Advertisement
AbbyG

Container Metadata Integrity & Anomaly Extraction

Jun 11th, 2025
57
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 35.98 KB | None | 0 0
  1. ExifToolVersion = 12.87
  2. FileName = 1643450878000.MP4
  3. Directory = .
  4. FileSize = 13410378
  5. ZoneIdentifier = Exists
  6. FileModifyDate = 1748430236.73652
  7. FileAccessDate = 1748452681.31226
  8. FileCreateDate = 1748443742.17326
  9. FilePermissions = 33206
  10. FileType = MP4
  11. FileTypeExtension = MP4
  12. MIMEType = video/mp4
  13. FileType (SubDirectory) -->
  14. - Tag 'ftyp' (20 bytes):
  15. 0008: 6d 70 34 32 00 00 00 01 69 73 6f 6d 6d 70 34 31 [mp42....isommp41]
  16. 0018: 6d 70 34 32 [mp42]
  17. + [BinaryData directory, 20 bytes]
  18. | MajorBrand = mp42
  19. | - Tag 0x0000 (4 bytes, undef[4]):
  20. | 0008: 6d 70 34 32 [mp42]
  21. | MinorVersion = .
  22. | - Tag 0x0001 (4 bytes, undef[4]):
  23. | 000c: 00 00 00 01 [....]
  24. | CompatibleBrands = isommp41mp42
  25. | - Tag 0x0002 (12 bytes, undef[12]):
  26. | 0010: 69 73 6f 6d 6d 70 34 31 6d 70 34 32 [isommp41mp42]
  27. Movie (SubDirectory) -->
  28. - Tag 'moov' (33016 bytes):
  29. 0024: 00 00 00 6c 6d 76 68 64 00 00 00 00 df 1e 02 e4 [...lmvhd........]
  30. 0034: df 1e 02 e8 00 00 3e 80 00 0f f8 49 00 01 00 00 [......>....I....]
  31. 0044: 01 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 [................]
  32. 0054: 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 [................]
  33. 0064: 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 [............@...]
  34. [snip 32936 bytes]
  35. + [Movie directory]
  36. | MovieHeader (SubDirectory) -->
  37. | - Tag 'mvhd' (100 bytes):
  38. | 002c: 00 00 00 00 df 1e 02 e4 df 1e 02 e8 00 00 3e 80 [..............>.]
  39. | 003c: 00 0f f8 49 00 01 00 00 01 00 00 00 00 00 00 00 [...I............]
  40. | 004c: 00 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 [................]
  41. | 005c: 00 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 [................]
  42. | 006c: 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 [....@...........]
  43. | [snip 20 bytes]
  44. | + [BinaryData directory, 100 bytes]
  45. | | MovieHeaderVersion = 0
  46. | | - Tag 0x0000 (1 bytes, int8u[1]):
  47. | | 002c: 00 [.]
  48. | | CreateDate = 3743285988
  49. | | - Tag 0x0001 (4 bytes, int32u[1]):
  50. | | 0030: df 1e 02 e4 [....]
  51. | | ModifyDate = 3743285992
  52. | | - Tag 0x0002 (4 bytes, int32u[1]):
  53. | | 0034: df 1e 02 e8 [....]
  54. | | TimeScale = 16000
  55. | | - Tag 0x0003 (4 bytes, int32u[1]):
  56. | | 0038: 00 00 3e 80 [..>.]
  57. | | Duration = 1046601
  58. | | - Tag 0x0004 (4 bytes, int32u[1]):
  59. | | 003c: 00 0f f8 49 [...I]
  60. | | PreferredRate = 65536
  61. | | - Tag 0x0005 (4 bytes, int32u[1]):
  62. | | 0040: 00 01 00 00 [....]
  63. | | PreferredVolume = 256
  64. | | - Tag 0x0006 (2 bytes, int16u[1]):
  65. | | 0044: 01 00 [..]
  66. | | MatrixStructure = 1 0 0 0 1 0 0 0 16384
  67. | | - Tag 0x0009 (36 bytes, fixed32s[9]):
  68. | | 0050: 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [................]
  69. | | 0060: 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [................]
  70. | | 0070: 40 00 00 00 [@...]
  71. | | PreviewTime = 0
  72. | | - Tag 0x0012 (4 bytes, int32u[1]):
  73. | | 0074: 00 00 00 00 [....]
  74. | | PreviewDuration = 0
  75. | | - Tag 0x0013 (4 bytes, int32u[1]):
  76. | | 0078: 00 00 00 00 [....]
  77. | | PosterTime = 0
  78. | | - Tag 0x0014 (4 bytes, int32u[1]):
  79. | | 007c: 00 00 00 00 [....]
  80. | | SelectionTime = 0
  81. | | - Tag 0x0015 (4 bytes, int32u[1]):
  82. | | 0080: 00 00 00 00 [....]
  83. | | SelectionDuration = 0
  84. | | - Tag 0x0016 (4 bytes, int32u[1]):
  85. | | 0084: 00 00 00 00 [....]
  86. | | CurrentTime = 0
  87. | | - Tag 0x0017 (4 bytes, int32u[1]):
  88. | | 0088: 00 00 00 00 [....]
  89. | | NextTrackID = 3
  90. | | - Tag 0x0018 (4 bytes, int32u[1]):
  91. | | 008c: 00 00 00 03 [....]
  92. | Track (SubDirectory) -->
  93. | - Tag 'trak' (14709 bytes):
  94. | 0098: 00 00 00 5c 74 6b 68 64 00 00 00 01 df 1e 02 e4 [...\tkhd........]
  95. | 00a8: df 1e 02 e8 00 00 00 01 00 00 00 00 00 0f f8 49 [...............I]
  96. | 00b8: 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 [................]
  97. | 00c8: 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [................]
  98. | 00d8: 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [................]
  99. | [snip 14629 bytes]
  100. | + [Track directory]
  101. | | TrackHeader (SubDirectory) -->
  102. | | - Tag 'tkhd' (84 bytes):
  103. | | 00a0: 00 00 00 01 df 1e 02 e4 df 1e 02 e8 00 00 00 01 [................]
  104. | | 00b0: 00 00 00 00 00 0f f8 49 00 00 00 00 00 00 00 00 [.......I........]
  105. | | 00c0: 00 00 00 00 01 00 00 00 00 01 00 00 00 00 00 00 [................]
  106. | | 00d0: 00 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 [................]
  107. | | 00e0: 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 [........@.......]
  108. | | 00f0: 00 00 00 00 [....]
  109. | | + [BinaryData directory, 84 bytes]
  110. | | | TrackHeaderVersion = 0
  111. | | | - Tag 0x0000 (1 bytes, int8u[1]):
  112. | | | 00a0: 00 [.]
  113. | | | TrackCreateDate = 3743285988
  114. | | | - Tag 0x0001 (4 bytes, int32u[1]):
  115. | | | 00a4: df 1e 02 e4 [....]
  116. | | | TrackModifyDate = 3743285992
  117. | | | - Tag 0x0002 (4 bytes, int32u[1]):
  118. | | | 00a8: df 1e 02 e8 [....]
  119. | | | TrackID = 1
  120. | | | - Tag 0x0003 (4 bytes, int32u[1]):
  121. | | | 00ac: 00 00 00 01 [....]
  122. | | | TrackDuration = 1046601
  123. | | | - Tag 0x0005 (4 bytes, int32u[1]):
  124. | | | 00b4: 00 0f f8 49 [...I]
  125. | | | TrackLayer = 0
  126. | | | - Tag 0x0008 (2 bytes, int16u[1]):
  127. | | | 00c0: 00 00 [..]
  128. | | | TrackVolume = 256
  129. | | | - Tag 0x0009 (2 bytes, int16u[1]):
  130. | | | 00c4: 01 00 [..]
  131. | | | MatrixStructure = 1 0 0 0 1 0 0 0 16384
  132. | | | - Tag 0x000a (36 bytes, fixed32s[9]):
  133. | | | 00c8: 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [................]
  134. | | | 00d8: 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [................]
  135. | | | 00e8: 40 00 00 00 [@...]
  136. | | | ImageWidth = 0
  137. | | | - Tag 0x0013 (4 bytes, int32u[1]):
  138. | | | 00ec: 00 00 00 00 [....]
  139. | | | ImageHeight = 0
  140. | | | - Tag 0x0014 (4 bytes, int32u[1]):
  141. | | | 00f0: 00 00 00 00 [....]
  142. | | Unknown_edts = .elst...I.
  143. | | - Tag 'edts' (28 bytes):
  144. | | 00fc: 00 00 00 1c 65 6c 73 74 00 00 00 00 00 00 00 01 [....elst........]
  145. | | 010c: 00 0f f8 49 00 00 00 00 00 01 00 00 [...I........]
  146. | | Media (SubDirectory) -->
  147. | | - Tag 'mdia' (14573 bytes):
  148. | | 0120: 00 00 00 20 6d 64 68 64 00 00 00 00 df 1e 02 e4 [... mdhd........]
  149. | | 0130: df 1e 02 e8 00 00 bb 80 00 2f e8 e0 55 c4 00 00 [........./..U...]
  150. | | 0140: 00 00 00 31 68 64 6c 72 00 00 00 00 00 00 00 00 [...1hdlr........]
  151. | | 0150: 73 6f 75 6e 00 00 00 00 00 00 00 00 00 00 00 00 [soun............]
  152. | | 0160: 43 6f 72 65 20 4d 65 64 69 61 20 41 75 64 69 6f [Core Media Audio]
  153. | | [snip 14493 bytes]
  154. | | + [Media directory]
  155. | | | MediaHeader (SubDirectory) -->
  156. | | | - Tag 'mdhd' (24 bytes):
  157. | | | 0128: 00 00 00 00 df 1e 02 e4 df 1e 02 e8 00 00 bb 80 [................]
  158. | | | 0138: 00 2f e8 e0 55 c4 00 00 [./..U...]
  159. | | | + [BinaryData directory, 24 bytes]
  160. | | | | MediaHeaderVersion = 0
  161. | | | | - Tag 0x0000 (4 bytes, int32u[1]):
  162. | | | | 0128: 00 00 00 00 [....]
  163. | | | | MediaCreateDate = 3743285988
  164. | | | | - Tag 0x0001 (4 bytes, int32u[1]):
  165. | | | | 012c: df 1e 02 e4 [....]
  166. | | | | MediaModifyDate = 3743285992
  167. | | | | - Tag 0x0002 (4 bytes, int32u[1]):
  168. | | | | 0130: df 1e 02 e8 [....]
  169. | | | | MediaTimeScale = 48000
  170. | | | | - Tag 0x0003 (4 bytes, int32u[1]):
  171. | | | | 0134: 00 00 bb 80 [....]
  172. | | | | MediaDuration = 3139808
  173. | | | | - Tag 0x0004 (4 bytes, int32u[1]):
  174. | | | | 0138: 00 2f e8 e0 [./..]
  175. | | | | MediaLanguageCode = 21956
  176. | | | | - Tag 0x0005 (2 bytes, int16u[1]):
  177. | | | | 013c: 55 c4 [U.]
  178. | | | Handler (SubDirectory) -->
  179. | | | - Tag 'hdlr' (41 bytes):
  180. | | | 0148: 00 00 00 00 00 00 00 00 73 6f 75 6e 00 00 00 00 [........soun....]
  181. | | | 0158: 00 00 00 00 00 00 00 00 43 6f 72 65 20 4d 65 64 [........Core Med]
  182. | | | 0168: 69 61 20 41 75 64 69 6f 00 [ia Audio.]
  183. | | | + [BinaryData directory, 41 bytes]
  184. | | | | HandlerClass =
  185. | | | | - Tag 0x0004 (4 bytes, undef[4]):
  186. | | | | 014c: 00 00 00 00 [....]
  187. | | | | HandlerType = soun
  188. | | | | - Tag 0x0008 (4 bytes, undef[4]):
  189. | | | | 0150: 73 6f 75 6e [soun]
  190. | | | | HandlerVendorID =
  191. | | | | - Tag 0x000c (4 bytes, undef[4]):
  192. | | | | 0154: 00 00 00 00 [....]
  193. | | | | HandlerDescription = Core Media Audio
  194. | | | | - Tag 0x0018 (17 bytes, string[17]):
  195. | | | | 0160: 43 6f 72 65 20 4d 65 64 69 61 20 41 75 64 69 6f [Core Media Audio]
  196. | | | | 0170: 00 [.]
  197. | | | MediaInfo (SubDirectory) -->
  198. | | | - Tag 'minf' (14484 bytes):
  199. | | | 0179: 00 00 00 10 73 6d 68 64 00 00 00 00 00 00 00 00 [....smhd........]
  200. | | | 0189: 00 00 00 24 64 69 6e 66 00 00 00 1c 64 72 65 66 [...$dinf....dref]
  201. | | | 0199: 00 00 00 00 00 00 00 01 00 00 00 0c 75 72 6c 20 [............url ]
  202. | | | 01a9: 00 00 00 01 00 00 38 60 73 74 62 6c 00 00 00 6a [......8`stbl...j]
  203. | | | 01b9: 73 74 73 64 00 00 00 00 00 00 00 01 00 00 00 5a [stsd...........Z]
  204. | | | [snip 14404 bytes]
  205. | | | + [MediaInfo directory]
  206. | | | | AudioHeader (SubDirectory) -->
  207. | | | | - Tag 'smhd' (8 bytes):
  208. | | | | 0181: 00 00 00 00 00 00 00 00 [........]
  209. | | | | + [BinaryData directory, 8 bytes]
  210. | | | | | Balance = 0
  211. | | | | | - Tag 0x0002 (2 bytes, fixed16s[1]):
  212. | | | | | 0185: 00 00 [..]
  213. | | | | DataInfo (SubDirectory) -->
  214. | | | | - Tag 'dinf' (28 bytes):
  215. | | | | 0191: 00 00 00 1c 64 72 65 66 00 00 00 00 00 00 00 01 [....dref........]
  216. | | | | 01a1: 00 00 00 0c 75 72 6c 20 00 00 00 01 [....url ....]
  217. | | | | + [DataInfo directory]
  218. | | | | | DataRef (SubDirectory) -->
  219. | | | | | - Tag 'dref' (20 bytes):
  220. | | | | | 0199: 00 00 00 00 00 00 00 01 00 00 00 0c 75 72 6c 20 [............url ]
  221. | | | | | 01a9: 00 00 00 01 [....]
  222. | | | | | + [DataRef directory]
  223. | | | | | | URL = .
  224. | | | | | | - Tag 'url ' (4 bytes, undef):
  225. | | | | | | 01a9: 00 00 00 01 [....]
  226. | | | | SampleTable (SubDirectory) -->
  227. | | | | - Tag 'stbl' (14424 bytes):
  228. | | | | 01b5: 00 00 00 6a 73 74 73 64 00 00 00 00 00 00 00 01 [...jstsd........]
  229. | | | | 01c5: 00 00 00 5a 6d 70 34 61 00 00 00 00 00 00 00 01 [...Zmp4a........]
  230. | | | | 01d5: 00 00 00 00 00 00 00 00 00 02 00 10 00 00 00 00 [................]
  231. | | | | 01e5: bb 80 00 00 00 00 00 36 65 73 64 73 00 00 00 00 [.......6esds....]
  232. | | | | 01f5: 03 80 80 80 25 00 02 00 04 80 80 80 17 40 15 00 [....%........@..]
  233. | | | | [snip 14344 bytes]
  234. | | | | + [SampleTable directory]
  235. | | | | | AudioSampleDesc (SubDirectory) -->
  236. | | | | | - Tag 'stsd' (98 bytes):
  237. | | | | | 01bd: 00 00 00 00 00 00 00 01 00 00 00 5a 6d 70 34 61 [...........Zmp4a]
  238. | | | | | 01cd: 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 00 [................]
  239. | | | | | 01dd: 00 02 00 10 00 00 00 00 bb 80 00 00 00 00 00 36 [...............6]
  240. | | | | | 01ed: 65 73 64 73 00 00 00 00 03 80 80 80 25 00 02 00 [esds........%...]
  241. | | | | | 01fd: 04 80 80 80 17 40 15 00 00 00 00 00 e6 c4 00 00 [.....@..........]
  242. | | | | | [snip 18 bytes]
  243. | | | | | + [BinaryData directory, 44 bytes]
  244. | | | | | | AudioFormat = mp4a
  245. | | | | | | - Tag 0x0004 (4 bytes, undef[4]):
  246. | | | | | | 01c9: 6d 70 34 61 [mp4a]
  247. | | | | | | AudioVendorID =
  248. | | | | | | - Tag 0x0014 (4 bytes, undef[4]):
  249. | | | | | | 01d9: 00 00 00 00 [....]
  250. | | | | | | AudioChannels = 2
  251. | | | | | | - Tag 0x0018 (2 bytes, int16u[1]):
  252. | | | | | | 01dd: 00 02 [..]
  253. | | | | | | AudioBitsPerSample = 16
  254. | | | | | | - Tag 0x001a (2 bytes, int16u[1]):
  255. | | | | | | 01df: 00 10 [..]
  256. | | | | | | AudioSampleRate = 48000
  257. | | | | | | - Tag 0x0020 (4 bytes, fixed32u[1]):
  258. | | | | | | 01e5: bb 80 00 00 [....]
  259. | | | | | + [AudioSampleDesc directory]
  260. | | | | | | Unknown_esds = ....%[email protected].......
  261. | | | | | | - Tag 'esds' (46 bytes):
  262. | | | | | | 01f1: 00 00 00 00 03 80 80 80 25 00 02 00 04 80 80 80 [........%.......]
  263. | | | | | | 0201: 17 40 15 00 00 00 00 00 e6 c4 00 00 e6 c4 05 80 [.@..............]
  264. | | | | | | 0211: 80 80 05 11 88 56 e5 00 06 80 80 80 01 02 [.....V........]
  265. | | | | | SampleGroupDescription = .roll....
  266. | | | | | - Tag 'sgpd' (18 bytes):
  267. | | | | | 0227: 01 00 00 00 72 6f 6c 6c 00 00 00 02 00 00 00 01 [....roll........]
  268. | | | | | 0237: ff ff [..]
  269. | | | | | SampleToGroup = roll....
  270. | | | | | - Tag 'sbgp' (20 bytes):
  271. | | | | | 0241: 00 00 00 00 72 6f 6c 6c 00 00 00 01 00 00 0b f9 [....roll........]
  272. | | | | | 0251: 00 00 00 01 [....]
  273. | | | | | TimeToSampleTable = .................
  274. | | | | | - Tag 'stts' (56 bytes):
  275. | | | | | 025d: 00 00 00 00 00 00 00 06 00 00 00 01 00 00 04 00 [................]
  276. | | | | | 026d: 00 00 00 01 00 00 03 f8 00 00 00 f2 00 00 04 00 [................]
  277. | | | | | 027d: 00 00 00 01 00 00 08 f8 00 00 0b 03 00 00 04 00 [................]
  278. | | | | | 028d: 00 00 00 01 00 00 03 f0 [........]
  279. | | | | | SampleToChunk = r..........................................................[snip]
  280. | | | | | - Tag 'stsc' (1376 bytes):
  281. | | | | | 029d: 00 00 00 00 00 00 00 72 00 00 00 01 00 00 00 2e [.......r........]
  282. | | | | | 02ad: 00 00 00 01 00 00 00 03 00 00 00 02 00 00 00 01 [................]
  283. | | | | | 02bd: 00 00 00 04 00 00 00 18 00 00 00 01 00 00 00 05 [................]
  284. | | | | | 02cd: 00 00 00 17 00 00 00 01 00 00 00 06 00 00 00 18 [................]
  285. | | | | | 02dd: 00 00 00 01 00 00 00 07 00 00 00 17 00 00 00 01 [................]
  286. | | | | | [snip 1296 bytes]
  287. | | | | | SampleSizes = ..eofYZd\\jFYW`QZbUPVXZ......'.UJFd.....{sbni_^@ZV.tD.7z.X.<S[snip]
  288. | | | | | - Tag 'stsz' (12272 bytes):
  289. | | | | | 0805: 00 00 00 00 00 00 00 00 00 00 0b f9 00 00 00 65 [...............e]
  290. | | | | | 0815: 00 00 00 6f 00 00 00 66 00 00 00 59 00 00 00 5a [...o...f...Y...Z]
  291. | | | | | 0825: 00 00 00 64 00 00 00 5c 00 00 00 5c 00 00 00 6a [...d...\...\...j]
  292. | | | | | 0835: 00 00 00 46 00 00 00 59 00 00 00 57 00 00 00 60 [...F...Y...W...`]
  293. | | | | | 0845: 00 00 00 51 00 00 00 5a 00 00 00 62 00 00 00 55 [...Q...Z...b...U]
  294. | | | | | [snip 12192 bytes]
  295. | | | | | ChunkOffset = ..,.6...r.}..~.../.......du..........U..e&..!..*.!...o.......[snip]
  296. | | | | | - Tag 'stco' (528 bytes):
  297. | | | | | 37fd: 00 00 00 00 00 00 00 82 00 00 81 2c 00 00 8f 36 [...........,...6]
  298. | | | | | 380d: 00 00 9f 1f 00 00 f6 72 00 01 7d 88 00 02 7e 1b [.......r..}...~.]
  299. | | | | | 381d: 00 03 a8 2f 00 04 e4 a5 00 06 bb 19 00 08 64 75 [.../..........du]
  300. | | | | | 382d: 00 09 f1 19 00 0b 87 04 00 0d f3 c8 00 11 55 94 [..............U.]
  301. | | | | | 383d: 00 13 65 26 00 14 f7 21 00 16 aa 2a 00 18 21 06 [..e&...!...*..!.]
  302. | | | | | [snip 448 bytes]
  303. | Track (SubDirectory) -->
  304. | - Tag 'trak' (18142 bytes):
  305. | 3a15: 00 00 00 5c 74 6b 68 64 00 00 00 01 df 1e 02 e4 [...\tkhd........]
  306. | 3a25: df 1e 02 e8 00 00 00 02 00 00 00 00 00 0f f8 49 [...............I]
  307. | 3a35: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [................]
  308. | 3a45: 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [................]
  309. | 3a55: 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [................]
  310. | [snip 18062 bytes]
  311. | + [Track directory]
  312. | | TrackHeader (SubDirectory) -->
  313. | | - Tag 'tkhd' (84 bytes):
  314. | | 3a1d: 00 00 00 01 df 1e 02 e4 df 1e 02 e8 00 00 00 02 [................]
  315. | | 3a2d: 00 00 00 00 00 0f f8 49 00 00 00 00 00 00 00 00 [.......I........]
  316. | | 3a3d: 00 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 [................]
  317. | | 3a4d: 00 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 [................]
  318. | | 3a5d: 00 00 00 00 00 00 00 00 40 00 00 00 03 c0 00 00 [........@.......]
  319. | | 3a6d: 02 20 00 00 [. ..]
  320. | | + [BinaryData directory, 84 bytes]
  321. | | | TrackHeaderVersion = 0
  322. | | | - Tag 0x0000 (1 bytes, int8u[1]):
  323. | | | 3a1d: 00 [.]
  324. | | | TrackCreateDate = 3743285988
  325. | | | - Tag 0x0001 (4 bytes, int32u[1]):
  326. | | | 3a21: df 1e 02 e4 [....]
  327. | | | TrackModifyDate = 3743285992
  328. | | | - Tag 0x0002 (4 bytes, int32u[1]):
  329. | | | 3a25: df 1e 02 e8 [....]
  330. | | | TrackID = 2
  331. | | | - Tag 0x0003 (4 bytes, int32u[1]):
  332. | | | 3a29: 00 00 00 02 [....]
  333. | | | TrackDuration = 1046601
  334. | | | - Tag 0x0005 (4 bytes, int32u[1]):
  335. | | | 3a31: 00 0f f8 49 [...I]
  336. | | | TrackLayer = 0
  337. | | | - Tag 0x0008 (2 bytes, int16u[1]):
  338. | | | 3a3d: 00 00 [..]
  339. | | | TrackVolume = 0
  340. | | | - Tag 0x0009 (2 bytes, int16u[1]):
  341. | | | 3a41: 00 00 [..]
  342. | | | MatrixStructure = 1 0 0 0 1 0 0 0 16384
  343. | | | - Tag 0x000a (36 bytes, fixed32s[9]):
  344. | | | 3a45: 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [................]
  345. | | | 3a55: 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [................]
  346. | | | 3a65: 40 00 00 00 [@...]
  347. | | | ImageWidth = 62914560
  348. | | | - Tag 0x0013 (4 bytes, int32u[1]):
  349. | | | 3a69: 03 c0 00 00 [....]
  350. | | | ImageHeight = 35651584
  351. | | | - Tag 0x0014 (4 bytes, int32u[1]):
  352. | | | 3a6d: 02 20 00 00 [. ..]
  353. | | Unknown_edts = .elst...I. .
  354. | | - Tag 'edts' (28 bytes):
  355. | | 3a79: 00 00 00 1c 65 6c 73 74 00 00 00 00 00 00 00 01 [....elst........]
  356. | | 3a89: 00 0f f8 49 00 00 03 20 00 01 00 00 [...I... ....]
  357. | | Media (SubDirectory) -->
  358. | | - Tag 'mdia' (18006 bytes):
  359. | | 3a9d: 00 00 00 20 6d 64 68 64 00 00 00 00 df 1e 02 e4 [... mdhd........]
  360. | | 3aad: df 1e 02 e8 00 00 3e 80 00 0f f8 49 55 c4 00 00 [......>....IU...]
  361. | | 3abd: 00 00 00 31 68 64 6c 72 00 00 00 00 00 00 00 00 [...1hdlr........]
  362. | | 3acd: 76 69 64 65 00 00 00 00 00 00 00 00 00 00 00 00 [vide............]
  363. | | 3add: 43 6f 72 65 20 4d 65 64 69 61 20 56 69 64 65 6f [Core Media Video]
  364. | | [snip 17926 bytes]
  365. | | + [Media directory]
  366. | | | MediaHeader (SubDirectory) -->
  367. | | | - Tag 'mdhd' (24 bytes):
  368. | | | 3aa5: 00 00 00 00 df 1e 02 e4 df 1e 02 e8 00 00 3e 80 [..............>.]
  369. | | | 3ab5: 00 0f f8 49 55 c4 00 00 [...IU...]
  370. | | | + [BinaryData directory, 24 bytes]
  371. | | | | MediaHeaderVersion = 0
  372. | | | | - Tag 0x0000 (4 bytes, int32u[1]):
  373. | | | | 3aa5: 00 00 00 00 [....]
  374. | | | | MediaCreateDate = 3743285988
  375. | | | | - Tag 0x0001 (4 bytes, int32u[1]):
  376. | | | | 3aa9: df 1e 02 e4 [....]
  377. | | | | MediaModifyDate = 3743285992
  378. | | | | - Tag 0x0002 (4 bytes, int32u[1]):
  379. | | | | 3aad: df 1e 02 e8 [....]
  380. | | | | MediaTimeScale = 16000
  381. | | | | - Tag 0x0003 (4 bytes, int32u[1]):
  382. | | | | 3ab1: 00 00 3e 80 [..>.]
  383. | | | | MediaDuration = 1046601
  384. | | | | - Tag 0x0004 (4 bytes, int32u[1]):
  385. | | | | 3ab5: 00 0f f8 49 [...I]
  386. | | | | MediaLanguageCode = 21956
  387. | | | | - Tag 0x0005 (2 bytes, int16u[1]):
  388. | | | | 3ab9: 55 c4 [U.]
  389. | | | Handler (SubDirectory) -->
  390. | | | - Tag 'hdlr' (41 bytes):
  391. | | | 3ac5: 00 00 00 00 00 00 00 00 76 69 64 65 00 00 00 00 [........vide....]
  392. | | | 3ad5: 00 00 00 00 00 00 00 00 43 6f 72 65 20 4d 65 64 [........Core Med]
  393. | | | 3ae5: 69 61 20 56 69 64 65 6f 00 [ia Video.]
  394. | | | + [BinaryData directory, 41 bytes]
  395. | | | | HandlerClass =
  396. | | | | - Tag 0x0004 (4 bytes, undef[4]):
  397. | | | | 3ac9: 00 00 00 00 [....]
  398. | | | | HandlerType = vide
  399. | | | | - Tag 0x0008 (4 bytes, undef[4]):
  400. | | | | 3acd: 76 69 64 65 [vide]
  401. | | | | HandlerVendorID =
  402. | | | | - Tag 0x000c (4 bytes, undef[4]):
  403. | | | | 3ad1: 00 00 00 00 [....]
  404. | | | | HandlerDescription = Core Media Video
  405. | | | | - Tag 0x0018 (17 bytes, string[17]):
  406. | | | | 3add: 43 6f 72 65 20 4d 65 64 69 61 20 56 69 64 65 6f [Core Media Video]
  407. | | | | 3aed: 00 [.]
  408. | | | MediaInfo (SubDirectory) -->
  409. | | | - Tag 'minf' (17917 bytes):
  410. | | | 3af6: 00 00 00 14 76 6d 68 64 00 00 00 01 00 00 00 00 [....vmhd........]
  411. | | | 3b06: 00 00 00 00 00 00 00 24 64 69 6e 66 00 00 00 1c [.......$dinf....]
  412. | | | 3b16: 64 72 65 66 00 00 00 00 00 00 00 01 00 00 00 0c [dref............]
  413. | | | 3b26: 75 72 6c 20 00 00 00 01 00 00 45 c5 73 74 62 6c [url ......E.stbl]
  414. | | | 3b36: 00 00 00 a3 73 74 73 64 00 00 00 00 00 00 00 01 [....stsd........]
  415. | | | [snip 17837 bytes]
  416. | | | + [MediaInfo directory]
  417. | | | | VideoHeader (SubDirectory) -->
  418. | | | | - Tag 'vmhd' (12 bytes):
  419. | | | | 3afe: 00 00 00 01 00 00 00 00 00 00 00 00 [............]
  420. | | | | + [BinaryData directory, 12 bytes]
  421. | | | | | GraphicsMode = 0
  422. | | | | | - Tag 0x0002 (2 bytes, int16u[1]):
  423. | | | | | 3b02: 00 00 [..]
  424. | | | | | OpColor = 0 0 0
  425. | | | | | - Tag 0x0003 (6 bytes, int16u[3]):
  426. | | | | | 3b04: 00 00 00 00 00 00 [......]
  427. | | | | DataInfo (SubDirectory) -->
  428. | | | | - Tag 'dinf' (28 bytes):
  429. | | | | 3b12: 00 00 00 1c 64 72 65 66 00 00 00 00 00 00 00 01 [....dref........]
  430. | | | | 3b22: 00 00 00 0c 75 72 6c 20 00 00 00 01 [....url ....]
  431. | | | | + [DataInfo directory]
  432. | | | | | DataRef (SubDirectory) -->
  433. | | | | | - Tag 'dref' (20 bytes):
  434. | | | | | 3b1a: 00 00 00 00 00 00 00 01 00 00 00 0c 75 72 6c 20 [............url ]
  435. | | | | | 3b2a: 00 00 00 01 [....]
  436. | | | | | + [DataRef directory]
  437. | | | | | | URL = .
  438. | | | | | | - Tag 'url ' (4 bytes, undef):
  439. | | | | | | 3b2a: 00 00 00 01 [....]
  440. | | | | SampleTable (SubDirectory) -->
  441. | | | | - Tag 'stbl' (17853 bytes):
  442. | | | | 3b36: 00 00 00 a3 73 74 73 64 00 00 00 00 00 00 00 01 [....stsd........]
  443. | | | | 3b46: 00 00 00 93 61 76 63 31 00 00 00 00 00 00 00 01 [....avc1........]
  444. | | | | 3b56: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [................]
  445. | | | | 3b66: 03 c0 02 20 00 48 00 00 00 48 00 00 00 00 00 00 [... .H...H......]
  446. | | | | 3b76: 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [................]
  447. | | | | [snip 17773 bytes]
  448. | | | | + [SampleTable directory]
  449. | | | | | VideoSampleDesc (SubDirectory) -->
  450. | | | | | - Tag 'stsd' (155 bytes):
  451. | | | | | 3b3e: 00 00 00 00 00 00 00 01 00 00 00 93 61 76 63 31 [............avc1]
  452. | | | | | 3b4e: 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 00 [................]
  453. | | | | | 3b5e: 00 00 00 00 00 00 00 00 03 c0 02 20 00 48 00 00 [........... .H..]
  454. | | | | | 3b6e: 00 48 00 00 00 00 00 00 00 01 00 00 00 00 00 00 [.H..............]
  455. | | | | | 3b7e: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [................]
  456. | | | | | [snip 75 bytes]
  457. | | | | | + [BinaryData directory, 94 bytes]
  458. | | | | | | CompressorID = avc1
  459. | | | | | | - Tag 0x0002 (4 bytes, string[4]):
  460. | | | | | | 3b4a: 61 76 63 31 [avc1]
  461. | | | | | | VendorID =
  462. | | | | | | - Tag 0x000a (4 bytes, string[4]):
  463. | | | | | | 3b5a: 00 00 00 00 [....]
  464. | | | | | | SourceImageWidth = 960
  465. | | | | | | - Tag 0x0010 (2 bytes, int16u[1]):
  466. | | | | | | 3b66: 03 c0 [..]
  467. | | | | | | SourceImageHeight = 544
  468. | | | | | | - Tag 0x0011 (2 bytes, int16u[1]):
  469. | | | | | | 3b68: 02 20 [. ]
  470. | | | | | | XResolution = 72
  471. | | | | | | - Tag 0x0012 (4 bytes, fixed32u[1]):
  472. | | | | | | 3b6a: 00 48 00 00 [.H..]
  473. | | | | | | YResolution = 72
  474. | | | | | | - Tag 0x0014 (4 bytes, fixed32u[1]):
  475. | | | | | | 3b6e: 00 48 00 00 [.H..]
  476. | | | | | | CompressorName =
  477. | | | | | | - Tag 0x0019 (32 bytes, string[32]):
  478. | | | | | | 3b78: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [................]
  479. | | | | | | 3b88: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [................]
  480. | | | | | | BitDepth = 24
  481. | | | | | | - Tag 0x0029 (2 bytes, int16u[1]):
  482. | | | | | | 3b98: 00 18 [..]
  483. | | | | | + [VideoSampleDesc directory]
  484. | | | | | | AVCConfiguration = .d....'d..V...i.......(.<....
  485. | | | | | | - Tag 'avcC' (34 bytes):
  486. | | | | | | 3ba4: 01 64 00 1f ff e1 00 0f 27 64 00 1f ac 56 c0 f0 [.d......'d...V..]
  487. | | | | | | 3bb4: 11 69 a8 08 08 08 10 01 00 04 28 ee 3c b0 fd f8 [.i........(.<...]
  488. | | | | | | 3bc4: f8 00 [..]
  489. | | | | | | ColorRepresentation (SubDirectory) -->
  490. | | | | | | - Tag 'colr' (11 bytes):
  491. | | | | | | 3bce: 6e 63 6c 78 00 01 00 01 00 01 00 [nclx.......]
  492. | | | | | | + [BinaryData directory, 11 bytes]
  493. | | | | | | | ColorProfiles = nclx
  494. | | | | | | | - Tag 0x0000 (4 bytes, undef[4]):
  495. | | | | | | | 3bce: 6e 63 6c 78 [nclx]
  496. | | | | | | | ColorPrimaries = 1
  497. | | | | | | | - Tag 0x0004 (2 bytes, int16u[1]):
  498. | | | | | | | 3bd2: 00 01 [..]
  499. | | | | | | | TransferCharacteristics = 1
  500. | | | | | | | - Tag 0x0006 (2 bytes, int16u[1]):
  501. | | | | | | | 3bd4: 00 01 [..]
  502. | | | | | | | MatrixCoefficients = 1
  503. | | | | | | | - Tag 0x0008 (2 bytes, int16u[1]):
  504. | | | | | | | 3bd6: 00 01 [..]
  505. | | | | | | | VideoFullRangeFlag = 0
  506. | | | | | | | - Tag 0x000a, mask 0x80 (1 bytes, int8u[1]):
  507. | | | | | | | 3bd8: 00 [.]
  508. | | | | | VideoFrameRate = ..0.@. ..0...... .(..8. ..0...U. ..0...&. ...
  509. | | | | | - Tag 'stts' (120 bytes, undef):
  510. | | | | | 3be1: 00 00 00 00 00 00 00 0e 00 00 00 01 00 00 00 30 [...............0]
  511. | | | | | 3bf1: 00 00 01 40 00 00 03 20 00 00 00 01 00 00 03 30 [...@... .......0]
  512. | | | | | 3c01: 00 00 00 01 00 00 03 10 00 00 02 12 00 00 03 20 [............... ]
  513. | | | | | 3c11: 00 00 00 01 00 00 28 a0 00 00 01 38 00 00 03 20 [......(....8... ]
  514. | | | | | 3c21: 00 00 00 01 00 00 03 30 00 00 00 01 00 00 03 10 [.......0........]
  515. | | | | | [snip 40 bytes]
  516. | | | | | CompositionTimeToSample = .... ..@...@...@... ..@...@...@...@...@...@...@..[snip]
  517. | | | | | - Tag 'ctts' (10344 bytes):
  518. | | | | | 3c61: 00 00 00 00 00 00 05 0c 00 00 00 01 00 00 03 20 [............... ]
  519. | | | | | 3c71: 00 00 00 01 00 00 06 40 00 00 00 01 00 00 00 00 [.......@........]
  520. | | | | | 3c81: 00 00 00 01 00 00 06 40 00 00 00 01 00 00 00 00 [.......@........]
  521. | | | | | 3c91: 00 00 00 01 00 00 06 40 00 00 00 01 00 00 00 00 [.......@........]
  522. | | | | | 3ca1: 00 00 00 02 00 00 03 20 00 00 00 01 00 00 06 40 [....... .......@]
  523. | | | | | [snip 10264 bytes]
  524. | | | | | SyncSampleTable = ..\....i.....x...,.....9....
  525. | | | | | - Tag 'stss' (68 bytes):
  526. | | | | | 64d1: 00 00 00 00 00 00 00 0f 00 00 00 01 00 00 00 5c [...............\]
  527. | | | | | 64e1: 00 00 00 b5 00 00 01 10 00 00 01 69 00 00 01 c4 [...........i....]
  528. | | | | | 64f1: 00 00 02 1d 00 00 02 78 00 00 02 d1 00 00 03 2c [.......x.......,]
  529. | | | | | 6501: 00 00 03 85 00 00 03 e0 00 00 04 39 00 00 04 94 [...........9....]
  530. | | | | | 6511: 00 00 04 ed [....]
  531. | | | | | IdependentAndDisposableSamples = .........................................[snip]
  532. | | | | | - Tag 'sdtp' (1298 bytes):
  533. | | | | | 651d: 00 00 00 00 20 10 18 10 18 10 18 10 10 10 18 10 [.... ...........]
  534. | | | | | 652d: 18 10 18 10 18 10 18 10 18 10 18 10 18 10 18 10 [................]
  535. | | | | | 653d: 18 10 18 10 18 10 18 10 18 10 18 10 18 10 18 10 [................]
  536. | | | | | 654d: 18 10 18 10 18 10 18 10 18 10 18 10 18 10 18 10 [................]
  537. | | | | | 655d: 18 10 18 10 18 10 18 10 18 10 18 10 18 10 18 10 [................]
  538. | | | | | [snip 1218 bytes]
  539. | | | | | SampleToChunk = .......V..W..X........
  540. | | | | | - Tag 'stsc' (92 bytes):
  541. | | | | | 6a37: 00 00 00 00 00 00 00 07 00 00 00 01 00 00 00 0b [................]
  542. | | | | | 6a47: 00 00 00 01 00 00 00 02 00 00 00 0a 00 00 00 01 [................]
  543. | | | | | 6a57: 00 00 00 56 00 00 00 03 00 00 00 01 00 00 00 57 [...V...........W]
  544. | | | | | 6a67: 00 00 00 05 00 00 00 01 00 00 00 58 00 00 00 0a [...........X....]
  545. | | | | | 6a77: 00 00 00 01 00 00 00 80 00 00 00 14 00 00 00 01 [................]
  546. | | | | | 6a87: 00 00 00 81 00 00 00 0f 00 00 00 01 [............]
  547. | | | | | SampleSizes = ...@!...G.sc.....d......h.........{ ..5 .......'...,l.:K...1G[snip]
  548. | | | | | - Tag 'stsz' (5188 bytes):
  549. | | | | | 6a9b: 00 00 00 00 00 00 00 00 00 00 05 0e 00 00 00 af [................]
  550. | | | | | 6aab: 00 00 40 21 00 00 00 dc 00 00 01 ab 00 00 00 47 [..@!...........G]
  551. | | | | | 6abb: 00 00 04 73 00 00 00 63 00 00 01 cf 00 00 03 04 [...s...c........]
  552. | | | | | 6acb: 00 00 08 64 00 00 00 ff 00 00 09 7f 00 00 01 1a [...d............]
  553. | | | | | 6adb: 00 00 13 68 00 00 02 15 00 00 12 d9 00 00 01 f8 [...h............]
  554. | | | | | [snip 5108 bytes]
  555. | | | | | ChunkOffset = ................"..L.p..s.......dM.s......../.....%G....>....[snip]
  556. | | | | | - Tag 'stco' (524 bytes):
  557. | | | | | 7ee7: 00 00 00 00 00 00 00 81 00 00 9f c8 00 00 fb 98 [................]
  558. | | | | | 7ef7: 00 01 85 05 00 02 85 19 00 03 b3 1f 00 04 ed 22 [..............."]
  559. | | | | | 7f07: 00 06 c5 4c 00 08 70 de 00 0a 00 73 00 0b 95 d8 [...L..p....s....]
  560. | | | | | 7f17: 00 0e 03 0a 00 11 64 4d 00 13 73 fe 00 15 06 9a [......dM..s.....]
  561. | | | | | 7f27: 00 16 b8 e6 00 18 2f f0 00 19 a7 ff 00 1b 25 47 [....../.......%G]
  562. | | | | | [snip 444 bytes]
  563. | UserData (SubDirectory) -->
  564. | - Tag 'udta' (33 bytes):
  565. | 80fb: 00 00 00 21 64 61 74 65 32 30 32 32 2d 30 36 2d [...!date2022-06-]
  566. | 810b: 32 36 54 32 31 3a 31 35 3a 35 37 2d 30 34 3a 30 [26T21:15:57-04:0]
  567. | 811b: 30 [0]
  568. | + [UserData directory]
  569. | | DateTimeOriginal = 2022-06-26T21:15:57-04:00
  570. | | - Tag 'date' (25 bytes):
  571. | | 8103: 32 30 32 32 2d 30 36 2d 32 36 54 32 31 3a 31 35 [2022-06-26T21:15]
  572. | | 8113: 3a 35 37 2d 30 34 3a 30 30 [:57-04:00]
  573. MediaDataSize = 13377310
  574. MediaDataOffset = 33068
  575. MediaData = ..Lavc58.91.100.L.2.....D.....V*.v..-;..L.T...+.a.G9MP...y....Y3 NQ.3.~..[snip]
  576. - Tag 'mdat' (13377310 bytes):
  577. 812c: de 02 00 4c 61 76 63 35 38 2e 39 31 2e 31 30 30 [...Lavc58.91.100]
  578. 813c: 00 02 4c a0 32 c5 da 11 1d 07 44 c0 00 00 0f 91 [..L.2.....D.....]
  579. 814c: ff 97 56 2a f6 76 ff ef 2d 3b b8 f4 4c ce 54 14 [..V*.v..-;..L.T.]
  580. 815c: 19 ec 2b 14 61 f9 47 39 4d 50 d5 99 9e 79 df 94 [..+.a.G9MP...y..]
  581. 816c: c1 9d 59 33 20 4e 51 13 33 f0 7e 1f 94 73 85 45 [..Y3 NQ.3.~..s.E]
  582. [snip 13377230 bytes]
  583.  
  584. BREAKDOWN:
  585. Non-standard ftyp Major Brand
  586. What it is: The ftyp box declares the file’s brand and lists which standards it claims to follow.
  587. Observed:
  588.  
  589. ini
  590. Copy
  591. MajorBrand = mp42
  592. CompatibleBrands = isommp41mp42
  593. Why it matters: Ring camera exports normally use isom or avc1. Seeing mp42 means a generic tool repackaged the file, breaking the original device’s chain of custody.
  594.  
  595. Bogus Movie-Header Timestamps
  596. What it is: In the moov.mvhd atom, the creation_time and modification_time fields record when the movie was created and last changed (as 32-bit UNIX timestamps).
  597. Observed:
  598.  
  599. ini
  600. Copy
  601. CreateDate = 3743285988 (≈ Fri Jul 21 01:06:28 UTC 2089)
  602. ModifyDate = 3743285992 (≈ Fri Jul 21 01:06:32 UTC 2089)
  603. Why it matters: A video recorded in August 2022 cannot carry timestamps in 2089. These future dates prove the container was edited or regenerated after capture.
  604.  
  605. Zeroed Track Dimensions (First Video Track)
  606. What it is: The tkhd atom holds each track’s intended display width and height.
  607. Observed:
  608.  
  609. ini
  610. Copy
  611. ImageWidth = 0
  612. ImageHeight = 0
  613. Why it matters: No legitimate camera export would erase its own resolution. Zero dimensions show the track header was overwritten or stripped, indicating tampering.
  614.  
  615. Garbage Track Dimensions (Second Video Track)
  616. What it is: Some MP4s list multiple tracks; here a second tkhd exists with nonsensical values.
  617. Observed:
  618.  
  619. ini
  620. Copy
  621. ImageWidth = 62914560
  622. ImageHeight = 35651584
  623. Why it matters: These absurd numbers aren’t real pixel dimensions—they’re bit-errors or uninitialized data, clear evidence of file corruption or manual editing.
  624.  
  625. Floating-Point File Timestamps
  626. What it is: Filesystem timestamps (FileModifyDate, FileAccessDate, FileCreateDate) normally record whole-second UNIX time.
  627. Observed:
  628.  
  629. ini
  630. Copy
  631. FileModifyDate = 1748430236.73652
  632. FileAccessDate = 1748452681.31226
  633. FileCreateDate = 1748443742.17326
  634. Why it matters: The fractional seconds and anomalous epoch values (yielding dates in 2026) indicate the file was copied or manipulated on another system before delivery, not straight from the camera.
  635.  
  636. Mismatched UserData Date
  637. What it is: The udta.date field often holds the camera’s original capture timestamp.
  638. Observed:
  639.  
  640. ini
  641. Copy
  642. DateTimeOriginal = 2022-06-26T21:15:57-04:00
  643. Why it matters: This June 26 date conflicts with the H.264 header’s creation_time of August 14 2022, proving that metadata was likely edited or grafted in from another source.
  644.  
  645.  
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement