mp4 Signature Format: Documentation & Recovery Example

MP4 Signature Format: Documentation & Recovery Example

MPEG-4 Part 14 or MP4 is a digital multimedia format most commonly used to store video and audio, but can also be used to store other data such as subtitles and still images. MP4 allows streaming over the Internet. The only official filename extension for MPEG-4 Part 14 files is .mp4, but many have other extensions, most commonly .m4a and .m4p. The MPEG-4 file format specification was based on the QuickTime format specification.

MP4 files consist of consecutive chunks. Each chunk has 8 byte header: 4-byte chunk size (big-endian, high byte first) and 4-byte chunk type - one of pre-defined signatures: "ftyp", "mdat", "moov", "pnot", "udta", "uuid", "moof", "free", "skip", "jP2 ", "wide", "load", "ctab", "imap", "matt", "kmat", "clip", "crgn", "sync", "chap", "tmcd", "scpt", "ssrc", "PICT".

First chunk must be of type "ftype" and has a sub-type at offset 8. MP4 defined by sub-type which must be one of values: "avc1", "iso2", "isom", "mmp4", "mp41", "mp42", "mp71", "msnv", "ndas", "ndsc", "ndsh", "ndsm", "ndsp", "ndss", "ndxc", "ndxh", "ndxm", "ndxp", "ndxs".

Iterating chunks, until unknown type is detected, we compose MP4 file.

Let's examine the sample

When inspecting sample.mp4 file's binary data using any Hex Viewer, like Active@ Disk Editor we can see it starts with a signature ftyp (hex: 66 74 79 70) at offset 4, which defines QuickTime Container File Type. File sub-type is mmp4 (hex: 6D 6D 70 34) which points to MP4 file type. First block size is 28 (hex: 00 00 00 1C, big-endian, high byte first), size located at offset 0. At offset 28 (hex: 1C) is located the second chunk, which has a size of 8 and type mdat (hex: 6D 64 61 74) . The next chunk is located at offset 28+8=36 (hex: 24) and has a size 303,739 (hex: 00 04 A2 7B) and type mdat (hex: 6D 64 61 74) at offset 40 (hex: 28). The next chunk is located at offset 36 + 303,739=303,775 and has a size 6,202 (hex: 00 00 18 3A) and type moov (hex: 6D 6F 6F 76) at offset 303,779. This is the last chunk, so total file size is 303,775+6,202=309,977 bytes. MP4 format - header inspection

 

More info:

MPEG-4 Part 14 Format Specification
QuickTime File Format