File Recovery

WAV Signature format

How to erase hard drive? Windows7 logo   How to erase hard drive? Intel logo

User's guide:

Waveform Audio Signature Format: Specification & WAV Recovery Example

Waveform Audio File Format (WAVE, or WAV, or Audio for Windows) is a Microsoft and IBM audio file format standard for storing an audio bitstream on PCs. It is an application of the RIFF (Resource Interchange File Format) bitstream format method for storing data in "chunks". It is the main format used on Windows Operating Systems for raw and uncompressed audio.

Any RIFF container, including WAV-audio must have a signature (tag) RIFF (hex: 52 49 46 46) at the beginning of the file.

RIFF files are organized into data segments (chunks). Each segment is prefixed with an 12 byte header: 4 byte signature (RIFF), 4 byte data size (little-endian order, low byte first) and 4 byte RIFF Type: signature WAVE. Chunk size is data size plus 8 bytes. Summarizing size for all found chunks, we calculate total file size.

Let's examine the sample

When inspecting sample.wav file's data using any Hex Viewer, like Active@ Disk Editor, which is included in Active@ File Recovery package, we can see it starts with a signature RIFF (hex: 52, 49, 46, 46).

At offset 8 there is a signature of Waveform Audio RIFF Type WAVE (hex: 57, 41, 56, 45).

At offset 4 there is a data size: 4,282 (hex: BA, 10, 00, 00) in little-endian order (low byte first).

Adding header length to the data size, we calculate a total WAV file size: 4,282 + 8 = 4,290

Wavform audiofile - signature inspection

RIFF Files Header:

struct RIFF_Header
    uint32   SignatureRIFF;     // Signature: "RIFF"
    uint32   SizeRIFF;      // 4 byte file size, little-endian order
    uint32   SignatureTYPE;     // RIFF Subtype: "AVI ", "CDXA", "WAVE", "CDR*", ...

Waveform Audio File Format

Active@ File Recovery Custom Scripting Example

This example just determins wav start signature and calculates file size based on the size specified in RIFF header.

Some additional validation included.
Syntax of the signature definition language you can read here.

DESCRIPTION=Waveform Audio File


        size = read(dword, 4)
        size = sum(size, 8)
        temp = read(dword, size)
        if (temp != "JUNK") goto label
        size = sum(size, 4)
        temp = read(dword, size)
        size = sum(size, 4)
        size = sum(size, temp)
        goto next
        temp = and(temp, 00FFFFFFh)
        if (temp != "TAG") goto exit
        size = sum(size, 128)
        goto next

This document is available in PDF format,
which requires Adobe® Acrobat® Reader
(Free download):


Data Recovery

Data Utility

Data Security

Data Backup

CD/DVD Tools