WAV Audio File Signature Format Specification & Recovery Example

Waveform Audio Signature Format: Specification & WAV Recovery Example

Waveform Audio File Format (WAVE, or WAV, or Audio for Windows) is a Microsoft and IBM audio file format standard for storing an audio bitstream on PCs. It is an application of the RIFF (Resource Interchange File Format) bitstream format method for storing data in "chunks". It is the main format used on Windows Operating Systems for raw and uncompressed audio.

Any RIFF container, including WAV-audio must have a signature (tag) RIFF (hex: 52 49 46 46) at the beginning of the file.

RIFF files are organized into data segments (chunks). Each segment is prefixed with an 12 byte header: 4 byte signature (RIFF), 4 byte data size (little-endian order, low byte first) and 4 byte RIFF Type: signature WAVE. Chunk size is data size plus 8 bytes. Summarizing size for all found chunks, we calculate total file size.

Let's examine the sample

When inspecting sample.wav file's data using any Hex Viewer, like Active@ Disk Editor, which is included in Active@ File Recovery package, we can see it starts with a signature RIFF (hex: 52, 49, 46, 46). At offset 8 there is a signature of Waveform Audio RIFF Type WAVE (hex: 57, 41, 56, 45). At offset 4 there is a data size: 4,282 (hex: BA, 10, 00, 00) in little-endian order (low byte first). Adding header length to the data size, we calculate a total WAV file size: 4,282 + 8 = 4,290

Wavform audiofile - signature inspection

More info:

RIFF Files Header:

struct RIFF_Header
	uint32   SignatureRIFF;		// Signature: "RIFF"
	uint32   SizeRIFF;		// 4 byte file size, little-endian order
	uint32   SignatureTYPE;		// RIFF Subtype: "AVI ", "CDXA", "WAVE", "CDR*", ...

Waveform Audio File Format

Active@ File Recovery Custom Scripting Example

This example just determins wav start signature and calculates file size based on the size specified in RIFF header. Some additional validation included.
Syntax of the signature definition language you can read here.

DESCRIPTION=Waveform Audio File


		size = read(dword, 4)
		size = sum(size, 8)
		temp = read(dword, size)
		if (temp != "JUNK") goto label
		size = sum(size, 4)
		temp = read(dword, size)
		size = sum(size, 4)
		size = sum(size, temp)
		goto next
		temp = and(temp, 00FFFFFFh)
		if (temp != "TAG") goto exit
		size = sum(size, 128)
		goto next