13

I have an audio file in an unknown format. How should I try to determine its format ?

Also, is it possible to do this by manual observation and not using any automated tool ?

0

3 Answers 3

12

As for the automated approach, the file command is the classic recommendation. It's a tool which tries to guess the file type from the data contained in the file. It implements many of the well known file format signatures via libmagic. If you have a composite file you could try binwalk which will try to find files as subsets of a larger file.

If you want to go the manual route, you need to match some subset of the file to a known signature or pattern. This applies especially when it comes to file formats which are likely to be compressed as data patterns will be less regular. Therefore you usually need to find a pattern, usually called a signature or fingerprint, in the file structure. Most file formats have magic numbers either in the header or the footer of the file in order to make it easy for programs to check what type of file they are about to load. There are a couple of good resources for well known file signatures:

5

Peter's suggestions are, as usual, excellent. I'd like to add a few points.

  • if you have access to some program using that format, you could always reverse engineer that in order to find out details about the format or even just the signatures it's looking for (assuming for example that it contains sound samples but is a proprietary and not well-known format)
    • this might also give clues about the libraries used to access the format which in turn gives clues about the format (think IDA FLIRT/FLAIR)
  • otherwise a media player such as VLC may also be a good method to find out details (Ctrl+J and Ctrl+I). That is, you simply attempt to open it and then see what media information the player can give you. Good players won't force you to stick a particular file extension on the file before opening it. But be wary of potential exploits (i.e. do it in a sandbox environment)
5

In addition to the fine suggestions in the other answers, here are some suggestions specific to audio:

  • If you know how long the playtime of the audio is (roughly), calculate the approximate bitrate of the audio file. This will tell you whether it is compressed or not, and the compression ratio can tell you roughly what you might be dealing with. For example, 4kbps~32kbps is indicative of a speech codec, 64~256kbps is ordinary compressed audio (AAC/MP3/Ogg Vorbis), 512~3072kbps likely means a lossless codec, and substantially higher means uncompressed or weakly compressed (e.g. ADPCM, PCM) audio. In turn, this may clue you into what it contains (speech, music, sound effects, etc.).
  • If you suspect it might be weakly compressed, try opening the file up as a raw PCM stream in your favorite audio editor (e.g. Audacity) and listening to it. There will probably be an insane amount of noise if it's compressed in any way, but some formats (e.g. ADPCM) can still be audible in this circumstance if they are relatively constant bitrate. I've used this tactic in the past to work out the spoken contents of a (still unknown) audio sample I received. Indeed, this tactic can even reveal the contents of poorly encrypted, uncompressed files by exploiting human pattern recognition.
  • Check for metadata chunks in the file -- strings, a quick examination of the first and last chunks of the file in a hex editor, or just searching for strings you might expect to see.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.