Analyzing Timestamp Anomalies in VOB Files

Digital forensic investigators uncover tampering in modified Video Object (VOB) files by identifying chronological inconsistencies between the host filesystem, container metadata, and elementary stream timing structures. Because VOB files are based on the MPEG-2 Program Stream format, they embed internal clock references that frequently desynchronize when an unauthorized edit, splice, or re-encoding occurs. By dissecting these internal layers—specifically examining Pack Headers, Packetized Elementary Stream (PES) headers, and DVD Information (IFO) tables—investigators can establish whether a video has been manipulated, truncated, or forged.

1. Comparing Filesystem and Internal Timestamps

Forensic analysis begins by establishing a baseline using external filesystem attributes (MACB timestamps: Modified, Accessed, Created, and Born). Investigators compare these values against internal container metadata. If the filesystem shows a creation date that predates or heavily contradicts the internal stream generation times, the file warrants deeper inspection. However, because external timestamps are easily spoofed using simple command-line utilities, investigators treat internal MPEG-2 stream markers as the definitive source of chronological integrity.

2. Inspecting System Clock References (SCR)

VOB files rely on a System Clock Reference (SCR) stored in the pack header (0x000001BA). The SCR synchronizes the playback system's internal clock with the multiplexed audio and video streams.

In an unaltered, continuous recording, the SCR increases monotonically and smoothly across packs. When investigators parse the raw stream, they look for:

• SCR Resets: Sudden drops to zero or lower values, indicating spliced footage from another source or an appended recording session.
• SCR Gaps: Unnatural jumps in the timeline that do not align with standard frame intervals, indicating deleted scenes or dropped frames.
• Jitter and Irregular Intervals: An inconsistent increase rate between packs, which commonly points to third-party consumer remuxing software that failed to maintain standard MPEG-2 multiplexing compliance.

3. Evaluating PTS and DTS Discrepancies

Within the Packetized Elementary Stream (PES) headers (0x000001E0 for video), MPEG-2 encodes two crucial timing mechanisms:

• Presentation Time Stamp (PTS): Tells the decoder when to display a specific frame.
• Decoding Time Stamp (DTS): Tells the decoder when to decompress a frame (used when B-frames introduce out-of-order decoding).

Investigators use forensic media analyzers to extract PTS and DTS values on a frame-by-frame basis. A legitimate recording presents a uniform progression of PTS values matching the defined frame rate (e.g., increments of 3003 ticks for 29.97 fps at a 90 kHz clock). Modified files often display:

• Non-sequential PTS jumps at edit points.
• Negative PTS differences (PTS moving backward without a standard stream reset marker).
• DTS values that exceed PTS values, which violates the MPEG-2 standard and indicates post-production manipulation.

4. Auditing Group of Pictures (GOP) Alignment

Video in a VOB container is organized into Groups of Pictures (GOP), typically initiated by an Intra-coded frame (I-frame) and preceded by a GOP header (0x000001B8). GOP headers contain a time code representing hours, minutes, seconds, and picture frames.

Investigators map these GOP time codes directly against the PES-level PTS. In a modified VOB file, editors often cut footage without re-encoding the entire stream (lossless cutting). This leaves an open GOP or an abrupt change in the expected GOP cadence (such as a standard 12-frame or 15-frame structure suddenly interrupted by a 4-frame GOP), along with a mismatched GOP time code that clashes with the surrounding PTS markers.

5. Cross-Referencing Associated IFO Files

When a VOB file originates from a standard DVD structure, it operates alongside an Information (IFO) file (e.g., VTS_01_0.IFO). The IFO file contains the Video Title Set Program Chain Table (VTS_PGC), which includes the exact playback duration, chapter transition times, and cell start/end sector addresses.

Investigators parse the IFO navigation tables and match them against the VOB:

• Cell Playback Timelines: If the VOB playback stream contains frames extending beyond the sector ranges or total time defined in the cell tables, hidden or appended data may be present.
• Time Maps (VTS_TMAPT): DVDs map playback intervals (usually every few seconds) to specific sectors. Discrepancies between the time map table and the actual SCR/PTS found at those sector addresses confirm stream replacement or surgical splicing.

6. Hexadecimal and Residue Carving

When metadata streams have been deliberately stripped or unified by sophisticated video editing suites, investigators analyze the boundaries between data packs using raw hex inspection. Unaltered VOB files strictly maintain 2048-byte sector alignment.

Spliced edits often leave fragmented packs, padding bytes (0x000001BF), or orphaned sequence headers containing historical metadata. If an investigator finds remnants of previous multiplexing parameters—such as an abandoned sequence display extension or varying aspect ratio flags inside the stream—it provides conclusive proof that the VOB file is an assembly of disparate sources rather than a pristine capture.