AAC Audio

Format	AAC Audio
Short name	AAC
Category	media
Platforms	Windows, macOS, Linux, iOS, Android, QNX
Crush support	Supported `(MediaParser)`
Status	Reviewed
Last reviewed	2026-10-04

Forensic relevance

Advanced Audio Coding — the dominant lossy audio codec on iOS and Android. AAC exists in multiple container forms requiring different analysis: (1) Raw ADTS-framed AAC (.aac) — sync word 0xFFF1 or 0xFFF9, self-synchronizing frames, minimal metadata, no embedded timestamps; common in Android voice recorder apps and streaming buffers. (2) ISOBMFF/M4A container — see M4A entry; most common on iOS. (3) ADIF (Audio Data Interchange Format) — rare, single header. Raw ADTS files abruptly stopped (e.g. by crash or battery removal) remain readable without finalization — unlike MPEG-4 which requires a complete moov box. Recording time must be inferred from filesystem timestamps or container metadata; ADTS carries no embedded timestamps. Bitrate and sampling rate can help fingerprint the recording device or app.

Signatures

Offset	Hex	ASCII (non-printable as .)	Description
offset 0 (0x0)	FF F1	..	ADTS AAC sync word — MPEG-4 AAC, no CRC
offset 0 (0x0)	FF F9	..	ADTS AAC sync word — MPEG-2 AAC, no CRC
offset 0 (0x0)	FF F0	..	ADTS AAC sync word — MPEG-4 AAC, with CRC
offset 0 (0x0)	FF F8	..	ADTS AAC sync word — MPEG-2 AAC, with CRC
offset 0 (0x0)	41 44 49 46	ADIF	ADIF header identifier

Known extensions

.aac

References

Advanced Audio Coding overview (Wikipedia) https://en.wikipedia.org/wiki/Advanced_Audio_Coding
ADTS format internals (MultimediaWiki) https://wiki.multimedia.cx/index.php/ADTS

Cite this entry

Crush Format Reference, “AAC Audio”. https://kalink0.github.io/crush-forensics/formats/aac/ — source: crush/data/build_formats_db.py at commit 640a2a9928f4e36a976b89901512a8dce824d093, built 2026-10-21 06:46:19 UTC.

Entry in the source at this commit · Change history of the source · Report a correction