手持式行動數位裝置之3GP/MP4多媒體視訊影片檔內容偽變偵測 …

16
73 手持式行動數位裝置之3GP/MP4多媒體視訊影片檔內容偽變偵測 的研究 鄧思源 法務部調查局資通安全處資安鑑識實驗室 調查官 [email protected] 摘要 目前常見的行動數位裝置大部分都具有攝影的功能,而所拍攝的影片格式大部分為 壓縮的3GPMP4的視訊格式,這些行動數位裝置也可能會記錄著與犯罪案件有關的視 訊檔影片資料,當這些視訊影片因案扣押成為重要物證時,數位鑑識人員如何快速鑑別 所鑑定行動數位裝置不論是內嵌或外接之儲存媒體裝置中所存放之3GP/MP4視訊檔有 無經過任何多媒體視訊編輯或轉檔軟體處理及修改?實為多媒體視訊影片內容鑑識作業 的一大挑戰。目前市面上有許多3GP/MP4視訊編輯或視訊轉檔軟體可對手持式行動數位 裝置所拍攝的MP43GP的多媒體視訊影片來直接進行增、刪、連結及格式轉換等後製 處理,對於這些經過加工處理之3GP/MP4檔案,數位鑑識人員該如何鑑別?本研究嘗試 提出如何在多媒體數位鑑識實務作業中,以MP43GP視訊影片檔案中所內嵌特定之 atoms元資料欄位內容來進行鑑別,以鑑定多媒體視訊影片是否已遭軟體竄改及編修, 並嘗試個化出可用於偽變造視訊影片內容之3GP/MP4視訊編輯軟體的特徵項或軟體工 具痕,並歸納出可列為反電腦鑑識(Anti-Computer Forensics)工具之軟體。由實驗結果得 知,本研究用於實驗的某些3GP/MP4視訊影片編輯及轉換軟體可鑑別出不同之特徵項或 軟體工具痕,可滿足數位鑑識人員在鑑驗手持式裝置3GP/MP4多媒體視訊影片內容偽變 偵測之鑑識需求。 關鍵字: 數位證據、反鑑識、反鑑識偵測技術、數位鑑識、多媒體檔案鑑識。 一、前言 根據國際電信聯盟統計全球手機用戶在 2010 年底已突破 53 億,另 DIGITIMES Reasearch網站有關2010年全球手機市場規模調查資料顯示, 2010年全球手機規模共約為 14.54億支,而2011年手機市場規模預測將可達15.54億支,以上種種資訊顯示,目前常 見之手持式行動數位裝置,每年都以驚人的數量不斷增長,而這些行動數位裝置大部分 都具有攝錄視訊影片之功能,目前各廠牌所生產之手持式行動數位裝置,用來存放之多 媒體視訊影片檔格式,約有95%皆預設副檔名為MP43GP之多媒體視訊檔案格式,而 透過Google搜尋引擎的搜尋功能,我們也可以在網際網路上發現許多免費或是商用可編 輯或轉換3GP/MP4多媒體視訊影片檔之工具軟體,這些軟體設計主要目的為提供使用者 可直接對以行動數位裝置所拍攝的3GP/MP4多媒體視訊影片檔進行視訊內容的剪接、編 輯與轉檔作業,編輯作業包括可將不同格式的視訊內容加以合併與剪接、加入文字、音 訊及特效等等,而轉檔作業則提供將不同之多媒體視訊影片檔或影像檔等不同之檔案格 式轉換為可支援它種作業系統環境下可播放之多媒體視訊影片檔案格式,或者可產生在 不同廠牌或型號的手持式行動數位裝置上可播放之各類解析度多媒體視訊影片檔格 式。這些多媒體視訊影片檔編輯或轉檔工具軟體,大部分皆都是在微軟視窗作業系統下

Transcript of 手持式行動數位裝置之3GP/MP4多媒體視訊影片檔內容偽變偵測 …

<4D6963726F736F667420576F7264202D20313035A4E2ABF9A6A1A6E6B0CABCC6A6ECB8CBB86DA4A73347504D5034A668B443C5E9B5F8B054BC76A4F9C0C9A4BAAE65B0B0C5DCB0BBB4FAAABAACE3A8732E646F63>
LinuxMAC
?

DCT
Quantizer Information(DQUANT)-1-212 [131]H.263
: H.263
YUVRGB
: 2.2 H.264
Journal of Information, Technology and Society 76
(NALNetwork Abstraction Layer)VCL
NALH.264
: H.264 2.3 MPEG-4(ISO/IEC 14496)
MPEG-4MPEG-1MPEG-2
VO
(VOPVideo Object Plane)(AVOAudio/Video Objects) MPEG-4MPEG-45 (VSVisual Object Sequence)(VO)
(VOLVideo Object Layer)(GOVGroup Of Video Object Planes)
(VOP)
MP4MPEG-4
MPEG-4 Part 14 ISO/IEC14496-12:2004(MPEG-4 Part 12: ISO base media file format)Apple
QuickTime MPEG-4 Part 14 (MP4)MOV
MP4
77 3GP/MP4
.MP43(1)MPEG-4
.MP4(2)MPEG-4
.M4VMP4 (3)3GPMPEG-4 Part 12
MP4.3GP.3G2MPEG-4(
H.263AMR) MP4
MP4(Meta Data)(Media Data)
//
SampleVOPMP4Sample
DurationTrackSample
3GP(3GPP)(The Third GenerationPartnership Project (3GPP))3G UMTS
3G2G3G2(3GPP2)3GGP2 3G CDMA2000
3GP3GP3GP
Part 10(AVC/H.264)3GPPISO
AMRH.2633GPPISO
atomMP4/3GP
atomatomatom
ASCIIatom
MPEG-4JPEG-2000Major_Brand
Minor_Version Compatible_Brands MPEG-4
Major_BrandMP423GPMajor_Brand
3GP4isomMdat atom(Movie sample data )
atomMoov atom (Movie sample data)Movie Header(atommvhd)track atom(atom
trak)Movie HeaderMovie data/
/Movie dataTime Scale Movie data
(1) Track atomsingle tracktrack
trackmoov atom
track atomHeaderMedia data
TrackMeata dataTrack atomatom
tkhd atom (Track Header atoms)mdia atom (Media atoms)tkhd atom
(1)track header
(UTC)(UTC)Track ID(
)()media atom
media atom(‘mdia’)Media header atom(‘mdhd’)mdhd atom’hdlr’atom (a handler reference atom)’minf’atom (media information atom)’udta’ atom(user data atom)
Media header atomsmedia atom
Handler reference atom
Media information atom
atoms(Video media information atoms)atom
atomatomtrack atom
TrackSampleMP4
”hdlr”Media dataMedia data type
(3)Data reference atomatom”dref”TrackMedia data
Media dataMP4
SampleSample
description atomatom”stsd”Sample Description Table
tableMedia dataMedia trackMPEG-4 ESDs(Elementary Stream Descriptions)Hint track
(2)Time-to-sample atomatom”stts”Sample
DurationatomSample(3)Sync sample atomatom”stss”atomMedia datakey Picturekey Picture /
(4)Sample-to-chunk atomatom
”stsc”ChunkSample
atom”stsz”Samplesize32-bit
MP4Chunkoffsetbytes32-bit64-bit
Journal of Information, Technology and Society 80
atom decConfigDescr
decSpecificInfoinfoMPEG-4
MPEG-4ESD(Elementary Descriptor) 3.2 MP4/3GP ATOM
Nokia E5102112007.MP4MPEG-4atom
0284-7ftyp atom 8-11majorBrand
MP4212-15minorVersion016-27
compatibleBrandsMP423GP4isom28-31mdat atom(media data container)1084783
:WinHexMP4atom 108482129C1(1068110)moov
atom(container for all the meta-data) 108481910
10955081010848306Cmvhd atom(movie header)
1084839-1084842(creationTime)327684393210Fri Nov 02 18:25:32 2007 UTC1084843-1084846(modificationTime)327684393210Fri Nov 02 18:25:32 2007 UTC1084847-1084850timescale2710
(1000010)1084851-1084854duration02FB05(19533310) 10849370AF1(279310)trak atom(container
for an individual track or stream )1084946005C(8410)tkhd atom(track header)1084955 -1084958(creationTime)
327684393210 Fri Nov 02 18:25:32 2007 UTC1084959 -1084962
81 3GP/MP4
(modificationTime)327684393210Fri Nov 02 18:25:32 2007 UTC1084971 -1084974duration02FB05(19533310)1085025-1085028
0140(32010)1085029-108503200F0(24010) 1085037 0A8D (269310) mdia
atom(container for media information in a trak)108504620
mdhd atom(media header)1085055-1085058(creationTime) 327684393210Fri Nov 02 18:25:32 2007 UTC1085059-1085062
(modificationTime)327684393210 Fri Nov 02 18:25:32 2007 UTC
1085063-1085066timescale7530(3000010)1085067-1085070
duration0008F110(58600010) 1085078 21 hdlr atom(handler type)
1085063-1085066handlerTypevide1085110
108511914vmhd atom(video media header)1085139
24dinf atom(data information box)10851471C
dref atom(data reference atom) 10851740A44(255610)stbl atom(sample
table atom)1085183A8stsd atom(sample descriptions) 108519998MP4v atom(visual sample description )
1085228-10852290140(32010)1085230-1085231
00F0(24010)108528542esds atom(elementary stream description)
: WhinHexstts atom 10853151D(2910)decSpecificInfo descriptor
info 000001B002000001B50ECF0000010 0000001200086C5D4C285020F0A311085350
0300(76010)stts atom(time-to-sample)10853635E
(9410)entryCount
10861191Cstsc atom(sample-to-chunk)
1086128-10861311entryCount11086146
offset)1086163BA(18610)entryCount
: WinHexstss atom Motorola U9moto1.3GP3GP(H.263)atom
4.16
: 3GP 32‘0x14’”20”ftype
atom 0 20 4-7 ftyp atom 8-11
majorBrand3GP412-15minorVersion016-27 compatibleBrands3GP428-31mdat atom(media data container) 133242
20898274A(1005010)moov
83 3GP/MP4
: 3GP moov atom
2090C0D19(334510)trak atom(container
for an individual track or stream )209155C(8410)tkhd atom(track header) 2091E-20921 (creationTime)
327849818010Wed Nov 21 21:56:20 2007 UTC20922-20925
(modificationTime)327849818010Wed Nov 21 21:56:20 2007 UTC20930 duration369B(1397910)20964-20967
0140(32010)20968-2096B00F0(24010) 209700CB5(324510)mdia atom(container
for media information in a trak)2097920mdhd atom(media header)20982-20985(creationTime)327849818010
Wed Nov 21 21:56:20 2007 UTC20986-20989(modificationTime)
327849818010Wed Nov 21 21:56:20 2007 UTC2098C-2098Dtimescale
03E8(100010)20990-20991duration369B(1397910) 2099930hdlr atom(handler type)209A6-209A9
handlerTypevide209B6-209C1handler name
Video stream209C80C5D(315710)
minf atom(media information container)209D114vmhd atom(video media header)209E524dinf atom(data information box)209ED1Cdref atom(data reference atom)
20A080C1D(309310)stbl atom(sample table atom)20A1275stsd atom(sample descriptions)
20A2165s263 atom(H263 sample description)
20A3E-20A3F00B0(17610)20A40-20A41
0090(14410)20A770Fd263 atom(decoder specific info H263 video)
Journal of Information, Technology and Society 84
: 3GP d263stts atom 20A7C-20A7Fvendormoto(183602084710)20A81
h263Level0A(1010)20A850598
(142410)stts atom(time-to-sample)20A92B1(17710) entryCount
: 3GP stssatom 2101E10(1610)stss atom(sync (key I-Picture) sample
map)21027-2102A00000000entryCount0
2102E1Cstsc atom(sample-to-chunk)2103A
01entryCount12104902F0(75210) stsz atom(sample sizes)2105AB7(18310)sampleCount
: 3GP/MP4/

3GP,3G 2,MP4,Mortola,Nokia,Sam sung,SonyEricsson

3GP/MP4
ATOM 33GP/MP4
4WinHex3GP/MP4
esds atomd263 atom atomstts atomstsz atomstco atomI-frame
esds atomd263 atomMD53GP/MP4
5453GP/MP4
4esds atomd263 atomMD5 76esds atomd263 atom MD54
JPEGUltraCompare Professional
Journal of Information, Technology and Society 86
93GP/MP4
MP4
atomMP4
5.1 3GP/MP4
16114PDA3GP/MP4640 3GP d263(decoder specific info H263 video) vendor atom
stts(decoding) time-to-sample entries atomstsz(sample size) entries atomstco(chunk offset partial data-offset information) atomstss(sync (key I-Picture) sample map) atomstsc sample-to-chunk partial data-offset information atomhdlr handler type atomatom I-PictureP-PictureI-PictureP-Picture
(MBMacro block)(quantizer)MP4
d263(decoder specific info H263 video) vendor atom12
3GP d263 atom
MP4esds atom 5.2
stts atom entry countstsz atom entry countstco atomentry count I-Picture12152050250
3GP/MP4Esds atom decspecificinfo3GP(h.263) d263 vendor atom 5.3
453GP/MP43GP/MP4
224Aimersoft Video Editor 114Agogo Video to ipod/cellphone/MP462
100%Tkhd atomcreated time
3GP/MP4
I-PICTURE(frame)I-picture quantizer
P-picture quantizer3GP/MP4
modified time YES YES YES
Stts atom entry count1 YES YES YES stsz stco atomentry count
YES YES YES
) YES(12)
Lavc51.25.0 Lavc51.57.0
3GP d263 vendor atom FFMP FFMP 5 5 5 [1] “”2009
2009 [2] James Luck and Mark Stokes“An Integrated Approach to Recovering Deleted Files from NAND
Flash Data” SMALL SCALE DIGITAL DEVICE FORENSICS VOL.2(1),2008. [3] Karel Rijkse “H.263:Video coding for low bit rate communication” Communication
Magazine,IEEEVOL.34(12),1996. [4] ISO/IEC”Information technology - Coding of audio-visual objects - Pt.12: ISO base media
format” Ref. No. ISO/IEC 14496-12:2005/Cor.1:2005(E),2005. [5] ISO/IEC “Information technology - Coding of audio-visual objects - Pt.14: MP4 file format”, Ref.
No. ISO/IEC 14496-14:2003(E),2003. [6] F. Pereira and T. Ebrahimi , “The MPEG-4 Book, Prentice Hall IMSC multimedia series”Prentice