Moov Atom
Definition
The master index atom in an MP4 or MOV file. Contains all track sample tables, timing information, creation and modification timestamps, and vendor-specific metadata boxes. Parsing the moov atom directly gives the examiner access to the full file structure independent of any media player.
- Container formats
- MP4, MOV (ISO base media file format)
- Contains
- Sample tables, timing, timestamps, metadata boxes
- Sibling atom
- mdat (raw audio/video sample data)
- Position
- Start or end of file depending on encoder
Common questions
Why does moov position matter for examiners?+
Some encoders write the moov atom at the end of the file only after encoding finishes, which is a useful signal: a file with moov at the start was likely optimised or re-processed by software such as an editing tool, while an unmoved trailing moov is more consistent with a straight camera export.
What happens if the moov atom is missing or corrupted?+
Standard players cannot open the file because they rely on moov to locate sample data, but the mdat payload may still be recoverable by carving raw frames or reconstructing a synthetic moov atom, a common video-recovery technique for corrupted or truncated recordings.
How does moov parsing differ from just playing the file?+
Playback shows only what the player chooses to expose, while directly parsing the moov atom's boxes reveals every timestamp, codec parameter, and vendor metadata field regardless of whether the player's UI surfaces it, which is why forensic tools parse the container structure directly.
Related terms
- EXIF
- Exchangeable Image File Format: a binary metadata standard defined in the IFF/TIFF structure embedded in JPEG APP1 segment and TIFF file headers....
- IPTC IIM
- International Press Telecommunications Council Information Interchange Model: a legacy binary metadata standard embedded in JPEG APP13. Carries caption, credit, copyright, and editorial...
- Makernote
- A proprietary EXIF sub-block written by the camera manufacturer to record device-specific data not covered by the EXIF standard. Canon, Nikon, Sony,...
- RIFF Chunk
- Resource Interchange File Format: the container structure used by WAV and AVI files. A hierarchy of typed chunks, each with a four-character...
- XMP
- Extensible Metadata Platform: Adobe's XML-based metadata container embedded as a text packet in image files. Can carry all standard EXIF and IPTC...