HEIC / HEIF Image

Format	HEIC / HEIF Image
Short name	HEIC/HEIF
Category	media
Platforms	Windows, macOS, Linux, iOS, Android, QNX
Crush support	Supported `(ImageParser)`
Status	Reviewed
Last reviewed	2026-10-04

Forensic relevance

Default photo format on iOS 11+; Android decodes HEIF since version 9 and captures HEIC from the camera since version 10. HEIF (ISO/IEC 23008-12) is the container; HEVC (H.265) is the default codec — hence the .heic extension on Apple devices. A single file can contain multiple images, e.g. image sequences, Portrait mode depth maps, and HDR variants. On iOS, Live Photos are stored as a .heic plus a separate .mov, and burst shots as individual files. Rich EXIF, XMP, and IPTC metadata per image, including GPS, timestamps, device model, and lens information. Depth maps from Portrait mode are stored as auxiliary images with XMP metadata. When iOS transfers HEIC to Windows/Mac via cable or email, it may silently convert to JPEG — the transferred file is then a re-encoded derivative, not the original. Traditional JPEG-based image authentication algorithms do not apply to HEIC. iCloud Photo Library syncs HEIC — relevant for cloud artifact correlation. A C2PA (Content Credentials) manifest, when present, is carried in a top-level ISOBMFF 'uuid' box (a fixed extended-type UUID identifies it as C2PA, since some decoders reject unknown top-level box types outright) and can record generating/editing software and an IPTC Digital Source Type — a direct AI-generation/-editing signal.

Signatures

Offset	Hex	ASCII (non-printable as .)	Description
offset 4 (0x4)	66 74 79 70 68 65 69 63	ftypheic	ftyp box with major brand 'heic' (HEVC image)
offset 4 (0x4)	66 74 79 70 68 65 69 78	ftypheix	ftyp box with major brand 'heix' (HEVC image, Main 10 / range extensions)
offset 4 (0x4)	66 74 79 70 68 65 76 63	ftyphevc	ftyp box with major brand 'hevc' (HEVC image sequence)
offset 4 (0x4)	66 74 79 70 68 65 76 78	ftyphevx	ftyp box with major brand 'hevx' (HEVC image sequence, extended profiles)
offset 4 (0x4)	66 74 79 70 68 65 69 6D	ftypheim	ftyp box with major brand 'heim' (multiview HEVC image)
offset 4 (0x4)	66 74 79 70 68 65 69 73	ftypheis	ftyp box with major brand 'heis' (scalable HEVC image)
offset 4 (0x4)	66 74 79 70 68 65 76 6D	ftyphevm	ftyp box with major brand 'hevm' (multiview HEVC image sequence)
offset 4 (0x4)	66 74 79 70 68 65 76 73	ftyphevs	ftyp box with major brand 'hevs' (scalable HEVC image sequence)
offset 4 (0x4)	66 74 79 70 6D 69 66 31	ftypmif1	ftyp box with major brand 'mif1' (generic HEIF image)
offset 4 (0x4)	66 74 79 70 6D 73 66 31	ftypmsf1	ftyp box with major brand 'msf1' (generic HEIF image sequence)

Known extensions

.heic, .heif

References

Apple HEIF WWDC 2017 session (format internals) https://developer.apple.com/videos/play/wwdc2017/513/
HEIF format spec (Nokia) https://nokiatech.github.io/heif/
HEIF format overview (Library of Congress) https://www.loc.gov/preservation/digital/formats/fdd/fdd000525.shtml
HEIF in Android (AOSP) https://source.android.com/docs/core/camera/heif
Forensic considerations for the High Efficiency Image File Format (McKeown & Russell, IEEE Cyber Security 2020) https://doi.org/10.1109/CyberSecurity49315.2020.9138890
Forensic considerations for HEIF — open-access preprint (arXiv) https://arxiv.org/abs/2006.08060
HEIF forensics — authentication implications (Amped Software) https://blog.ampedsoftware.com/2017/09/29/heif-image-files-forensics-authentication-apocalypse
C2PA Technical Specification (Content Credentials) https://spec.c2pa.org/specifications/specifications/2.4/specs/C2PA_Specification.html

Cite this entry

Crush Format Reference, “HEIC / HEIF Image”. https://kalink0.github.io/crush-forensics/formats/heic-heif/ — source: crush/data/build_formats_db.py at commit 640a2a9928f4e36a976b89901512a8dce824d093, built 2026-10-21 06:46:19 UTC.

Entry in the source at this commit · Change history of the source · Report a correction