M4A,M4B,M4P Signature Format: Documentation & Recovery Example

MPEG-4 Part 14 Audio (M4A,M4B,M4P) Format & Recovery Example

M4A is a file extension for an audio file encoded with Advanced Audio Coding (AAC) which is a lossy compression. M4A stands for MPEG 4 Audio. Audio-only MPEG 4 container files usually have an M4A file extension. The MPEG-4 file format specification was based on the QuickTime format specification. M4A file quality is better and file sizes smaller compared to MP3 files. M4A files sound better than MP3 files when encoded at the same bit rate. The reason that these file extensions are so common is that they have been adopted by Apple for use in the iTunes Music Store.

M4B format is only different from M4A because it can be bookmarked allowing an MP3 player to return exactly to the last listening point. M4B is popular for audiobooks and podcasts for this very reason.

M4P is Apple's version of the M4A format that includes DRM protection, called FairPlay. This is the format used for protected music purchased from the iTunes Music Store.

MPEG-4 Part14 (M4A,M4B,M4P) files consist of consecutive chunks. Each chunk has 8 byte header: 4-byte chunk size (big-endian, high byte first) and 4-byte chunk type - one of pre-defined signatures: "ftyp", "mdat", "moov", "pnot", "udta", "uuid", "moof", "free", "skip", "jP2 ", "wide", "load", "ctab", "imap", "matt", "kmat", "clip", "crgn", "sync", "chap", "tmcd", "scpt", "ssrc", "PICT".

First chunk must be of type "ftype" and has a sub-type at offset 8. M4A defined by sub-type which must be "M4A_", for M4B sub-type must be "M4B_" and for M4P sub-type must be "M4P_".

Iterating chunks, until chunk of unknown type is detected, we compose MPEG-4 Audio file.

Let's examine the sample

When inspecting sample.m4a file's binary data using any Hex Viewer, like Active@ Disk Editor we can see it starts with a signature ftyp (hex: 66 74 79 70) at offset 4, which defines QuickTime Container File Type. File sub-type is M4A_ (hex: 4D 34 41 20) which points to M4A file type. First block size is 24 (hex: 00 00 00 18, big-endian, highest byte first), size located at offset 0. At offset 24 (hex: 18) is located the second chunk, which has a size of 8 and type free (hex: 66 72 65 65). The next chunk is located at offset 24+8=32 (hex: 20) and has a size 93,590 (hex: 00 01 6D 96) and type mdat (hex: 6D 64 61 74) at offset 36 (hex: 24). The next chunk is located at offset 32 + 93,590=93,622 (hex: 01 6D B6) and has a size 2,476 (hex: 00 00 09 AC) and type moov (hex: 6D 6F 6F 76) at offset 93,626 (hex: 01 6D BA). This is the last chunk, so total file size is 93,622+2,476 =96,098 bytes. M4A Audio format - header inspection

 

More info:

MPEG-4 Part 14 Format Specification
QuickTime File Format