Investigating VLC Media Player
20/04/2021 Tuesday
VLC Media Player (VideoLAN Client) has been developed by the VideoLAN community as a free and open source, lightweight, cross-platform media player app, and streaming media server. VLC is available for Linux, iOS, iPadOS, Tizen, Windows 10 Mobile, Windows Phone desktop operating systems, and mobile platforms. VLC accepts many types of audio and video compression, including DVD-Video, video CD and streaming protocols, and file formats. It can stream media and transcode video files over computer networks.
Digital Forensics Value of VLC Media Player Artifacts
VLC artifacts contains information about the media files that are played using the VLC Media Player. This artifact discloses information on the user's interaction with the application and files that were played in the player. Also, it is supported in Linux, Windows 8 and 10, Android, and iOS. Tracking such information is critical during the digital forensic analysis process.
Location of VLC Media Player Artifacts
Windows 7/8/10: C:\Users\User Name\AppData\Roaming\vlc\vlc-qt-interface.ini
Analyzing VLC Media Player Artifacts with ArtiFast Windows
This section will discuss how to use ArtiFast Windows to analyze VLC Media Player artifacts from Windows machines and what kind of digital forensics insights we can gain from the artifacts.
After you have created your case and added evidence for investigation, at the Artifacts Parser Selection Phase, you can select VLC Media Player artifacts:
ArtiFast can analyze VLC Media Player Audio Files, Recently Played Files and Watched Videos. For demonstration purposes, all the artifacts have been chosen, however, you have the option to select one or more artifacts.
Once ArtiFast parser plugins complete processing artifacts for analysis, it can be reviewed via “Artifact View” or “Timeline View,” with indexing, filtering, and searching capabilities. Below is a detailed description of VLC Media Player artifacts in ArtiFast software.
VLC Media Player Audio Files Artifact
- Item name - The name of the audio item.
- Item path - The file path to the audio item.
- Album name - The name of the album.
- Artist name - The name of the artist.
- Is favorite - Indicates whether the audio is flagged as favorite.
VLC Media Player Recently Played Files Artifact
- File name - The name of the file.
- File path - The file path to the recently played file.
- Resume time - The number of seconds played before the media file is paused or stopped.
VLC Media Player Watched Videos Artifact
- Show title - The name of the file that was played in the player.
- Name - The name of the video.
- Watched duration - The video watched duration.
- Favorite - Indicates whether the video is flagged as favorite.
- Path - The file path of the video.
- Type - The type of the video.
- Duration - The duration of the video.
- Is currently playing - Indicates whether the video is currently playing.
- Season - The video season.
- Episode - The video episode.
