Monday, June 11, 2012

MP4 recovery from a truncated file

I recently received a 20 minute MP4 file were recovery of both video and sound was required.  However, the file had not been finalised so there was no meta data.  The file contained a header, 'ftyp' and the 'mdat' segement, but no 'moov' data.

Interestingly, Windows media player would view the file - but video only.  Quick time and VLC would not touch it.

To process the file I recquested, and received a small MP4 file.  From this all the meta data in the moov atom could be read.  It was then a case of reconstructing the atoms that describe the file.  The most important ones are 'stsz', 'stss' and 'stco'.  Each codec has different coding systems, but on this video, each video chunck started with the string 0x00 0x00 0x01 0xb3.  Each audio chunck was a fixed length, and preceeded the video chunk.  The difficult one to find was the video frame, which started with 0x00 0x00 0x01 0x00  - although easy to find, the possiblity of false positives required careful attention.

After a fair bit work and investigation it was possible to get a viewable video with sound, but approx halfway through the video became distorted.  The problem turned out to be the 'stss' atom (sync sample atom).  All chunks seemed to have a fixed number of frames, so the 'stss' array was straight incrementing numbers.  However, at about the 2GB mark of the file one chunk had extra frames.  This was reflected in both the 'stss' and 'stsz' atoms, but the video did not display correctly.  After a lot of head scratching a workable solution was found by ignoring the extra frames.

Curiously, the sample MP4 would not play with QuickTime, or produce sound with Windows Media Player.  It is possible that the originally created file was valid, but VLC does not like variable length 'stss' atom elements.

Overall, a very satisfactory solution as file was reconstructed with a totally missing moov section.

No comments:

Post a Comment