Video stuck in an .exe
What do you do when a client or business owner hands you surveillance video of the crash, but it’s an .exe, not something you were expecting, like an .mp4?
There are a few typical ways to handle this:
Execute the .exe to see if it installs the native player and plays the video.
Drop the .exe into a forensic video player to see if it can find and extract the video stream.
Use something like 7-Zip to see if you can extract the video stream(s) from the .exe.
7-Zip is a free archiver that can open a lot more than zip files, including Windows executables (.exe). If you get a video in .exe format, right-click the file, click 7-Zip, and then Open Archive (image below). If that doesn’t work, dive deeper and try Open Archive -> #, which searches the file for recognizable embedded content.
Extract any files that look like video or associated data to a separate working folder. If you recover the embedded video files, you may also recover key metadata. That beats the heck out of screen capture or just watching the video in the native player, which usually won't report that information.
Extracting a video stream doesn’t guarantee you’ve got everything, of course, so keep the original .exe and any companion files.
Sometimes 7-Zip will just display an unnamed entry (a lump of data it can see but can’t identify), or the # method will return a long list of foreign-looking files. Other times, the .exe is just the video player, so this process is fruitless.
If you run into a wall, send the file to your forensic video practitioner or software provider of choice… odds are they’ll be able to make some hay. Oftentimes though, you’ll be able to get the video stream yourself in a couple minutes.
Thanks for reading, keep exploring!
Lou Peck
P.S. If you have any other .exe tricks, please comment on the post below.