OGG Audio
| Format | OGG Audio |
|---|---|
| Short name | OGG |
| Category | media |
| Platforms | Windows, macOS, Linux, iOS, Android, QNX |
| Crush support | Supported (MediaParser) |
| Status | Reviewed |
| Last reviewed | 2026-10-04 |
Forensic relevance
Open bitstream container supporting multiple codecs — forensically encountered as Ogg Vorbis (music, games), Ogg Opus (voice messages), and Ogg FLAC (lossless audio). All OGG streams begin with the OggS capture pattern (0x4F676753). Ogg Opus is the dominant format for voice messages in modern messaging apps: WhatsApp stores voice notes as .opus (PTT-YYYYMMDD-WANNNN.opus — date and a per-day counter encoded in the filename, no time of day), Telegram stores as .ogg, both using Opus codec at 16-32 kbps. Vorbis comment metadata (same key-value format as FLAC) may contain title, artist, date, encoder, and custom fields. No native embedded timestamps — recording time inferred from filesystem metadata or messaging app databases.
Signatures
| Offset | Hex | ASCII (non-printable as .) | Description |
|---|---|---|---|
| offset 0 (0x0) | 4F 67 67 53 | OggS | OGG capture pattern ('OggS') |
Known extensions
.ogg, .oga, .opus
References
- OGG format overview (Xiph.org) https://xiph.org/ogg/
- Ogg encapsulation format specification (RFC 3533) https://www.rfc-editor.org/rfc/rfc3533.html
- Ogg encapsulation for the Opus audio codec (RFC 7845) https://www.rfc-editor.org/rfc/rfc7845.html
- Opus codec specification (RFC 6716) https://datatracker.ietf.org/doc/html/rfc6716
- Ogg Vorbis comment format https://xiph.org/vorbis/doc/v-comment.html
Cite this entry
Crush Format Reference, “OGG Audio”. https://kalink0.github.io/crush-forensics/formats/ogg/ — source: crush/data/build_formats_db.py at commit 640a2a9928f4e36a976b89901512a8dce824d093, built 2026-10-21 06:46:19 UTC.
Entry in the source at this commit · Change history of the source · Report a correction