Container Atom / Box
Definition
The structural metadata units inside video container formats (MP4, MOV, MKV). Atoms such as mvhd (movie header) carry creation and modification timestamps; udta atoms can carry copyright and location data. These are independent of any embedded EXIF or XMP and can differ from them if a file was re-muxed.
- Field
- EXIF and container metadata forensics
- Applies to formats
- MP4, MOV, MKV
- Example atom
- mvhd carries movie creation/modification timestamps
- Other atom
- udta can carry copyright and location data
- Independence
- Separate from embedded EXIF/XMP, can diverge after re-mux
Common questions
Why would container atom timestamps disagree with a file's EXIF metadata?+
EXIF or XMP metadata is typically written by the capturing device at recording time and embedded in the media stream, while container atoms like mvhd are written or rewritten whenever the file is muxed or remuxed by editing software, a messaging app, or a conversion tool. A mismatch between the two is itself forensically useful, since it can indicate the file passed through additional processing after capture.
Can container atom metadata be edited without leaving a visible trace?+
Atom values can be altered with a hex editor or muxing tool, but doing so usually changes the container's internal byte offsets and box sizes, and forensic tools that parse the container structure can flag inconsistencies such as atom sizes that do not match their declared content or timestamps that fall outside plausible ranges.
Related terms
- C2PA (Coalition for Content Provenance and Authenticity)
- An open technical standard that embeds cryptographically signed provenance assertions into media files at the point of capture or editing. A C2PA...
- EXIF (Exchangeable Image File Format)
- A metadata standard embedded in JPEG and TIFF files by capture devices. EXIF fields record camera make and model, lens data, exposure...
- IPTC IIM
- International Press Telecommunications Council Information Interchange Model: a legacy binary metadata standard embedded in JPEG APP13. Carries caption, credit, copyright, and editorial...
- Makernote
- A proprietary EXIF sub-block written by the camera manufacturer to record device-specific data not covered by the EXIF standard. Canon, Nikon, Sony,...
- XMP (Extensible Metadata Platform)
- An Adobe-defined metadata format stored as an XML packet embedded in image files. XMP carries a software history field (xmpMM:History) that editing...