3GP Signature Format: Documentation & Recovery Example

3GP Signature Format: Documentation & Recovery Example

3GP (3GPP file format) is a multimedia container format defined by the Third Generation Partnership Project (3GPP) for 3G UMTS multimedia services. It is widely used on 3G mobile phones (plus 2G &4G). 3GP is defined in the ETSI 3GPP technical specification. 3GP is a required file format for video and associated speech/audio media types and timed text in ETSI 3GPP technical specifications for IP Multimedia Subsystem (IMS), Multimedia Messaging Service (MMS), Multimedia Broadcast/Multicast Service (MBMS) and Transparent end-to-end Packet-switched Streaming Service (PSS).
The 3GP file format stores video streams as MPEG-4 Part 2 or H.263 or MPEG-4 Part 10 (AVC/H.264), and audio streams as AMR-NB, AMR-WB, AMR-WB+, AAC-LC, HE-AAC v1 or Enhanced aacPlus (HE-AAC v2). 3GPP allowed use of AMR and H.263 codecs in the ISO base media file format (MPEG-4 Part 12), because 3GPP specified the usage of the Sample Entry and template fields in the ISO base media file format as well as defining new boxes to which codecs refer.
The 3GPP file format specification was based on the QuickTime container format specification.
A 3GP file is always big-endian, storing and transferring the most significant bytes first.

3GP files consist of consecutive chunks. Each chunk has 8 byte header: 4-byte chunk size (big-endian, high byte first) and 4-byte chunk type - one of pre-defined signatures: "ftyp", "mdat", "moov", "pnot", "udta", "uuid", "moof", "free", "skip", "jP2 ", "wide", "load", "ctab", "imap", "matt", "kmat", "clip", "crgn", "sync", "chap", "tmcd", "scpt", "ssrc", "PICT".

First chunk must be of type "ftype" and has a sub-type at offset 8. 3GP defined by sub-type which must be one of values: "3ge6", "3ge7", "3gg6", "3gp1", "3gp2", "3gp3", "3gp4", "3gp5", "3gp6", "3gp7", "3gr6", "3gr7", "3gs6", "3gs7", "kddi".

Iterating chunks, until unknown type is detected, we compose 3GP file.

Let's examine the sample

When inspecting sample.3gp file's binary data using any Hex Viewer, like Active@ Disk Editor we may notice it starts with a signature ftyp (hex: 66 74 79 70) at offset 4, which defines QuickTime Multimedia Container File Type. File sub-type is 3gp5 (hex: 33 67 70 35) which points to 3GPP file type. First block size is 24 (hex: 00 00 00 18, big-endian, high byte first), size located at offset 0. At offset 24 (hex: 18) is located the second chunk, which has a size of 1,716 (hex: 00 00 06 B4) and type moov (hex: 6D 6F 6F 76). The next chunk is located at offset 24+1,716=1,740 and has a size 8 (hex: 00 04 A2 7B) and type free (hex: 66 72 65 65) at offset 1,744 (hex: 06 D0). Iterating all data blocks the same way, we recover 3GP file. 3GPP format - header inspection

 

More info:

3GPP Specification detail
3GP and 3G2 Format Specification
QuickTime File Format