AVI Video
| Format | AVI Video |
|---|---|
| Short name | AVI |
| Category | media |
| Platforms | Windows |
| Crush support | Supported (MediaParser) |
| Status | Reviewed |
| Last reviewed | 2026-10-04 |
Forensic relevance
Legacy RIFF-based video container format common in older Windows recordings, CCTV/DVR systems, dashcams, and surveillance cameras. RIFF header at offset 0, 'AVI ' identifier at offset 8. AVI has no native creation timestamp fields — recording time must be inferred from filesystem metadata or INFO chunk strings. INFO chunks (ICRD, IDIT, ISFT, INAM) and an IDIT chunk in the header list may contain creation date/time, recording software, device info, and comments — content varies by device. The stream header (strh) fourcc identifies the codec, which can fingerprint the recording device or software. Files edited with AVIDemux, VirtualDub, or FFmpeg leave software-specific structures (e.g. JUNK chunks, additional LIST chunks) — a forensic indicator of post-processing. Standard RIFF is limited to ~4GB — larger files require OpenDML extension (AVI 2.0).
Signatures
| Offset | Hex | ASCII (non-printable as .) | Description |
|---|---|---|---|
| offset 0 (0x0) | 52 49 46 46 | RIFF | RIFF container header |
| offset 8 (0x8) | 41 56 49 20 | AVI | AVI subtype identifier ('AVI ') at offset 8 |
Known extensions
.avi
References
- AVI RIFF file reference (Microsoft) https://learn.microsoft.com/en-us/windows/win32/directshow/avi-riff-file-reference
- AVI format overview (Wikipedia) https://en.wikipedia.org/wiki/Audio_Video_Interleave
- Forensic analysis of video file formats (Gloe, Fischer, Kirchner — DFRWS EU 2014) https://dfrws.org/wp-content/uploads/2019/06/2014_EU_paper-forensic_analysis_of_video_file_formats.pdf
- RIFF INFO tags in AVI (ExifTool) https://exiftool.org/TagNames/RIFF.html
Cite this entry
Crush Format Reference, “AVI Video”. https://kalink0.github.io/crush-forensics/formats/avi/ — source: crush/data/build_formats_db.py at commit 640a2a9928f4e36a976b89901512a8dce824d093, built 2026-10-21 06:46:19 UTC.
Entry in the source at this commit · Change history of the source · Report a correction