PNG Chunk
Definition
The basic structural unit of a PNG file. Each chunk has a four-character type code, a length field, a data payload, and a CRC-32 checksum. Critical chunks (IHDR, IDAT, IEND) must be present and in a defined order; ancillary chunks are optional. Unexpected or malformed chunks indicate post-processing.
- Structure
- Type code, length, data payload, CRC-32
- Critical chunks
- IHDR, IDAT, IEND
- Ancillary chunks
- Optional, e.g. metadata, gamma, text
- Forensic flag
- Malformed or unexpected chunk order
Common questions
How does chunk analysis help detect image manipulation?+
Editing software often rewrites, reorders, or drops chunks in ways a camera's native encoder would not, and a broken CRC-32 or an out-of-place critical chunk can point to corruption or deliberate tampering rather than a file straight off a device.
Can ancillary chunks carry evidentiary metadata?+
Yes. Ancillary chunks such as tEXt or tIME can retain software identifiers, timestamps, or comments left by the editing tool, which sometimes survive even after visible image content has been altered.
Related terms
- EXIF (Exchangeable Image File Format)
- A metadata standard embedded in JPEG and TIFF files by capture devices. EXIF fields record camera make and model, lens data, exposure...
- File Signature (Magic Bytes)
- The fixed byte sequence at the start of a file that identifies its format. JPEG files begin with FF D8 FF; PNG...
- JPEG Quantisation Table
- A matrix of 64 values embedded in a JPEG file that controls the precision with which each frequency component of the image...
- Thumbnail Inconsistency
- Many cameras embed a reduced-resolution preview image inside the EXIF header of a JPEG. If the main image has been cropped or...
- XMP (Extensible Metadata Platform)
- An Adobe-defined metadata format stored as an XML packet embedded in image files. XMP carries a software history field (xmpMM:History) that editing...