Android Video Thumbnail Files ".lvl"

Video Thumbnails ".lvl" Found on Android Devices

Video files with the .lvl extension were located on an Android phone in the hidden “.thumbnails” folder. The Android device tested is a Samsung Galaxy SGH-M919. The device model number appears in the full path where the .lvl video thumbnails are stored.

Root/media/0/.thumbnails/M919UVSFQA1_4.4.4/movie_xx/section.0000.lvl

A test to see what actions initiate the creation of the video thumbnails was conducted.

Download Video Testing

A Samsung Galaxy SGH-M919 was used for the test. The phone had been cleared and reset to factory defaults. I installed a video download app to obtain a video from the Internet and store them on the mobile device. The app Video Downloader was installed from the Google App Store.

 
Using the Video Downloader browser, I accessed the Internet Archive movie library and downloaded “Night of the Living Dead”.

It is October after all - Happy Halloween!!

The video download completed. The video was never opened or viewed on the device.

I used the built-in file browser “My Files” app to view folders and files on the phone.

Opening the “VideoDownloader” folder.

Opening the “Download” folder. This showed the “night of the living dead.mp4” video filename and thumbnail image. The video file was never opened or viewed.

Using “My Files” app, I changed the settings to allow hidden files to be visible.

   
With hidden files now visible, I opened the “.thumbnails” folder.

Inside “.thumbnails” was a similar folder to that found on the client’s phone with model number.

Opening the folder containing the device’s model number revealed again a similar folder to that of the client phone’s folder structure. ( movie_xx )

The “movie_27” folder contained the video thumbnails with “.lvl” extensions.

Recorded Video Testing

I created several videos with the built-in camera app. These videos were stored in the “DCIM” folder apart from those videos that were downloaded. They also received their own folder and “.lvl” video thumbnails in the same root “.thumbnails” folder path.

LVL File Format

The “.lvl” file are actually 3GP format video clips from the original video file saved to the device. The header information viewed in Eric Zimmerman’s EZViewer is shown below.

Results

My testing shows that Android photo or video viewing apps initiate the automatic creation on the operating system. The video thumbnails are not created until the video file preview is viewed as a motion thumbnail in an app. The apps use these ".lvl" video clips to show a preview of the videos in thumbnail form.

The “.lvl” files are actual 3GP video clips of sections of the full movie and can be viewed with specific file viewers and forensic tools. Renaming the xxx.lvl file to xxx.3gp will allow the video thumbnail to be viewed in a standard media player.

I also tested deleting the videos and observed that the “.lvl” thumbnails remained on the phone for a period of time. The phone eventually deleted the “.lvl” files and folders that were related to the original deleted video file.