MP4 Video

Format	MP4 Video
Short name	MP4
Category	media
Platforms	Windows, macOS, Linux, iOS, Android, QNX
Crush support	Supported `(MediaParser)`
Status	Reviewed
Last reviewed	2026-10-04

Forensic relevance

Versatile ISOBMFF container format (ISO/IEC 14496-12) for video recordings, screen captures, and downloaded media. The ftyp box at offset 4 identifies the specific brand (mp42, isom, M4V, etc.). The mvhd (Movie Header) box contains creation and modification timestamps in QuickTime epoch (seconds since 1904-01-01 UTC — not Unix epoch); despite the specification, many cameras store local time instead of UTC. The udta (User Data) box may contain device make/model, recording software, and GPS coordinates (e.g. from GoPro, DJI, dashcams, smartphones). Metadata changes when a video is re-encoded or edited — altered mvhd timestamps and missing udta boxes are indicators of processing. Screen recordings from iOS and Android are commonly stored as MP4.

Signatures

Offset	Hex	ASCII (non-printable as .)	Description
offset 4 (0x4)	66 74 79 70	ftyp	ISOBMFF ftyp box at offset 4

Known extensions

.mp4, .m4v

References

ISOBMFF format overview (Wikipedia) https://en.wikipedia.org/wiki/ISO_base_media_file_format
ISOBMFF — ISO/IEC 14496-12:2026 base media file format https://www.iso.org/standard/85596.html
MP4 file format spec (ISO/IEC 14496-14) https://www.iso.org/standard/79110.html
QuickTime date/time tags — UTC vs. local time (ExifTool documentation) https://exiftool.org/TagNames/QuickTime.html
MPEG-4 Video Authentication Using File Structure and Metadata (J. R. Hall, NCMF thesis, 2015) https://www.ucdenver.edu/docs/librariesprovider27/ncmf-docs/theses/hall_thesis_fall2015.pdf

Cite this entry

Crush Format Reference, “MP4 Video”. https://kalink0.github.io/crush-forensics/formats/mp4/ — source: crush/data/build_formats_db.py at commit 640a2a9928f4e36a976b89901512a8dce824d093, built 2026-10-21 06:46:19 UTC.

Entry in the source at this commit · Change history of the source · Report a correction