[Case Study] DVR Forensics: An Introduction to H.264 Compression and Digital Video Recorders (DVRs)

Editor’s note: Video surveillance system is an important part of digital forensics. In this article, SalvationDATA forensic expert will introduce the video surveillance technologies and the well-known H.264 compression format. The discussion covers the basic concept of how digital recorders utilize the H.264 video compression standard to compress signals, allowing increased storage of data and higher-quality transmission over networks, even those with lower bit rates.

Types of DVRs

The security market has evolved into multiple segments for DVR systems. Embedded, hybrid, and PC-based DVRs all require the essential elements of video and audio capture: analog-to-digital conversion, compression, playback, and network streaming. The embedded DVR is a stand-alone piece of equipment that accepts analog CCTV camera inputs for compression and storage on a local HDD. Hybrid DVRs accept analog CCTV and IP camera inputs as video sources. PC-based DVRs are integrated into surveillance stations with hardware compression add-in cards or software compression running on the PC. The distinguishing features among different models are the number of video input channels; compression standards supported; video quality of the record, stream, and display modes; storage capacity; and how many functions the system can perform simultaneously.

What is H.264?

Because the raw video data is extremely large in size and inefficient to transmit or process, surveillance systems always use video compression technologies to process the video data from the surveillance cameras. H.264 is the new industry standard for video compression in security DVRs. Prior generations used MPEG-4 and even MJPEG for video recording. H.264 has the advantage of offering the highest compression ratio while maintaining excellent video quality for security applications. H.264’s higher compression ratio (up to twice better than prior-generation technology) effectively increases storage capacity by 100%, producing smaller file sizes and, therefore, longer recording time on a fixed-capacity storage device. In addition, the use of H.264 allows high-quality images to be transmitted over networks at very low bit rates. Security systems that involve multiple cameras can quickly exceed the available network bandwidth without efficient compression. DVR system designs without H.264 often rely on reduced-frame-rate or lower resolution recording techniques that degrade picture quality in order to increase recording time and reduce video bit rates.

How does H.264 compression work?

In a DVR surveillance system, frames of video are captured from the camera and sent to the internal H.264 encoder to be compressed. Each frame of video is then compressed in one of two ways: as an I-frame or as a P-frame.

An I-frame is a video frame that has been encoded without reference to any other frame of video. A video stream or recording will always start with an I-frame and will typically contain regular I-frames throughout the stream. These regular I-frames also called intra- frames, keyframes or access points, are crucial for random access of recorded H.264 files, such as with rewind and seek operations during playback. The disadvantage of I-frames is that they tend to be much larger than P-frames.

P-frames are motion-compensated frames: that is to say, the encoder makes use of the difference between the current frame being processed and a previous frame of video, ensuring that information that does not change, e.g. a static background, is not repeatedly transmitted. To put it simply, a P-frame tells the codec what changed from the previous I-frame, and since it is not a full frame of video, it takes much less space to store.

Conclusion

H.264 offers significant benefits to the user and system designer. Most of today’s CCTV surveillance DVRs or NVRs code their video data based on the implementation of the H.264 standard. Embedded DVR/NVR systems also use self-developed proprietary file systems to store and manage the video data, which causes major difficulties for forensic investigators because such file systems are not readable in PC operating systems. However, with our SalvationDATA’s patented technology, we offer a perfect solution for DVR forensics. Visit our website to learn more about our DVR forensic product Video Investigation Portable (VIP). You can also go to our resource page to download our forensic products for free. We welcome you to contact us and claim your free product trial!