Quantcast
Channel: Forensic Focus Forums - Recent Topics
Viewing all articles
Browse latest Browse all 20110

Forensic Software: Recovering H.264 video files with Defraser 1.3.0 for free ?

$
0
0
If you have roughly the same number of ftyp, moov and mdat tags on a disk, it is likely that they are encapsulated. ftyp are normally only 0x14 to 0x24 bytes long moov atoms have a structure that will be consistent for the video recorder, and will have groups of data preceded by 4 byte tags mdat often looks like random data, the headers for audio and video can be 'subtle', but may just be a length which is different for every frame.

Viewing all articles
Browse latest Browse all 20110

Trending Articles