MKV Video (Matroska)
| Format | MKV Video (Matroska) |
|---|---|
| Short name | MKV |
| Category | media |
| Platforms | Windows, macOS, Linux, iOS, Android, QNX |
| Crush support | Supported (MediaParser) |
| Status | Reviewed |
| Last reviewed | 2026-10-04 |
Forensic relevance
Open EBML-based container format for HD video, commonly found in downloaded media, media server libraries (Plex, Jellyfin), and screen recordings. Supports chapters, subtitles, attachments, and multiple audio/video tracks. The Segment Info element contains key forensic metadata: DateUTC (nanoseconds since 2001-01-01 UTC — the muxing timestamp), Title, MuxingApp (library used), and WritingApp (application used). WritingApp and MuxingApp are mandatory fields — they identify the software that created or remuxed the file (e.g. HandBrake, FFmpeg, MakeMKV, mkvmerge) and are strong indicators of post-processing. Shares the EBML magic (0x1A 0x45 0xDF 0xA3) with WebM — distinguished by DocType 'matroska' vs 'webm' in the EBML header.
Signatures
| Offset | Hex | ASCII (non-printable as .) | Description |
|---|---|---|---|
| offset 0 (0x0) | 1A 45 DF A3 | .E.. | EBML header (Matroska/WebM) — DocType 'matroska' identifies MKV |
Known extensions
.mkv, .mka, .mks, .mk3d
References
- Matroska format specification (RFC 9559) https://datatracker.ietf.org/doc/rfc9559/
- EBML specification (RFC 8794) https://datatracker.ietf.org/doc/rfc8794/
- Matroska technical basics https://www.matroska.org/technical/basics.html
- Matroska element reference https://www.matroska.org/technical/elements.html
Cite this entry
Crush Format Reference, “MKV Video (Matroska)”. https://kalink0.github.io/crush-forensics/formats/mkv/ — source: crush/data/build_formats_db.py at commit 640a2a9928f4e36a976b89901512a8dce824d093, built 2026-10-21 06:46:19 UTC.
Entry in the source at this commit · Change history of the source · Report a correction