Hard Disk File System investigation for the Magnavox 537, 535, 533, 515, 513, 2160A, 2160, 2080 &... - Page 3

We need to figure out how the video is stored inside the AV001_0AV001_00.MPG file. I was thinking that there would be some links like this:

record in TI000_0TI000_00.IFO -> somewhere in TM001_0TM001_00.MAP -> somewhere in AV001_0AV001_00.MPG

So far I haven't be able to find any of the links. I don't think you will be able to get a good clip off the drive without finding where the segments live. As I found that the ratio between the MPG_SEG_MPG_SEGM.DAT file and AV001_0AV001_00.MPG file are changing with disk size. The segment lengths should get larger on the larger disk drives.

Pete, if you want to try looking through the directory entries in the TI000_0TI000_000_00.IFO files. That might help us figure out the links. I don't think we will get very far with the video file extraction until we can figure out this relationship. Some of it is definitely index array type thing. I know the TI000_0TI000_000_00.IFO looks like it is arranged that way anyway.

Example have array A. A[1] is first record, so if you see a A[200] you have to do:
Location of A[200] = (size of one record of A) * 200 + (A[1] location)
The indexing come in where you have a result from one array feed another array.
Ex. I is an index for A
A[I[5]]
It does appear that the TI000_0TI000_00.IFO is arranged this way for storing the titles and chapter headers. More about that later.


iBoard has a nice feature in it. If you highlight up to for bytes in the view mode down is the hex area. It will display the little-endian and big-endian numbers, up to four bytes at a time. This file format the Magnavox is using the little-endian.

iBoard, which runs on Windows, is what I've been using to see what is on the hard drive. It will copy blocks, write blocks as well as view and edit data right on the hard drive. It makes it easier to see what is on the drive. I would think there are other block hex editors for the Mac and Linux systems as well. I just haven't looked for any.

We are hoping to be able to figure out the file format used on the Magnavox units to be able to resize a file system for a drive upgrade. Also, other people would like to extract the video directly from hard disks.

Little busy right now so it might be a while before I get back to this investigation.

Copperblade, thanks for the tips. Maybe Sleuthkit will help. I hope to find some time to work on this. This is what I do know.

There is no partition table, sector 0 is all 0s.
The format is setup in a way to do one thing and that is to store and edit videos. Some of the files have copies, apparently for keeping a working copy and an edit copy.
Some of the data is linked by position. This big problem is still how to jump from the .MAP files to the video stored in the .MPG file. I think if we can figure that out we can easily get the mapping from the VBI_DATVBI_DATA.DAT to the .MAP file. I think the .MAP file is stored in to sector blocks with the first sector pointing into the .MPG file just based on it's position in the .MAP file. So the first two sector block points to the first block in the .MGP file and the second two sector block points to the second block in the .MPG file and so on. Just a theory right now, I have not confirmed this yet.

I have been doing some of my testing on a 40 Gig drive. The information at the beginning takes up about 1 Gig, only two files changes with the filesystem size and that is the MPG_SEGMPG_SEGM.DAT file and the AV001_0AV001_00.MPG file. I believe the MPG_SEGMPG_SEGM.DAT file is a used / free hash table for the AV001_0AV001_00.MPG file. I currently have an image that I was looking at with three short 1 minuet videos on it. I didn't try deleting the second file before recording the third though. Hopefully I can look at this some this summer.

I don't see why not. They do cost a lot more than a hard drive. But they are faster and lower power than even the notebook 2.5" drives. I put a 2.5" AV hard drive in my main 2160A.

On the video extraction front. I have been looking at a lightly use drive image and have been able to extract most of the video that was stored on it. I still can't figure out how to go from the directory listing found in TI000_0TI000_00.IFO to the video in the AV001_0AV001_00.MPG file. I know the information should be in the TM001_0TM001_00.MAP and the TC001_0TC001_00.CHP. But I can't seem to connect the dots. I did decode the time length part of the directory listing that you see while looking at the titles.

Maybe I can find sometime soon and post what I have so far and someone else could connect the dots.

I'll try compressing the entire 40 Gig hard drive. Since most of it is blank it is currently doing about 1000:1 ratio. I am guessing that it will be about 100 Meg. I put a link in a post to where it will be stored. A friend of mine has suggested a few places where I could place a big file to share.

The file will take over 4 hours to compress so I'll try to post earlier part of this week.

In my post through the thread I have what I have figured out so far. So you have that to start with.

I posted the first 1.2 Gig of the hard drive to 242Meg zip file. This is the first time I used We Transfer. It is a neat service I hope they can keep it running. Anyway, the file will be deleted on September 13. Let me know if you need it posted after that date.

Just to help out with the disk image I posted.

First, it still looks like the allocation units in the AV001_0AV001_00.MPG file is in 8 Megabyte increments, or 16384 sectors.

I have 7 saved titles on this image and I think they should all be in the section I posted. I have found 4 of them at the following sector numbers.

4.1 SLP start at sector number 2008029 and runs 16 Megabytes
5.1 EP start at sector number 2155485 and runs 24 Megabytes
5.2 LP start at sector number 2221021 and runs 24 Megabytes
11.1 SPP starts at sector number 2270173 and runs 24 Megabytes

I was able to save the MPGs out at those starting sector numbers and play them back on my computer. They are all about 1 minute videos, so not too long here.

I have the file mapping listed earlier but just in case, only the last two files vary with the disk size. This was on a 40 Gig drive so:

MPG_SEGMPG_SEGM.DAT starts at sector 2008025 and runs 4 sectors
AV001_0AV001_00.MPG starts at sector 2008029 and runs 76103680 sectors. The posted disk image has this file only partially there.

I believe the link from the title file TI000_0TI000_00.IFO, is in the TM001_0TM001_00.MAP file. I just can figure out the MAP file at all. Some with some knowledge of mpg file might be able to see what it is but I can't.

Nope, that title was not saved. It is just what the auto record buffer had put in the .MOV file. I did list sector number in a previous post for four of the saved titles.

We Transfer does use Adobe Flash Player. So you will need a browser with that loaded in it to have this work.

Ken.F got a copy downloaded.

The title listings are found at sector 61235 and run for three sectors. On post 55 I have the record as much as I have decoded listed there.

Here is the list:
JAN/31/11 5:31PM 4.1 SL
JAN/31/11 5:32PM 5.1 EP
JAN/31/11 5:33PM 5.2 LP
JAN/31/11 5:34PM 11.1 SPP
JAN/31/11 5:35PM 11.2 SP
JAN/31/11 5:36PM 45.1 HQ
JAN/31/11 5:37PM 45.2 SLP

As in a earlier post, I listed where the 4.1, 5.1, 5.2 and 11.1 records live in the MOV file. The others should be there as well but I didn't find them.

I have been blanking the hard drive will all 0s before starting so there wouldn't be any extra bits turn on that the DVR didn't do. The hard drive format they are using is their own and doesn't have a partition table or boot sector or any computer general file system on it. The drive is just for storing data.

I haven't pulled together the information into one spot but several of my post have information that I have decoded.

The header information at sector 4:
Post 6

The directory listing at sector 4 and 5:
Post 11

I have figured out what most of the file are for. Only two of them change with drive size and that is MPG_SEGMPG_SEGM.DAT and AV001_0AV001_00.MPG.

The titles are stored in TI000_0TI000_00.IFO. If you go in there you will see the titles. I have figured out some of these records but haven't gotten very far with it.

This is my first stab at the TI000_0TI000_00.IFO file data.
Post 55

I detail the two files that change size with the hard drive.
Post 60

I'll try to download the data you posted mrmazda and see what I find. I have most of the file uses figured out but not the bits in them.

I think the TM001_0TM001_00.MAP and TM002_0TM002_00.MAP have time indexes on them. Most of the data looks like this because it just increments going down a list. I haven't been able to figure out what the first 16 bytes means at all. I think that is where the secret is for mapping from the directory listing in the TI000_0TI000_00.IFO through the TM001_0TM001_00.MAP to the AV001_0AV001_00.MPG that stores the video.

I have extracted video from the AV001_0AV001_00.MPG
List of video found.

What is in the title listing.

I just save off the sectors I want and name it .mpg and then it plays just fine.

This file system used on the DVR is based on a 512 byte sector. I can see why the advanced sector format drive is a problem.

I attached my to files for the director listing and the MAP file.

The MPG files starts at sector 2008029.
4.1 SLP start at sector number 2008029 and runs 16 Megabytes
5.1 EP start at sector number 2155485 and runs 24 Megabytes
5.2 LP start at sector number 2221021 and runs 24 Megabytes
11.1 SPP starts at sector number 2270173 and runs 24 Megabytes

 

MultiTitles TI000_0TI000_00.IFO.zip 0.822265625k . file

 

MultiTitles_TM001_0TM001_00.MAP.zip 453.8154296875k . file