MOV Video (QuickTime)
| Format | MOV Video (QuickTime) |
|---|---|
| Short name | MOV |
| Category | media |
| Platforms | macOS, iOS |
| Crush support | Supported (MediaParser) |
| Status | Reviewed |
| Last reviewed | 2026-10-04 |
Forensic relevance
Apple's native video container format — the QuickTime File Format, on which ISOBMFF/MPEG-4 is based. iOS camera recordings — including the video component of Live Photos — are stored as .mov files. macOS screen recordings also use MOV. Identified by an ftyp box at offset 4 with the 'qt ' brand; the ftyp box is optional in QuickTime, so older files begin directly with a moov, mdat or wide atom. Timestamps use the QuickTime epoch (seconds since 1904-01-01 UTC); many non-Apple cameras store local time instead, and iOS additionally records com.apple.quicktime.creationdate with a time-zone offset. GPS coordinates are stored as Apple-specific metadata keys ('com.apple.quicktime.location.ISO6709') in the metadata atom (meta/keys/ilst). Device make/model, software version, and creation date are commonly present. Files processed by QuickTime Player, iMovie, or Final Cut Pro will show altered timestamps and may lack original device metadata — a key indicator of post-processing.
Signatures
| Offset | Hex | ASCII (non-printable as .) | Description |
|---|---|---|---|
| offset 4 (0x4) | 66 74 79 70 71 74 20 20 | ftypqt | ftyp box with QuickTime brand 'qt ' |
| offset 4 (0x4) | 6D 6F 6F 76 | moov | Older QuickTime file without ftyp, starting with a movie atom ('moov') |
| offset 4 (0x4) | 6D 64 61 74 | mdat | Older QuickTime file without ftyp, starting with a media data atom ('mdat') |
| offset 4 (0x4) | 77 69 64 65 | wide | Older QuickTime file without ftyp, starting with a 'wide' placeholder atom |
Known extensions
.mov
References
- QuickTime File Format specification (Apple) https://developer.apple.com/documentation/quicktime-file-format
- Apple developer docs — QuickTime metadata atoms https://developer.apple.com/documentation/quicktime-file-format/metadata_atoms_and_types
- Apple developer docs — location metadata in MOV https://developer.apple.com/documentation/quicktime-file-format/location_metadata
- Geolocation metadata in iOS and Android video files (addpipe, 2025) https://blog.addpipe.com/geolocation-metadata-ios-android-video-files/
- ExifTool QuickTime tags reference https://exiftool.org/TagNames/QuickTime.html
Cite this entry
Crush Format Reference, “MOV Video (QuickTime)”. https://kalink0.github.io/crush-forensics/formats/mov/ — source: crush/data/build_formats_db.py at commit 640a2a9928f4e36a976b89901512a8dce824d093, built 2026-10-21 06:46:19 UTC.
Entry in the source at this commit · Change history of the source · Report a correction