- Nationwide Digital Forensic & Cyber Investigation Services
A filename is a label. Byte patterns, declared lengths, and coherent internal structures establish whether the supplied object is MP4, MOV, AVI, Matroska, transport stream, or something else.
Home › Digital Evidence Authentication › Video Evidence Authentication › Video Magic Bytes and Header Signatures
Quick Answer. Video magic bytes are recognizable byte sequences that suggest a container format. MP4 commonly has ftyp at offset 4; AVI begins with RIFF and identifies AVI at offset 8; Matroska begins 1A 45 DF A3. Examiners confirm these clues against lengths, internal records, and stream structure. A matching header identifies a format candidate, not an authentic recording.
This byte identification guide belongs to Video Evidence Authentication. Use it before interpreting MP4 and MOV file structure or drawing conclusions from video metadata. The initial task is to determine what the supplied bytes contain, including wrappers that a filename conceals.
| Question | Short answer |
|---|---|
| What are MP4 video magic bytes? | The usual MP4 identification is 66 74 79 70, spelling ftyp, at offset 4 after a four byte box size. Validate the major brand, compatible brands, and subsequent boxes rather than accepting those four bytes alone. |
| What do AVI video header bytes look like? | AVI normally starts 52 49 46 46 for RIFF, then a four byte little endian size, followed at offset 8 by 41 56 49 20 for AVI plus a space. |
| Do Matroska and WebM have different opening magic bytes? | Both use the EBML header identifier 1A 45 DF A3. Read the EBML DocType to distinguish matroska from webm and then inspect the tracks. |
| Can video magic bytes identify H.264 inside MP4? | Not by themselves. MP4 is the container. Sample descriptions such as avc1 and their configuration records identify the encoded stream; the opening ftyp box does not. |
| Does a mismatched video extension prove concealment? | No. It establishes a mismatch between the name and the identified format. Export software, ordinary renaming, or intentional concealment can produce that condition. Intent requires additional evidence. |
| Can truncated video retain a valid signature? | Yes. A file can retain its original opening bytes while losing later movie metadata or media samples. Check declared sizes, available tracks, and the final readable sample. |
An ISO base media file type box containing a major brand, minor version, and compatible brands.
The AVI space identifier at offset 8 in a conventional RIFF AVI file.
The EBML header value that declares a document family such as matroska or webm.
The hexadecimal value 47 expected at repeated MPEG transport packet boundaries.
The identifier that opens an ASF header and precedes its size and object count.
The header field locating the end of the FLV header before the initial previous tag size.
A 64 bit ISO box length used when the ordinary size field equals 1.
Read bytes from a preserved working copy, not a renamed or repaired export. Start with the opening region and the total file length. Record absolute offsets in hexadecimal or decimal consistently. A signature search is a triage method: identification becomes stronger when the candidate header leads to plausible lengths, recognized structures, and decodable tracks.
| Container candidate | Concrete bytes and placement | Required confirmation |
|---|---|---|
| MP4 or related ISO media | 66 74 79 70 commonly at offset 4 | A valid ftyp size, brands, and a coherent box sequence |
| AVI | 52 49 46 46 at 0; 41 56 49 20 at 8 | RIFF size and LIST structures including hdrl and movi |
| Matroska or WebM | 1A 45 DF A3 at 0 | EBML header fields, DocType, Segment, and tracks |
| MPEG transport stream | 47 repeated at packet intervals | Stable packet alignment and credible transport headers |
| MPEG program stream | 00 00 01 BA pack start code | Pack and packet syntax across the stream |
| ASF, commonly containing WMV | 30 26 B2 75 8E 66 CF 11 A6 D9 00 AA 00 62 CE 6C | Header Object size and valid child objects |
| FLV | 46 4C 56 at 0 | Version, flags, data offset, and audio or video tags |
An AVI wrapper may carry several different codecs. ASF may contain audio without video. An MP4 compatible file may contain only an audio track. Report the recognized wrapper separately from the presence of video and the codec actually used. Consult codec and GOP analysis when the question concerns encoded pictures rather than file identity.
Preserve the file exactly as received and supply its acquisition context. We can classify the wrapper, document offsets and structural errors, and distinguish a format mismatch from an incomplete transfer before any recovery copy is made.
Request Confidential Consultation Call (833) 292 3733The ftyp type normally follows a four byte big endian box length. The next four bytes give the major brand, followed by a four byte minor version and zero or more four byte compatible brands. These are format declarations. They do not certify the origin of the footage or identify the application that last wrote every other part of the file.
| Four byte brand | Hexadecimal bytes | Interpretation |
|---|---|---|
| isom | 69 73 6F 6D | Generic ISO base media compatibility declaration |
| mp41 | 6D 70 34 31 | MPEG 4 version 1 file format declaration |
| mp42 | 6D 70 34 32 | MPEG 4 version 2 file format declaration |
| M4V plus space | 4D 34 56 20 | A video oriented brand used in some media ecosystems |
| qt plus two spaces | 71 74 20 20 | QuickTime format brand |
The sequence 00 00 00 18 66 74 79 70 6D 70 34 32 00 00 00 00 69 73 6F 6D 6D 70 34 32 declares a 24 byte ftyp box. Its major brand is mp42, its minor version is zero, and its compatible brands are isom and mp42. The next box begins at offset 24. A parser that instead advances by the payload length alone will lose alignment.
Some older QuickTime files lack ftyp and begin with another valid atom. Therefore, absence of ftyp at byte 4 does not exclude MOV. Likewise, ftyp is shared by image and audio formats. A brand such as heic requires a different interpretation than a video recording. Inspect handlers and sample descriptions before calling the object a movie.
For ordinary boxes, size includes the header. Size 1 introduces an extended 64 bit size; size 0 extends the box to the end of the file within the applicable structure. Account for these rules before declaring corruption. The position of moov before mdat commonly supports progressive playback, but it does not establish whether the clip was edited.
Each family needs its own structural test. RIFF lengths use little endian ordering, while conventional ISO box lengths use big endian ordering. Confusing those conventions can turn a healthy file into an apparent size anomaly. Record the candidate format and the independent structure that confirms it rather than listing a collection of matching strings.
For a conventional AVI RIFF chunk, the stored size describes bytes after the first eight bytes. Chunk payloads use padding to even boundaries. LIST chunks group records; hdrl carries stream headers and movi contains media chunks. Larger OpenDML AVI files may include additional RIFF segments marked AVIX. A size comparison limited to the initial segment can therefore be misleading.
EBML uses element identifiers and variable length sizes rather than fixed ISO box headers. Locate DocType, whose element identifier is 42 82, and read its value. A WebM declaration should be assessed against the permitted stream features, not inferred from an .webm suffix. Unknown element sizes can be legitimate, particularly for streamable segments.
Standard MPEG transport packets are 188 bytes. Check candidate sync positions at offsets 0, 188, 376, and onward when alignment begins at zero. Some variants place four prefix bytes before each 188 byte packet, producing 192 byte records; other systems use 204 byte records with additional error correction data. Search for the correct alignment instead of rejecting every nonzero starting offset.
Repeated 47 bytes should lead to credible packet identifiers, adaptation controls, and continuity behavior. Program association and program map information can connect packet identifiers to streams. A single 47 value is common in arbitrary data and carries essentially no identification weight by itself.
ASF starts with the full 16 byte Header Object identifier shown above, not just its first eight bytes. Validate its little endian object size and child object count before following stream properties. FLV normally uses version 1. Its four byte big endian DataOffset is commonly 9, followed by an initial PreviousTagSize of zero. Subsequent tags have declared data sizes and timestamps; their preceding tag size relationships provide additional checks.
A renamed file can remain completely valid internally. Truncation is different: the available bytes end before a declared structure or expected sample range is complete. Determine which observation applies before discussing intent, repair, or missing content. Compare the supplied length with the acquisition source and any documented transfer size.
An MP4 with an intact initial ftyp and mdat may be unplayable because moov was never finalized or was lost from the end. An intact moov can also reference sample offsets beyond the available file. Neither condition independently proves deliberate deletion. Interrupted recording, storage failure, partial download, and export failure must be assessed against the collection history.
Repair software can invent a wrapper, rebuild indexes, or borrow parameters from a reference recording. Those actions create a derivative useful for review, not a restored original with independently established history. Preserve the input hash, recovery settings, reference file identity, output hash, and limitations on recovered timing.
For a disputed clip, the useful conclusion is specific: the received object is structurally consistent with an AVI container, or the received MP4 ends within a declared media box. Authentication then moves to source records, timing, and content continuity under the video authenticity check. Header classification alone cannot establish that a scene happened as depicted.
Use this sequence to make the identification reproducible without altering the evidence or letting a player silently convert it.
We document video container identification with byte offsets, interpreted lengths, stream inventory, and reproducible error locations. Where recovery is requested, we distinguish original evidence from reconstructed playback material and explain which timing or content claims remain unsupported. This analysis is led by subject matter experts in video header analysis who read the ftyp box, brand codes, and file signatures at the byte level.
Elite Digital Forensics is an independent digital forensics practice serving attorneys, paralegals, in house counsel, insurers, lenders, businesses, and individuals nationwide. Our team includes former law enforcement forensic examiners and court qualified expert witnesses in computer, cell phone, cloud, document, and multimedia forensics. Every engagement begins with a scoped plan, hash verified evidence handling, and a clear explanation of what the examination can answer.
Usually not. Brands and wrapper signatures describe format compatibility. Device attribution needs metadata, source records, and comparison material rather than a header match alone.
Preserve the received name first. If a decoder requires another extension, rename only a documented working copy and retain the hash relationship to the evidence.
The header can survive while indexes, decoder configuration, or media samples are absent or damaged. Identify the failed structure rather than treating the opening signature as a health check.
Yes. An elementary stream need not have a container header. Annex B streams commonly use 00 00 01 or 00 00 00 01 start codes before NAL units. Validate syntax across multiple units.
No. ASF is a container and can hold audio or other supported streams. Inspect stream properties before reporting video content or a specific codec.
Present the original item identifier, hash, offset labeled bytes, interpretation rules, and corroborating structure. Separate format identification from conclusions about editing, origin, or the truth of depicted events.
Tell us what the file is claimed to be, how it was received, and whether playback or identification has failed. Preserve the untouched item and any transfer records so the examination can distinguish the available structure from later recovery work. Our court qualified experts in video forensics can testify to what the header bytes establish about a recording.
Request Confidential Consultation Call (833) 292 3733This content is for educational and informational purposes only and does not constitute legal advice. Elite Digital Forensics provides independent digital forensic services and expert witness testimony; we do not provide legal representation. Every case is fact specific; outcomes depend on the evidence, jurisdiction, and counsel. Retain qualified legal counsel for advice about your matter.
Elite Digital Forensics Assistant
By submitting this form, you consent to be contacted by email, text, or phone. Your information is kept secure and confidential. Reply Stop to opt out at anytime.
IMPORTANT: Please remember to check your spam or junk folder