M4V Signature Format: Documentation & Recovery Example

M4V Signature Format: Documentation & Recovery Example

The M4V file format is a video container format developed by Apple and is very similar to the MP4 format, however M4V files may optionally be protected by DRM copy protection. Apple's iTunes Store uses M4V to encode video files, such as TV episodes, movies, and music videos. The copyright of M4V files may be protected by using Apple's FairPlay DRM copy protection.

MPEG-4 Part 14 or MP4 is a digital multimedia format most commonly used to store video and audio, but can also be used to store other data such as subtitles and still images. MP4 allows streaming over the Internet. The only official filename extension for MPEG-4 Part 14 files is .mp4, but many have other extensions, most commonly .m4a, .m4p and m4v. The MPEG-4 file format specification was based on the QuickTime format specification.

M4V files consist of consecutive chunks. Each chunk has 8 byte header: 4-byte chunk size (big-endian, high byte first) and 4-byte chunk type.

First chunk must be of type "ftype" and has a sub-type at offset 8. M4V defined by sub-type which must be "M4V_".

Next chunks type should be one of pre-defined signatures: "ftyp", "mdat", "moov", "pnot", "udta", "uuid", "moof", "free", "skip", "jP2 ", "wide", "load", "ctab", "imap", "matt", "kmat", "clip", "crgn", "sync", "chap", "tmcd", "scpt", "ssrc", "PICT".

Iterating chunks, until unknown type is detected, we compose M4V file.

Let's examine the sample

When inspecting sample.m4v file's binary data using any Hex Viewer, like Active@ Disk Editor we can see it starts with a signature ftyp (hex: 66 74 79 70) at offset 4, which defines QuickTime Container File Type. File sub-type is M4V_ (hex: 4D 34 56 20) which points to M4V (MPEG-4) file type. First block size is 32 (hex: 00 00 00 20, big-endian, high byte first), size located at offset 0. At offset 32 (hex: 20) is located the second chunk, which has a size of 30,322 (hex: 00 00 76 72, big-endian, lower-byte first) and type moov (hex: 6D 6F 6F 76). The next chunk is located at offset 32+30,322=30,354 (hex: 00 00 76 92) and has a size 8 (hex: 00 00 00 08) and type free (hex: 66 72 65 65). Iterating blocks further we can pick up all M4V file data. QuickTime M4V format - header inspection

 

More info:

M4V file format
MPEG-4 Part 14 Format Specification
QuickTime File Format