VideoLan VLC Player App Artifact Report can be used in forensics investigations.This is the windows store app. Watched videos and other valuable information can be found in its sqlite database.

1. VideoLan VLC Player Artifact Report
By
AZIZ SASMAZ

2. Introduction
VideoLan VLC Player APP can be downloaded from Windows store. It uses sqlite database to
store media information. and a log file LogFile.txt to store run time,
played or streamed video and other critical information.
Artifact Structure
VLC database is sqlite database. VideoLan VLC app creates three database files after
installation: background.sqlite, mediavlc.sqlite, mediavlcVideos, settings.sqlite.
There is also a LogFile.txt text file is created.
In mediavlcVideos.sqlite database, there is a table named VideoItem. There are some
important fields in this table: Name, Path, Duration, TimeWatchedSeconds etc.
Example:
showTitle null
Season -1
Episode 0
_id 1
Path C:UsersasasmazVideossecret_video.mp4
Type mp4
Name secret_video
Favorite 0
TimeWatchedSeconds 20
Duration 484400000
Lastwatched 2106-05-19 10:03:22
HasThumbNail 1
IsCameraRoll 0
IsCurrentPlaying 0
LogFile.txt file contains important information such as application run time and which files
were opened or which videos were streamed from which urls. See a sample content below:
App launch 5/19/2016 10:26:31 AM
DB does not need to be dropped.
Loading artists from MusicDB ...
Found 0 artists from MusicDB
Loading artists from MusicDB ...
Found 0 artists from MusicDB
PlayVideoCommand called
PLAYVIDEO: VideoVm is not null, continuing
PLAYVIDEO: Settings videoVm as Locator.VideoVm.CurrentVideo
SetMRL: C:UsersazizsVideos20160508_153702.mp4

3. PLAYWITHVLC: MediaPlayer instance created
PLAYVIDEO: Updating SystemMediaTransportControls
PLAYVIDEO: Updating Live Tile
PLAYVIDEO: Navigating to VideoPlayerPage
SetMRL: https://www.youtube.com/watch?v=06WZXNzTuBM
PLAYWITHVLC: MediaPlayer instance created
Software Version:
Windows 10 Home, Version 1511, OS build 10586.104, VLC 1.7.0.0 for windows store
Artifact location:
C:UsersasasmazAppDataLocalPackagesVideoLAN.VLCforWindows8_paz6r1rewnh0aLo
calState
Tools used in Analysis:
Text Editor: NotePad or TextPad
SQLite Browser: SqLite Database Browser Portable
Important Attributes:
Below VideoItem table shows forensically important attributes with their data type and
description
Name Description Sample
showTitle Title of the video null
Season which season if it's a series -1
Episode which episode if it's a series 0
_id primary key of the table 1
Path The location of the watched video C:UsersasasmazVideosanimal_hunting.mp4
Type Which file type it has mp4
Name Name of the wathed video secret_video
Favorite If it is favorited 0
TimeWatchedSecondsHow many seconds the video is watched 20
Duration Duration of the video 484400000
Lastwatched Last watched date 2106-05-19 10:03:22
HasThumbNail If it has a thumbnail 1
IsCameraRoll Is it from the windos surface camera roll 0
IsCurrentPlaying If it is currently playing 0

4. Date Attributes
The date attributes can be found both in LogFile.txt ("App launch 5/19/2016 10:26:31 AM" )
and
in mediavlcVideos.sqlite database videoItem.Timewathed field as local time.
Investigation Scenario I:
Ali has been charged by the court with abusing and killing animals for pleasure. As a suspect
of animal torturing, he denies all the claims. And all animal right groups and animal lovers is
curious about this case. You are a computer forensics investigator and have been asked the
following to support the case:
Are there any videos related to animals in the suspects PC?
Which videos have been watched?
When he run these videos?
What is the duration of the video, how long he watched it after opening the file? (Duration
is important because the suspect can claim that he accidentally downloaded the suspicious
file and after seeing for a a few seconds closed it.)
Investigation Scenario 2:
A woman sues his boyfriend for taking her videos with his smart phone without her
permission and sharing it with a friend of him. As a forensics investigator you have been
asked the following:
Is there any videos on suspects and his friend's camera roll?
Is there any synced videos on their windows 10 PC? (can be identified by IsCameraroll field)
When the video was run and what is the last watched date?