RIFF Chunk
Definition
Resource Interchange File Format: the container structure used by WAV and AVI files. A hierarchy of typed chunks, each with a four-character code, a length field, and a data payload. The fmt chunk defines audio parameters; the data chunk holds PCM samples; INFO and BEXT chunks carry metadata.
- Full name
- Resource Interchange File Format
- File types
- WAV and AVI
- Structure
- Typed chunks with a 4-char code, length, payload
- Key chunks
- fmt, data, INFO, BEXT
Common questions
Why do investigators examine RIFF chunk structure in audio forensics?+
Chunk order, sizes and the presence or absence of expected chunks such as INFO or BEXT can reveal whether a WAV file was edited or re-encoded, since standard recording software writes chunks in predictable patterns that editing tools often disturb.
What forensic information can the BEXT chunk hold?+
It can carry a timestamp, originator information and a unique identifier written by broadcast recording equipment, which can help establish when and on what device a recording was made.
Related terms
- EXIF
- Exchangeable Image File Format: a binary metadata standard defined in the IFF/TIFF structure embedded in JPEG APP1 segment and TIFF file headers....
- IPTC IIM
- International Press Telecommunications Council Information Interchange Model: a legacy binary metadata standard embedded in JPEG APP13. Carries caption, credit, copyright, and editorial...
- Makernote
- A proprietary EXIF sub-block written by the camera manufacturer to record device-specific data not covered by the EXIF standard. Canon, Nikon, Sony,...
- Moov Atom
- The master index atom in an MP4 or MOV file. Contains all track sample tables, timing information, creation and modification timestamps, and...
- XMP
- Extensible Metadata Platform: Adobe's XML-based metadata container embedded as a text packet in image files. Can carry all standard EXIF and IPTC...