Free DME & DFIR Resources

Despite our efforts to educate everyone in the digital evidence chain on the proper way to label and care for CDs, DVDs, and BDs (see CD and DVD Care and Handling: Stop Destroying Your Evidence!), read errors still happen...a lot. Here are two of my favorite tools for repairing and recovering data from disc-based media.

That's a tall order, right?  VLC from VideoLAN.org has become the go-to media player for most, as it can play so many things that Windows Media Player won't, and it's free.  Well, how does it do that, play more than other players?  The Libavformat and Libavcodec libraries, the same ones created by and for the FFmpeg project (and so many other multimedia applications). 

VLC & DirectShow Filters

DirectShow is one of Microsoft's multimedia frameworks, formerly known as ActiveMovie, which replaced Microsoft's earlier Video for Windows framework.  VLC supports DirectShow-based input sources through a module (not very well, IMO, though), but the default Windows version downloaded from VideoLAN cannot reference 32-bit DirectShow filters installed on your Windows PC for audio/video decoding (i.e. filters/codecs registered in your Windows Registry), as the default version downloaded is x64.

As an example, a DCCTV video file exported from a GeoVision system to an AVI file may be using the proprietary GMP4 video codec. In order to play the video, you must install the GeoVision GMP4 codec necessary to decode the primary video stream; this is a DirectShow filter.  DirectShow filters can only be referenced by applications that can leverage DirectShow, which we've established, VLC x64 cannot.