WAV Signature format

Waveform Audio Signature Format: Specification & WAV Recovery Example

Waveform Audio File Format (WAVE, or WAV, or Audio for Windows) is a Microsoft and IBM audio file format standard for storing an audio bitstream on PCs. It is an application of the RIFF (Resource Interchange File Format) bitstream format method for storing data in "chunks". It is the main format used on Windows Operating Systems for raw and uncompressed audio.

Any RIFF container, including WAV-audio must have a signature (tag) RIFF (hex: 52 49 46 46) at the beginning of the file.

RIFF files are organized into data segments (chunks). Each segment is prefixed with an 12 byte header: 4 byte signature (RIFF), 4 byte data size (little-endian order, low byte first) and 4 byte RIFF Type: signature WAVE. Chunk size is data size plus 8 bytes. Summarizing size for all found chunks, we calculate total file size.

Let's examine the sample

When inspecting sample.wav file's data using any Hex Viewer, like Active@ Disk Editor, which is included in Active@ File Recovery package, we can see it starts with a signature RIFF (hex: 52, 49, 46, 46).

At offset 8 there is a signature of Waveform Audio RIFF Type WAVE (hex: 57, 41, 56, 45).

At offset 4 there is a data size: 4,282 (hex: BA, 10, 00, 00) in little-endian order (low byte first).

Adding header length to the data size, we calculate a total WAV file size: 4,282 + 8 = 4,290

RIFF Files Header:

struct RIFF_Header
{
    uint32   SignatureRIFF;     // Signature: "RIFF"
    uint32   SizeRIFF;      // 4 byte file size, little-endian order
    uint32   SignatureTYPE;     // RIFF Subtype: "AVI ", "CDXA", "WAVE", "CDR*", ...
};

Waveform Audio File Format

Active@ File Recovery Custom Scripting Example

This example just determins wav start signature and calculates file size based on the size specified in RIFF header.

Some additional validation included.
Syntax of the signature definition language you can read here.

[WAV_HEADER]
DESCRIPTION=Waveform Audio File
EXTENSION=wav
BEGIN=WAV_BEGIN
SCRIPT=WAV_SCRIPT

[WAV_BEGIN]
RIFF=0|0
WAV=8|8

[WAV_SCRIPT]
        size = read(dword, 4)
        size = sum(size, 8)
next:
        temp = read(dword, size)
        if (temp != "JUNK") goto label
        size = sum(size, 4)
        temp = read(dword, size)
        size = sum(size, 4)
        size = sum(size, temp)
        goto next
label:
        temp = and(temp, 00FFFFFFh)
        if (temp != "TAG") goto exit
        size = sum(size, 128)
        goto next