficulty.

I thought of running ffprobe command to see the file characteristics and got the following output.
ffprobe sample01.AVI...

Input #0, avi, from 'sample01.AVI':
Metadata:
creation_time   : 2012-05-15 17:37:35
encoder         : SONY DSC MJPEG 0100
Duration: 00:00:46.27, start: 0.000000, bitrate: 2833 kb/s
Stream #0:0: Video: mjpeg (MJPG / 0x47504A4D), yuvj422p(pc, bt470bg/unknown/unknown), 320x240, 2735 kb/s, 30 fps, 30 tbr, 30 tbn, 30 tbc
Metadata:
title           : SONY DSC MOVIE
Stream #0:1: Audio: pcm_mulaw ([7][0][0][0] / 0x0007), 11025 Hz, 1 channels, s16, 88 kb/s

I converted the video time duration (00:00:46.27) for seconds and got the value: (46*60)+27 = 2767 s

Give this value multiplied by the amount of 30 fps and obtained the following value: 2767 * 30 = 83610.

I thought the logic was right, but to see the amount of frames in the video with the command:

ffprobe -show_frames -select_streams v:0 sample01.AVI

I got a output information and the final of message is:

[FRAME]t message repeated 692 times
media_type=video
stream_index=0
key_frame=1
pkt_pts=1387
pkt_pts_time=46.232871
pkt_dts=1387
pkt_dts_time=46.232871
best_effort_timestamp=1387
best_effort_timestamp_time=46.232871
pkt_duration=1
pkt_duration_time=0.033333
pkt_pos=16330824
pkt_size=11662
width=320
height=240
pix_fmt=yuvj422p
sample_aspect_ratio=N/A
pict_type=I
coded_picture_number=0
display_picture_number=0
interlaced_frame=0
top_field_first=0
repeat_pict=0
[/FRAME]

I understand the output for the command, the pkt_pos line = 16330824 has the number of the frames in the video file.

The calculated value (2767 * 30 = 83610) and read the value in the attribute (pkt_pos = 16,330,824) are vastly different.

Can anybody help me to see where the error? An is a interpretation or arithmetic error?

Please forgive the bad English!