Legal Tech: How to Overcome Hurdles in Digital Evidence
Media Viewers, Digital Evidence and the dreaded T263 Codec Error
Though this post might be best for lawyers, it should also give potential clients some idea as to why it is that you may want seriously tech savvy lawyer to represent you in your case. Be forewarned, however, If your eyes glaze over the moment someone starts to talk about the nuts and bolts of technology you may want to skip this post entirely.
A problem that is coming up with increasing regularity for all kinds of lawyers; DWI / DUI lawyers, criminal defense attorneys, domestic lawyers, and personal injury lawyers; is how to view video evidence provided in a seemingly corrupt digital .avi format. The latest trend seems to be for police departments and store surveillance divisions to send discs that contain what seemed to be simple .avi video files. My customary advice for people attempting to review video files is to simply open them up with VLC, a free and extremely robust and flexible video rendering program. However, when lawyers attempt to open this file that for all intents and purposes appears to be a standard format video file they receive this error:
This T263 “no suitable decoder module” codec issue is the error that people lucky enough to use VLC receive. For their efforts, those few remaining diehard Windows Media fans are blasted with static.
It would be easy enough for law enforcement agencies or store security departments to include the appropriate video player along with the video file but that is far from common practice. This is particularly frustrating given the fact that we all know that the police have to have the appropriate software to play these files so it is not as if could not foresee the issue. Given the current budget crisis and the fact that most criminal cases are appointed, one might hope that justice and efficiency would be the overriding goal for all concerned. One would apparently be wrong.
Not only do police typically not include a copy of a player that would effectively render the video, they also typically omit any reference to what player would be required to view the video thus requiring the attorney to either hire a forensic examiner or have substantial technological skills themselves.
In the past two weeks alone, I have received two such files. One file purported to have the eyewitness account of the alleged victim in a serious aggravated assault case. We wanted to review this video and we wanted to review it fast. Having been both blessed and cursed with an ample sized pocket protector, within a few minutes I found a workaround that is effective for a substantial proportion of videos that are otherwise unplayable in conventional media players, including the video we sorely needed to view quickly.
This fix is specific to those files that when played using VLC, result in the above referenced error. In fact that error only occurs when attempting to play a file created using March Networks’ Evidence Reviewer. If all you ever want to do is play that file at normal speed without the ability to enhance it in any way then you can download and evidence reviewer off of their website. However, if you wish to isolate portions of the video, enhance the video or enhance the audio, then you are going to need to either have them approve you for your own account or you can follow these basic instructions.
1. Download a free hex editor. You don’t need to know what that means, just do it. I like HxD which you can download here.
2. the video file that you need to view onto your own hard drive;
3. Open the video file using HxD (literally, go to File and select Open). Once opened, the file will look like this (I added the call-out boxes myself):
4. Change the “T” in “T263” to an “H” as in “H263”. It should end up looking like this:
5. Save the file with a new name on your hard drive.
6. Play your new file in VLC. If you get an indexing error, just tell it to play the file “as is.”
7. There is no step 7. You are done.
It seems crazy but that’s all there is to it. The evidence review software company appears to have “changed” a codec by renaming it and dubbing it proprietary. As a result, standard media players can’t play their files. It seems pretty sketchy to me but it’s hard to get too upset when it only set us back a few minutes. I am also amused by and particularly appreciate the fact that VLC’s own error message says that “[u]nfortunately, there is no way for you to fix this.” My guess is that they just didn’t try too hard.
This won’t impact the quality or admissibility of the evidence. Moreover, you can now use VLC’s handy export features to isolate audio and then use Audacity to reduce background noise and amplify muffled speech, etc. There’s a lot you should know about handling digital evidence. It is a new frontier. Check out my paper on digital evidence as well as the accompanying PowerPoint presentation about the new frontier of digital evidence for more tips. I hope this helps.
