Analsis Hexadecimal mp4 - Penerbit,+127-140
Analsis Hexadecimal mp4 - Penerbit,+127-140
Analsis Hexadecimal mp4 - Penerbit,+127-140
2 (2021) 127-140
© Universiti Tun Hussein Onn Malaysia Publisher’s Office
AITCS
Homepage: http://publisher.uthm.edu.my/periodicals/index.php/aitcs
e-ISSN :2773-5141
DOI: https://doi.org/10.30880/aitcs.2021.02.02.009
Received 13 June 2021; Accepted 09 September 2021; Available online 30 November 2021
Abstract: In digital forensic, recovery of deleted and damaged video file plays an
important role in searching for evidences. However, failure to repair the corrupted
MP4 file may lead to delayed the searching process. In this project, a corrupted MP4
repair tool has been developed. This tool is called LiteMP4Repair. Development of
this tool is using Object-Oriented System Development methodology. The tool is
written using C#. This project creates an alternative way for repair corrupted MP4 file
which is focusing on corrupted file header. LiteMP4Repair tool focus on repairing
corrupted MP4 file using header substitution. This tool use substitution method by
using 10 random headers within 32bytes. For the result of testing the playable or
repairing corrupted MP4 file, there 10 corrupted MP4 from difference timeline has
been test. Finally, an alternative tool called LiteMP4Repair has been successfully
developed.
1. Introduction
The growth of digital camera, CCTV and security camera, which is used to capture image and
record video events was along with smart device. The demand for this device is increase by time was
shows that most people is using the smart device such as smart phone [1]. Besides that, these devices
are used by criminal to record illegitimate activities such as robbery, murder and threads. The data or
information from these devices can be used to identify the criminal to being justice. In criminal
investigation, the recorded video data often provides important evidence for a case.
To solve this issue, the video data restoration and video carving has been actively studied [2].
Studies on the file carving have targeted the restoration of different file types like pdf, zip, and image
files but there are small number of methods on carving of the file type like video. The existing
contributions in this field are based on manual comparison of video container structure and content,
which is time demanding and error-pron [3]. File carving is the process of reassembling computer file
from fragments in the absence of the file system metadata [4]. File carving is one of powerful method
that taking advantage of the video file structure.
The actual file content can be found by using conventional file restoration technique, but the file
cannot be restored if the file link is lost for example is lost part of header link file. For MP4 file, it
known as that it has a large volume and it was likely corrupted although the meta information a remain
in the file header. The existing technique based on restoration technique such as Frame-based recovery,
Bi-fragment gap carving (BGC) and Smart carving technique. These techniques are not efficient when
the target video file was fragmented though it can introduce the method of providing a signature of the
file system.
For this study, the propose tool are focusing only for corrupted of header MP4 file. In this study, a
simple corrupted MP4 repair tool has been proposed, in which corrupted header in MP4 file repair by
using 10 multiple header substitution that may able to repair and been display. This application can only
repair out one file at one time. 10 multiple header substitution that been used has its own characteristic
and category to been choose. The corrupted header MP4 file that be repair size file must less than 30MB.
This study is to test the functional of repair MP4 header by change the corrupted header with another
structure of header MP4 file. To complete the propose tool, the study for MP4 header structure is
important to may have a higher functionality for LiteMP4repair tool.
The remaining of the paper is organized as follows. Section 2 review all work related to the MP4
repair method. Section 3 presents the Object-Oriented System Development methodology used to
perform application develop tasks. Section 4 presents the result and discussion, Section 5 present the
results, and finally, Section 6 concludes the work and highlights a direction for future research.
2. Related Work
2.1 MP4 Overview
A file that use.mp4 file extension was an MPEG-4 video file format. MPEG-4 stands for “Moving
Pictures Expert Group 4,” which is a standard for audio and video coding compression[5]. MPEG-4 is
commonly shortened to “MP4.” MP4 files can be read by computer applications such as QuickTime
and VLC. This type of file is one of the common video file formats used for downloading and streaming
videos. MP4 files were created by the ISO/IEC14496-12:2001 standard by the ISO/IEC and Motion
Picture Experts Group (MPEG) [6].
Since 1999, the MPEG-4 standard has been undergone some involvement which make MPEG-4
has 3 part, which is Part1,2, and 3. this part were the initial standard that outlined the file format to
contain audio and video data. These 3 parts was been identify in ISO/IEC 14496-1, ISO/IEC 14496-2
and ISO/IEC 14490-3 [7].
Moreover, standard for MP4 file format been used today was made in 2003 which is MPEG-4 Part
14. MPEG-4 was introduced in ISO/IEC 14496-14, there have been many further amendments to
MPEG-4 file structure. Besides that, Advanced Video Coding (AVC) was introduced in MPEG-4 Part
10 defined in ISO/IEC 14496-10 in 2003. In 2004, MPEG -4 Part 15 defined in ISO/IEC 14496-15. In
this part, it introduced the storage format for encoded data.
Table 1: Comparison with MPEG-1, -2, and -4
128
Salim et al., Applied Information Technology and Computer Science Vol. 2 No. 2 (2021) p. 127-140
Table 1 shows the difference MPEG-1,2 and 4. The standardized for 3 type of MPEG is different,
which is MPEG-1 standardized out in 1992 for MPEG-2 is in 1994 and for MPEG-4 is in 1998. Besides
that, the picture structure for MPEG-2 and 3 is frame and Top/bot.field but only MPEG-1 do not have
Top/bot.field.
For picture type MPEG-1 use I, P, B, and D, MPEG-2 use I, P, and B-picture, and MPEG-4 use I,
P, B-rect/arb. Next, motion compression of block size for MPEG-1 was 16 x16, MPEG-2 was 16 x 16
(16 x 18) and MPEG-4 was 16 x 16 and 8 x 8. The transmission rate for MPEG-1 is up to 1.5Mbps,
MPEG-2 is 2 to 15 Mbps and for MPEG-4is from 64kbps to 150 Mbps.
In order to do this project, it is important to understand the MP4 container-based nature of the file
itself. MP4 file is made of a few separated units or individual data structure shown in figure 1. The first
version of MPEG-4 which is MPEG-4 Part 1 it called as atoms [8]. The second version that nowadays
use for MP4 which is MPEG-4 Part 14 called as boxes. Both versions are identified via unique 4-byte
sequences.
For each box, it begins with an unsigned 32-bit or 64-bit integer, but most of the box use the 32-bit
integer. On purpose of parsing the MPEG-4 boxes all byte size value will described in hexadecimal
value using prefix ‘0x’, where 0x00=0 bytes, 0x10=16 bytes, 0x20=32 bytes, etc.
MPEG-4 has three main type of boxes, namely file type (“ftyp”) box, the movie (“moov”) box and
movie data (“mdat”) box. The beginning of the file that provides information about the content of the
file is file type (“ftyp”) box. For the movie (“moov”) is contains information about the media within
the file and for movie data (“mdat”) box is provide the raw data for video and audio within the file.
Figure 2 shows the main structure of MP4 video file in hex-viewer.
129
Salim et al., Applied Information Technology and Computer Science Vol. 2 No. 2 (2021) p. 127-140
The example file for the file type (“ftyp”) box in figure 3, the first four bytes represent the size of
the box highlight with red colour. The next four bytes define as the type of the box in figure 3 highlight
with green colour. The ISO specification requires this box to exist as early as possible in the file. In
each file, it only must have one (“ftyp”) box and not more to follow ISO specification [11].
Figure 4 shows that the next four bytes is define as the movie (“moov”) box. The first four in red
represent the size of the box which is 0x0D 0xA8 bytes. The next four in green represent the type of the
box, which is 0x6D, 0x6F, 0x6F, 0x67.
2.2 Study of Existing Systems
Recovery application has been wisely developed by many companies as they see the potential of
recovery data. PhotoRec software and Restore media software are the two examples of the existing tool.
PhotoRec is an open-source digital forensic tool. This tool is designed to restore lost or corrupted
file such as document, audio, video, picture from the disk image. This tool use signature matching of
file to retrieves deleted file and also this tool do not consider the storage media file system metadata
[12]. The technique that use in this tool is text-based data recovery techniques [13]. So, each block
needs to be check against the signature databases. It can carve lost files from digital camera storage
media of, USB flash drives, hard disks, and CD-ROMs. Moreover, it restores most common photo
formats, audio files, document formats, such as Microsoft Office, PDF, HTML, and archive or
compressed formats. However, it does not attempt to write to the damaged media from where carving
is being performed [14].
Restore Media repairing technology us build on searching for all existing file fragment as well as
on repairing based on available information. It can repair a video from camera, android smartphones,
130
Salim et al., Applied Information Technology and Computer Science Vol. 2 No. 2 (2021) p. 127-140
drone and other device with internal and removable media storage device [15]. He/she software analyzes
the downloaded file for program errors and then fixes them by substituting lost during the process of
conversion /compression bits of information.
Frame-Based Recovery of Corrupted Video Files Using Video Codec Specifications is one of
technique that been used for corrupted video repair. The advantages for this technique are it repair the
corrupted video file by taking advantage in video code. The method makes a video file converted into
video frames where every frame that been an important part of the video [16]. It is applied to MP4 and
H.264 video coding structure. Besides that, it also applied to dual common video coding standard, which
is been using as automobile black boxes and mobile devices. This technique does not have ability to
extract data by their own rather take help from additional tool [17]. For the additional tool, there have
their own limitation like the playable video frames and decoding header information.
For this research, experiments are carried out between LiteMP4repair, Restore Media and PhotoRec
because both are widely used open source for carving or repair. Secondly, both tools are also capable
of doing video repair. Table 2 shows a summary of file recover or repair reviewed in this study.
Table 2 :Comparison with Existing System
Frame-based
Feature PhotoRec Restore Media
recovery
MP4 Carving √ √ x
Corrupted MP4 Repair √ √ √
Substitution header technique x x x
131
Salim et al., Applied Information Technology and Computer Science Vol. 2 No. 2 (2021) p. 127-140
To reach the objective of the project, there needs a plan or guideline to follow such as the scope of the
project, the cost, and the time management for the time provided in an earlier stage.
3.1 System Requirement Analysis
In the analysis phase, the important thing that needs to be take note is the user requirement and the
existing system. This user requirement and existing system were analyzed and made the comparison.
The outcome for the analysis phase is literature review. In order to develop a working application, the
requirements are user requirements, functional requirements, non-functional requirements and system
requirement which are shown in Table 3, Table 4, Table 5 and Table 6.
Table 3: User requirements
No User requirement
1 User should be able to upload file to the software tool
2 User should be able view the uploaded file from the software
3 User should be able to choose the file in database that be save
4 User should be able to start repair the uploaded file
5 User should be able to view the file has been repair
6 User should be able to download file from the software tool
No Data Functionality
1 User Registration The system should be able to register for a new account in the
application
2 User Login The system should allow user to log into the application
3 Insert Corrupted MP4 File The system should be able to let user to upload MP4 file
4 Repair Corrupted MP4 File The system should be able to repair the selected video
5 View Playable MP4 File The system should allow user view the file that has been repair
6 Save Playable MP4 File The system should allow user to save the MP4 file that been
repair
7 User Log Out The system should allow user to logout from the application
No Data Functionality
1 Usability The application tool should be easy to use
2 Operational • The application tool should be able to display repair file
• The application tool should be user-friendly
• The application tool available to Window 10
3 Performance The interaction between user and application should not
exceed 5 minutes
No Data Requirement
1 Operation System Microsoft Windows 10
2 Hardware • Processor: Intel® Core™ i5-6200U CPU @2.30GHz
• Memory (RAM): 4.0GB
• Hard Disk (HDD): Minimum 2GB
3 Software • Xampp Control Panel v3.2
• Microsoft Visual Studio 2019
132
Salim et al., Applied Information Technology and Computer Science Vol. 2 No. 2 (2021) p. 127-140
The end user can log into the system with his/she username and password after creating their
account in the proposed application. After successfully logging in, the user can insert the corrupted
MP4 file, and repair corrupted MP4 file. Moreover, the user can view the MP4 file and safe the playable
MP4 file to the laptop. For the last use case user has logout from the LiteMP4Repair tool.
The sequence diagram display interaction between object arrangement in time sequences. The
dynamics behaviour between the user and the application object is been described. It also visualized the
data flow of the action is carried out through functionalities of the application. Figure 6 shows the
sequence diagram of user registration and user login.
133
Salim et al., Applied Information Technology and Computer Science Vol. 2 No. 2 (2021) p. 127-140
As shown in Figure 6, in order to register an account, the user needs to provide a unique username,
and password. Once verified, the information will be saved inside the database and the user will be
redirected to the main page. If the user already has an account, he/she need to login before log into the
application. The username and password provided by the user is checked if they match. After successful
login, the user will be redirected to the main page otherwise an error message will be shown.
In Figure 7, the sequence of chatting process is shown. The user can choose from his/her
computer to select corrupted MP4 file. After selected file, it will save in database. If the user wishes to
repair the corrupted file, he/she can select file in database. After file finish repair, user can save the file
back to he/she computer.
3.3 System Design
After all the user’s requirements were successfully analyze, the project will proceed in design phase.
In this phase, both interface and database had been designed in order to help visualize the system before
134
Salim et al., Applied Information Technology and Computer Science Vol. 2 No. 2 (2021) p. 127-140
proceed with the coding the system. For the design of the application, flowchart is used as a tool to
describe the flow of the LiteMP4Repair application. The end user will carry the step of process by
follow the flowchart. The flowchart of the proposed application is shown in Figure 8.
The process starts with a login module where the user is required to provide the correct username
and password associated to his/her account. After a successful login, the user will be able to perform
the functions provided in the application. The user can choose whether to add corrupted MP4 file and
repair the corrupted file. Other than that, the user can also view and save the file that have been repair.
Lastly, the user can also choose to be logged out of the application.
4. Results and Discussion
This section the implement and testing that was conducted for LiteMP4Repair tool.
4.1 Implementation
Implementation process starts from the interface design and database. The two aspects of the
application are very important in ensuring the tools runs smoothly. The coding for the application was
done using C sharp programming language and the IDE is Microsoft Visual Studio 2019. On the other
hand, phpMyAdmin was used as the database for the application. The app is connected to phpMyAdmin
Database with adding dependencies and implementation to Microsoft Visual Studio 2019.
To start using the application, a user needs to create an account by registering to login to the
application. After entering registration detail, username and password must be provided to login the
tool. A message will display if the username or password invalid, and the field is empty. The user then
can proceed to add new corrupted MP4 file.
Basically, there are 10 type of header that has been use and for each header has different
characteristic. Table 7 will show each characteristic for 10 header that been choose.
135
Salim et al., Applied Information Technology and Computer Science Vol. 2 No. 2 (2021) p. 127-140
4.2 Testing
Once the application has been developed, a testing phase is commenced to examine the functionality
of the application. Testing was conducted to identify any sorts of error that comes arise when using the
LiteMP4Repair tool. Another purpose of testing is to find out whether the application able to achieve
their objective and scope specified. Table 8 shows the summary of the functional testing results.
Table 8: Test Case Result for Register Form
136
Salim et al., Applied Information Technology and Computer Science Vol. 2 No. 2 (2021) p. 127-140
For the result of testing the playable or repairing corrupted MP4 file, there 10 corrupted MP4 from
same resource and size file has been test. However, 10 corrupted MP4 file that been test have different
timeline or duration. This test to see whether selected 10 header can repair corrupted header which from
different source, size file and timeline based on table 7.
137
Salim et al., Applied Information Technology and Computer Science Vol. 2 No. 2 (2021) p. 127-140
Table 14 shows the result of testing, which is most of the corrupted MP4 file can be repair using
header 2, 6 and 9. Source of header 2 and header 6 is YouTube and header 9 source from Facebook.
Figure 9 shows the success percentage of repairing corrupted MP4 file. There are 12% are successfully
repair, 11% are intermeddle which mean the corrupted MP4 file can display but it has no sound, and
77% are fail.
Based on the test results, comparisons were made to headers 2, 6 and 9. Overall, the header
structure of all three is the same, but it has slightly difference in movie box (moov) size. As in literature
review, there 2 boxes in MP4 file structure which is file type (ftyp) box and movie (moov) box. Table
15 shows the comparison on header 2, 6, and 9 which is the four bytes in yellow represent the size of
the box.
Table 15: Comparison on header 2, 6, and 9
No Header ASCII(HEX)
1 Header 2 ….ftypmp42….isommp42..%Bmoov
2 Header 6 … ftypmp42….isommp42….moov
3 Header 9 … ftypmp42….isommp42…Wmoov
138
Salim et al., Applied Information Technology and Computer Science Vol. 2 No. 2 (2021) p. 127-140
5. Conclusion
Three objectives of this LiteMP4Repair tool have been set as the indicators of the application
development as follows:
• To propose simple corrupted MP4 repair tool using multiple header substitution.
• To develop LiteMP4Repair tool.
• To test the functionality of the application.
All the three objectives of LiteMP4Repair tool are achieved. The developed application is to
try to applied MP4 file repair using multiple random header substitution technique. This method is to
see whether the corrupted MP4 header can be repair by substitute header with random header.
There are several limitations that can be found on the application. Firstly, this application can
only support Microsoft window 7 above as a platform. The size of corrupted MP4 file that can be repair
using this application is 30MB. The interface is less attractive. Lastly, the percentage of success repair
the MP4 file are lower.
There are some improvements that can be implemented to enhance the limitation stated. This
application is suggested to be able to support other operating systems such as iOS and Android platform.
Besides that, user can repair MP4 file that have file size more than 30MB and design an interface that
will attract more user. Other than that, make the percentage of success repair the MP4 file are higher
should also be considered.
Acknowledgement
The authors would like to thank the Faculty of Computer Science and Information Technology,
Universiti Tun Hussein Onn Malaysia for its support and encouragement throughout the process of
conducting this study.
References
[1] “Use of internet, social media, digital devices plateaus in US | Pew Research Center.” Accessed:
Nov. 30, 2019.[Online] Avalible: https://www.pewresearch.org/fact-tank/2018/09/28/internet-
social-media-use-and-device-ownership-in-u-s-have-plateaued-after-years-of-growth/
[2] B. Yoo, J. Park, S. Lim, J. Bang, and S. Lee, “A study on multimedia file carving method,”
Multimed. Tools Appl., vol. 61, no. 1, pp. 243–261, Nov. 2012, doi: 10.1007/s11042-010-0704-
y.
[3] M. Iuliani, D. Shullani, M. Fontani, S. Meucci, and A. Piva, “A Video Forensic Framework for
the Unsupervised Analysis of MP4-Like File Container,” IEEE Trans. Inf. Forensics Secur., vol.
14, no. 3, pp. 635–645, Mar. 2019, doi: 10.1109/TIFS.2018.2859760.
[4] A. Pal and N. Memon, “The evolution of file carving,” IEEE Signal Process. Mag., vol. 26, no.
2, pp. 59–71, Mar. 2009, doi: 10.1109/MSP.2008.931081.
[5] “What is MPEG-4? — Definition by Techslang.” Accessed: Jul. 04, 2021.[Online] Available:
https://www.techslang.com/definition/what-is-mpeg-4/
[6] M. Nadeem Ashraf, “Forensic Multimedia File Carving,” 2013, Accessed: Nov. 30, 2019.
[Online]. Available: http://www.diva-
portal.org/smash/record.jsf?pid=diva2%3A613183&dswid=-605.
[7] I. E. G. Richardson, H.264 and MPEG-4 video compression : video coding for next-generation
multimedia. Wiley, 2003.
139
Salim et al., Applied Information Technology and Computer Science Vol. 2 No. 2 (2021) p. 127-140
[8] D. Shin, J. Kim, and D. Shin, “A Study on the Digital Right Management of MPEG-4 Streams
for Digital Video Library,” Springer, Berlin, Heidelberg, 2003, pp. 444–455.
[9] J. Randolph Hall Bfa, “MPEG-4 VIDEO AUTHENTICATION USING FILE STRUCTURE
AND METADATA,” 2015.
[10] “MPEG-4 files.” , Accessed: Dec. 04, 2019. [Online]. Available:
http://atomicparsley.sourceforge.net/mpeg-4files.html
[11] K. Mansell, A. Caithness, and K. MANSELL, “RECOVERING VIDEO FROM MEMORY
DUMPS OF MOBILE PHONE HANDSETS,” Citeseer, Accessed: Nov. 30, 2019. [Online].
Available:
http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.190.695&rep=rep1&type=pdf.
[12] R. K. Pahade, B. Singh, and U. Singh, “A Survey on Multimedia File Carving,” Int. J. Comput.
Sci. Eng. Surv., 2015, doi: 10.5121/ijcses.2015.6603.
[13] “PhotoRec - Download.” Accessed: Jun. 06, 2021.[Online] Avalible:
https://photorec.en.softonic.com/
[14] W. Qiu, R. Zhu, J. Guo, X. Tang, B. Liu, and Z. Huang, “A New Approach to Multimedia Files
Carving,” in 2014 IEEE International Conference on Bioinformatics and Bioengineering, Nov.
2014, pp. 105–110, doi: 10.1109/BIBE.2014.31.
[15] “Repair Video Online – Fix Corrupted MP4, MOV, M4A, MXF Files.” Accessed: Jun. 06,
2021.[Online] Avalible:https://restore.media/
[16] X. Zha and S. Sahni, “Fast in-Place File Carving for Digital Forensics,” Springer, Berlin,
Heidelberg, 2011, pp. 141–158.
[17] U. Siddiqui, P. R. Thorat, and A. B. Diggikar, “IJARCCE An Overview of Frame based
Recovery of Corrupted Video files for Forensic Purpose,” Int. J. Adv. Res. Comput. Commun.
Eng., vol. 4, 2015, doi: 10.17148/IJARCCE.2015.41215.
[18] P. Daras, I. Kompatsiaris, T. Raptis, and M. G. Strintzis, “An MPEG-4 tool for composing 3D
scenes,” IEEE Multimed., vol. 11, no. 2, pp. 58–71, Apr. 2004, doi:
10.1109/MMUL.2004.1289042.
[19] “UML Class Diagram Tutorial.” Accessed: Jun. 06, 2021.[Online] Avalible:
https://www.visual-paradigm.com/guide/uml-unified-modeling-language/uml-class-diagram-
tutorial/
140