Crush — Format Reference

Built from crush/data/build_formats_db.py at commit 640a2a9928f4 on 2026-10-21 06:46:19 UTC.

← All formats

AVIF Image

FormatAVIF Image
Short nameAVIF
Categorymedia
PlatformsWindows, macOS, Linux, iOS, Android, QNX
Crush supportSupported (ImageParser)
StatusReviewed
Last reviewed2026-10-04

Forensic relevance

AV1 Image File Format — a royalty-free still-image format based on the AV1 video codec, defined by AOM on top of HEIF (ISO/IEC 23008-12) with MIAF constraints (ISO/IEC 23000-22). Adopted by Chrome (2020), Firefox (2021), Safari (2022), Android 12 (2021), and increasingly by streaming and social media platforms for bandwidth-efficient image delivery. Like HEIC, AVIF uses the ISOBMFF ftyp box structure; the major brand 'avif' or 'avis' (for image sequences / animations) follows 'ftyp' at offset 4. Supports EXIF, XMP, and ICC colour profiles embedded in 'meta' boxes — GPS coordinates, capture timestamps, and device model are preserved when the originating app writes EXIF. AVIF files from social media have often had metadata stripped server-side, which is itself a forensic indicator of the image's provenance. The AV1 bitstream inside is distinct from H.265 (HEVC used in HEIC), so HEIC-specific codec detection tools will not recognise AVIF content. Animation / multi-frame AVIF ('avis' brand) is increasingly used as a GIF replacement — relevant when investigating multimedia evidence. Like HEIC, a C2PA (Content Credentials) manifest, when present, is carried in a top-level ISOBMFF 'uuid' box and can record generating/editing software and an IPTC Digital Source Type — a direct AI-generation/-editing signal.

Signatures

OffsetHex ASCII (non-printable as .)Description
offset 4 (0x4)66 74 79 70 61 76 69 66ftypavifftyp box with major brand 'avif' (AVIF image)
offset 4 (0x4)66 74 79 70 61 76 69 73ftypavisftyp box with major brand 'avis' (AVIF image sequence / animation)

Known extensions

.avif

References

Cite this entry

Crush Format Reference, “AVIF Image”. https://kalink0.github.io/crush-forensics/formats/avif/ — source: crush/data/build_formats_db.py at commit 640a2a9928f4e36a976b89901512a8dce824d093, built 2026-10-21 06:46:19 UTC.

Entry in the source at this commit · Change history of the source · Report a correction