VIDEO_TS sleuthing/forensics. How can I, and what could I learn?

What can you learn about the author/authoring of a DVD from the VIDEO_TS or .ISO files? 

The .BUP, .IFO and maybe the .VOBs or the .ISO, do they leave clues as to the software which created them, the operating system?  I tried opening them up in a text editor and it's mostly gobbledygook to me, what program might make sense of this data and display the relevant parts?

The idea behind this is I've got a copy of the ViSA workprint of RotS which is believed to be the source behind all the hoopla.  The files date "May 17, 2005 11:51 PM" so that leads creedance to them, now i'm trying to figure out what can be learned from them.  For instance the .ISO was made almost 24 hours after the VTS's were made.  Opening the .ISO in a text editor, the only thing recognizable is "Ulead Systems USA Inc." (**Edit** forum doesn't like these characters **Edit**)

It would certainly be interesting to unravel such a mystery.  Learning the actual source could be revealing for sure.

Good luck with your endeavor....I look forward to seeing how you progress.

:)

No so much a mystery, people in different places know the details.  I'm attempting to pull those pieces together to see the larger whole.

For instance, someone confessed to being the leak, and there are court docs which are collaborated by online postings that the leak was to an online forum. (trying to get an invite to said forum to read what went down internally)  Now what was actually given to that forum, i'm still unclear.  Was it a VHS rip or the .ISO?  maybe sleuthing this file might help.  Then the question once it got into this forum, did it get repackaged?  When did it get RAR'd?  Have found posts about the Elite Torrent version which mention it being RAR'd.  Also interesting that since the leak went through the UK why didn't anyone over there get any penalties?  Star Wars is beloved over there as well, and the UK/US governments are on friendly terms.  Also interesting that Elite Torrents were several stops down the line, yet they went down, and with that precedent why not more cases, every year there is a leak of every movie?  Another odd thing was the FBI takedowns were pushed back a month, since every movie was leaked makes sense to wait for the biggest of the year, but who makes that call?  There was a newly installed Assistant Attorney General, was it known he was more simpathetic to this cause?  horrible hobby, but getting back to the thread:

From the VIDEO_TS files is it possible to determine source?  The other oddity is it's resolution, about half typical DVD res.  Could that have been done to hide the VHS source or was this a common practice to save time?

info of the larger whole will be at:

http://noneinc.com/tBSWM/tBSWM_FAQ.html

or discussion here:

http://originaltrilogy.com/forum/topic.cfm/topic/7758/

Ok poking around for some hex editors on the mac side.  First one tried having problems scrolling.

But did realize something about the DVD.  There are 5 VOBs at a resolution of 352x240.  So why split up the movie into so many VOBs?  The answer is in the chapters, the first VOB has 94 chapters and the others 99.  and they are perfectly keyed into each change of camera.  So for those looking to do color revision work, pulling out the chapter timecodes from this thing will get you a step forward in that direction.  and that's more or less the nail in the coffin that the original leak was not from a VHS source.

Yeah you're right it's not the VOBs (file type, there's only two, now that I check) was looking at the Title/Chapters, and konphuz'd.  Never seen a single movie split between multiple Titles.

So two VOBs which contain 5 Titles each containing 99 chapters except for the first which has 94.

satanika wrote:

It sounds like VCD res to me, is it MPEG1 or MPEG2? Source could be VCD or 'VCD-on-DVD'.

Would the VCD-on-DVD format be something 2005 production houses might have used?  Seemed to be the preferred pirate method of the time, curious if this is a reprocessing of another file or if this was the 'source'.  Have not uncovered anything more using the hex search, the only thing recognizable is the "Ulead Systems".

Basic rundown of info:

Star.Wars.Episode.3.Revenge.of.the.Sith.WP.DVDR-ViSA ISO

UnRAR Folder : sw3.scr-visa

File : sith.iso

File Size : 1.54 GB

Date : May 18, 2005 10:29 PM

VIDEO_TS Date : May 17, 2005 11:51 PM

- VIDEO_TS.BUP : May 17, 2005 11:51 PM : 33kb

- VIDEO_TS.IFO : May 17, 2005 11:51 PM : 33kb

- VTS_01_0.BUP : May 17, 2005 11:51 PM : 164kb

- VTS_01_0.IFO : May 17, 2005 11:51 PM : 164kb

- VTS_01_1.VOB : May 17, 2005 11:50 PM : 1.02gb

- VTS_01_2.VOB : May 17, 2005 11:51 PM : 512.6mb

Format : MPEG2 Muxed - 352 x 240 - 29.97

Audio : 48000 hz - 224 kb/s

Title 01 - 94 Chapters : Title 02, 03, 04, 05 - 99 Chapters

Subtitles : No

Sample : sample.vob (50mb) - May 18, 2005 10:14 PM

NFO comment: "WEEEEEEE, ripper named the rars funny, isn't he a hoot.  nuke this if you want.  it's real.  check a rar or two could be a SCREENER, looks more like a finished Workprint, since there's 2 fuck off big timers :) "

Since these groups have members who accomplish tasks, might be proof, that there was an uploader, could be the same as the RAR person, then this .nfo creator, then the distributors.

Timecode Start : RT (underscored by an arrow) 00:59:49:03 LTCR:00:59:49:02

Timecode End : RT 03:20:44:18 LTCR:03:20:44:14

RT = RealTime???? & LTCR = Linear TimeCode Recording???? (guess)

Timecode 00:00:00:00 : at beginning of count down.

Here's a pic of the unique frames from the pre-movie opening:  (most of the other frames are black with timecode running)

SMPTE -> HEAD (reversed) -> COMMON NO SYNC (reversed) -> (arrow) -> COLOR BY JEDI MASTERING LAB -> HEAD -> (dot) -> PICTURE -> (black ring on red field) -> (black rectangle on red field) -> (yellow background) 1 - R " 2 NOTSSNUD "" -> SOUND START (vertical flip) -> REEL 1 (vertical flip) -> DUNSTON 2 (vertical flip) -> PICTURE START (white background) -> (diamond) -> (count down) 11, 10, 9 NINE, 8, 7, 6 SIX, 5, (diamond) POP or BOB???? -> 4 -> (arrow) -> CONTROL STRIP (7FRAMES) -> (arrow), 3