MPG Signature format

VCD Audio Video (.DAT) Signature Format & MPG Recovery Example

The VCD, also called Video CD format, stores MPEG files under the .DAT file extension. .DAT format is just the MPEG-1 or MPEG-2 format only with the .dat extension. DAT files on VCD disks are stored under the MPEGAV (MPEG Audio and Video) directory. Usually, audio & video data encoded with MPEG-1 standard.

Any RIFF container, including MPG Audio-Video must have a signature (tag) RIFF (hex: 52 49 46 46) at the beginning of the file.

RIFF files are organized into data segments (chunks). Each segment is prefixed with an 12 byte header: 4 byte signature (RIFF), 4 byte data size (little-endian order, low byte first) and 4 byte RIFF Type: signature CDXA. Chunk size is data size plus 8 bytes. Summarizing size for all found chunks, we calculate total file size.

Let's examine the sample

When inspecting a sample.mpg file's data using any Hex Viewer, like Active@ Disk Editor, which is included in Active@ File Recovery package, we can see it starts with a signature RIFF (hex: 52, 49, 46, 46).

At offset 8 there is a signature of MPG RIFF Type CDXA (hex: 43, 44, 58, 41). At offset 4 there is a data size: 34,315,716 (hex: C4, 9D, 0B, 02) in little-endian order (low byte first). Adding header length to the data size, we calculate a total MPG audio video file size: 34,315,716 + 8 = 34,315,724 bytes.Sample file is much smaller, however it contains a valid header and a part of whole video.

RIFF Files Header:

struct RIFF_Header
{
    uint32   SignatureRIFF;     // Signature: "RIFF"
    uint32   SizeRIFF;      // 4 byte file size, little-endian order
    uint32   SignatureTYPE;     // RIFF Subtype: "AVI ", "CDXA", "WAVE", "CDR*", ...
};

Videodiscs - VCD Files Format

DAT - File Extension for VCD Files

Active@ File Recovery Custom Scripting Example

This example just determins MPG start signature and calculates file size based on the size specified in RIFF header. Some additional validation included. Syntax of the signature definition language you can read here.

[MPG_HEADER]
DESCRIPTION=MPG Audio Video File
EXTENSION=mpg
BEGIN=MPG_BEGIN
SCRIPT=MPG_SCRIPT

[MPG_BEGIN]
RIFF=0|0
CDXA=8|8

[MPG_SCRIPT]
        size = read(dword, 4)
        size = sum(size, 8)
next:
        temp = read(dword, size)
        if (temp != "JUNK") goto label
        size = sum(size, 4)
        temp = read(dword, size)
        size = sum(size, 4)
        size = sum(size, temp)
        goto next
label:
        temp = and(temp, 00FFFFFFh)
        if (temp != "TAG") goto exit
        size = sum(size, 128)
        goto next