File Recovery

MPG Signature format

How to erase hard drive? Windows7 logo   How to erase hard drive? Intel logo

User's guide:

VCD Audio Video (.DAT) Signature Format & MPG Recovery Example

The VCD, also called Video CD format, stores MPEG files under the .DAT file extension. .DAT format is just the MPEG-1 or MPEG-2 format only with the .dat extension. DAT files on VCD disks are stored under the MPEGAV (MPEG Audio and Video) directory. Usually, audio & video data encoded with MPEG-1 standard.

Any RIFF container, including MPG Audio-Video must have a signature (tag) RIFF (hex: 52 49 46 46) at the beginning of the file.

RIFF files are organized into data segments (chunks). Each segment is prefixed with an 12 byte header: 4 byte signature (RIFF), 4 byte data size (little-endian order, low byte first) and 4 byte RIFF Type: signature CDXA. Chunk size is data size plus 8 bytes. Summarizing size for all found chunks, we calculate total file size.

Let's examine the sample

When inspecting a sample.mpg file's data using any Hex Viewer, like Active@ Disk Editor, which is included in Active@ File Recovery package, we can see it starts with a signature RIFF (hex: 52, 49, 46, 46).

At offset 8 there is a signature of MPG RIFF Type CDXA (hex: 43, 44, 58, 41). At offset 4 there is a data size: 34,315,716 (hex: C4, 9D, 0B, 02) in little-endian order (low byte first). Adding header length to the data size, we calculate a total MPG audio video file size: 34,315,716 + 8 = 34,315,724 bytes.Sample file is much smaller, however it contains a valid header and a part of whole video.

MPG data video file - signature inspection

RIFF Files Header:

struct RIFF_Header
    uint32   SignatureRIFF;     // Signature: "RIFF"
    uint32   SizeRIFF;      // 4 byte file size, little-endian order
    uint32   SignatureTYPE;     // RIFF Subtype: "AVI ", "CDXA", "WAVE", "CDR*", ...

Videodiscs - VCD Files Format

DAT - File Extension for VCD Files

Active@ File Recovery Custom Scripting Example

This example just determins MPG start signature and calculates file size based on the size specified in RIFF header. Some additional validation included. Syntax of the signature definition language you can read here.



        size = read(dword, 4)
        size = sum(size, 8)
        temp = read(dword, size)
        if (temp != "JUNK") goto label
        size = sum(size, 4)
        temp = read(dword, size)
        size = sum(size, 4)
        size = sum(size, temp)
        goto next
        temp = and(temp, 00FFFFFFh)
        if (temp != "TAG") goto exit
        size = sum(size, 128)
        goto next

This document is available in PDF format,
which requires Adobe® Acrobat® Reader
(Free download):


Data Recovery

Data Utility

Data Security

Data Backup

CD/DVD Tools