Apple Core Audio Format (CAF)
| Format | Apple Core Audio Format (CAF) |
|---|---|
| Short name | CAF |
| Category | media |
| Platforms | macOS, iOS |
| Crush support | Not yet supported |
| Status | Reviewed |
| Last reviewed | 2026-10-05 |
Forensic relevance
Apple's chunk-based audio container on macOS and iOS. A big-endian file header ('caff', version 1) is followed by chunks such as 'desc' (audio format), 'data' (audio data with an edit count), 'pakt' (packet table for variable bit rates) and optional metadata chunks; the 'info' chunk can contain text metadata such as a recording date. Audio messages in Apple Messages are stored as 'Audio Message.caf' attachments, making the format relevant for messaging analysis.
Signatures
| Offset | Hex | ASCII (non-printable as .) | Description |
|---|---|---|---|
| offset 0 (0x0) | 63 61 66 66 00 01 00 00 | caff.... | File type 'caff', version 1, flags 0 |
Known extensions
.caf
References
- Core Audio Format Specification (Apple) https://developer.apple.com/library/archive/documentation/MusicAudio/Reference/CAFSpec/CAF_spec/CAF_spec.html
Cite this entry
Crush Format Reference, “Apple Core Audio Format (CAF)”. https://kalink0.github.io/crush-forensics/formats/caf/ — source: crush/data/build_formats_db.py at commit 640a2a9928f4e36a976b89901512a8dce824d093, built 2026-10-21 06:46:19 UTC.
Entry in the source at this commit · Change history of the source · Report a correction