MP3 Audio
| Format | MP3 Audio |
|---|---|
| Short name | MP3 |
| Category | media |
| Platforms | Windows, macOS, Linux, iOS, Android, QNX |
| Crush support | Supported (MediaParser) |
| Status | Reviewed |
| Last reviewed | 2026-10-04 |
Forensic relevance
Ubiquitous lossy audio format for music, voice memos, voicemails, and messaging app voice messages. ID3v2 tags (at file start, 'ID3' magic) can embed title, artist, album, year, comments, cover art, lyrics, URLs, and custom frames — some apps embed GPS coordinates or device info in custom ID3 frames. ID3v1 tags (last 128 bytes, 'TAG' marker) store basic metadata. VBR files often contain a Xing/LAME tag in the first MPEG frame — this encodes the encoding software (e.g. 'LAME 3.99') and settings, useful for source attribution and detecting re-encoding. Bitrate and sample rate can help fingerprint the recording device or app. No native timestamp — recording time must be inferred from ID3 tags or filesystem metadata.
Signatures
| Offset | Hex | ASCII (non-printable as .) | Description |
|---|---|---|---|
| offset 0 (0x0) | 49 44 33 | ID3 | ID3 tag header (MP3 with ID3v2 metadata) |
| offset 0 (0x0) | FF FB | .. | MPEG-1 Layer 3 sync word (MP3 without ID3 header) |
| offset 0 (0x0) | FF FA | .. | MPEG-1 Layer 3 sync word with CRC (MP3 without ID3 header) |
| offset 0 (0x0) | FF F3 | .. | MPEG-2 Layer 3 sync word (MP3 without ID3 header) |
| offset 0 (0x0) | FF F2 | .. | MPEG-2 Layer 3 sync word with CRC (MP3 without ID3 header) |
| offset 0 (0x0) | FF E3 | .. | MPEG-2.5 Layer 3 sync word (MP3 without ID3 header) |
| offset 0 (0x0) | FF E2 | .. | MPEG-2.5 Layer 3 sync word with CRC (MP3 without ID3 header) |
Known extensions
.mp3
References
- ID3v2 specification (id3.org) https://id3.org/id3v2.3.0
- ID3 overview (Wikipedia) https://en.wikipedia.org/wiki/ID3
- LAME tag specification (encoder attribution) http://gabriel.mp3-tech.org/mp3infotag.html
- ForensicsWiki — ID3 https://forensics.wiki/id3/
Cite this entry
Crush Format Reference, “MP3 Audio”. https://kalink0.github.io/crush-forensics/formats/mp3/ — source: crush/data/build_formats_db.py at commit 640a2a9928f4e36a976b89901512a8dce824d093, built 2026-10-21 06:46:19 UTC.
Entry in the source at this commit · Change history of the source · Report a correction