Free DME & DFIR Resources

There is more Digital & Multimedia Evidence (DME) than any other type of evidence today.
Working together we've expedited tens of thousands of criminal investigations.  Learn more

MPC-HC

  • That's a tall order, right?  VLC from VideoLAN.org has become the go-to media player for most, as it can play so many things that Windows Media Player won't, and it's free.  Well, how does it do that, play more than other players?  The Libavformat and Libavcodec libraries, the same ones created by and for the FFmpeg project (and so many other multimedia applications)

    VLC & DirectShow Filters

    DirectShow is one of Microsoft's multimedia frameworks, formerly known as ActiveMovie, which replaced Microsoft's earlier Video for Windows framework.  VLC supports DirectShow-based input sources through a module (not very well, IMO, though), but the default Windows version downloaded from VideoLAN cannot reference 32-bit DirectShow filters installed on your Windows PC for audio/video decoding (i.e. filters/codecs registered in your Windows Registry), as the default version downloaded is x64.

    As an example, a DCCTV video file exported from a GeoVision system to an AVI file may be using the proprietary GMP4 video codec. In order to play the video, you must install the GeoVision GMP4 codec necessary to decode the primary video stream; this is a DirectShow filter.  DirectShow filters can only be referenced by applications that can leverage DirectShow, which we've established, VLC x64 cannot. 

  • This really should come as no surprise to folks in our industry, as Apple's support of QuickTime on Windows has waned over many years. It's also important to understand that I.T. is going to take a global approach to the new vulnerabilities, and will likely force removal of QuickTime from all hosts they control/manage. Your job, should you choose to accept it, is to explain to them why you are an exception, and to learn more about the available options and solutions to address your environment and needs. There are options.

  • You can just press play if you want to, but if you're forensically processing evidence, I wouldn't advise it. Know the playback software, as it is just as important to proper playback and interpretation as the hardware. Take Windows Media Player, for instance.

    In the following video I discuss a few quirks about Windows Media Player v12, a shortcoming of the popular metadata tool MediaInfo, and more.

Smart Search

DME Resources Newsletter

Sign-up for the DME Resources"I may occasionally send an email" newsletter. Maybe quarterly? Semi-annually?

Well, what I can tell you is that your information will not be shared. See my Privacy Policy.

NOTE: Members of my site are NOT auto-subscribed or un-subscribed from this newsletter; they must manually Opt-In/Out.

Subscribe Today!

Who Doesn't Love Cookies?
DME Resources may place one or more Cookies on your computer. Cookies do not contain any personally identifying information, they allow me to customize my site based on your preferences. If you Decline cookies from my site, you may not be able to use all of the site's features.