This script is designed to extract still images from video files that are tagged or that have been blue-checked in the current view.

In order to accomplish this, the script needs a copy of ffmpeg.exe, which can be downloaded from the following URL:

• https://ffmpeg.org/download.html#build-windows

By default, the script will write the images it extracts to a sub-folder of the current case’s export folder called ‘VideoSplit <script version>\Images’. This folder will be created automatically if it doesn’t already exist. If the folder does exist, the user will be warned to check for existing data before continuing. This warning will not be provided if a custom folder is specified.

If the user opts to process tagged files, there will most likely be a delay whilst the script checks that at least one file has been tagged. During this time, the script may appear to hang before switching to the next dialog tab.

By default, extracted images will be written to a sub-folder named using the source-entry’s item-GUID. Whilst the name of each entry can be used instead, GUIDs are less likely to be problematic.

When it comes to specifying how many images to extract, the user can either specify a number directly, or instruct the script to extract an image every x number of seconds. This is in turn linked to duration of the file being processed.

If a number is specified, the script will convert this to a time interval by dividing each video’s duration by the number of images specified. This may result in a larger number of images than that specified.

The number of ffmpeg threads option is equivalent to the ffmpeg -threads command-line parameter. It’s unlikely that this will be needed as by default the script won’t wait for one image-extraction process to finish before starting the next one.

In addition to writing the extracted images to the local file system, they can also be added to a logical evidence file (LEF), which can in turn be added to the current case automatically at the end of processing. If only the LEF is needed, the images can be deleted once the LEF has been created.

The contents of the LEF will mirror the path and folder structure of the data extracted to the user’s disk. The sub-folder created for each file will contain a readme.txt file containing the path of the original file plus additional information.

This script is maintained for use during EnCase training. For more details, please click the following link:

• OpenText EnCase Training

Use of this script and ffmpeg.exe is at your own risk. OpenText makes no representation or warranty, express or implied.