Opus Audio
| Format | Opus Audio |
|---|---|
| Short name | Opus |
| Category | media |
| Platforms | Windows, macOS, Linux, iOS, Android, QNX |
| Crush support | Supported (MediaParser) |
| Status | Reviewed |
| Last reviewed | 2026-10-04 |
Forensic relevance
Low-latency voice and audio codec (RFC 6716) used in WebRTC, Discord, WhatsApp, Telegram, Signal, and VoIP applications. Opus is a codec, not a container — stored files use Ogg encapsulation as defined in RFC 7845, with the .opus extension. The Ogg ID header identifies the stream as Opus and contains channel count, sample rate, and pre-skip value. A Vorbis comment header follows with optional metadata tags. WhatsApp voice notes use .opus extension; Telegram uses .ogg — both are Ogg-encapsulated Opus at 16-32 kbps. WebRTC recordings may appear as raw Opus frames without Ogg container in browser cache or WebRTC dump files. No native embedded timestamps — recording time inferred from filesystem metadata, messaging app databases, or the WhatsApp filename convention (PTT-YYYYMMDD-WANNNN.opus — date only, no time of day).
Signatures
| Offset | Hex | ASCII (non-printable as .) | Description |
|---|---|---|---|
| offset 28 (0x1C) | 4F 70 75 73 48 65 61 64 | OpusHead | OpusHead codec identification (RFC 7845 §5.1, offset 28 in first Ogg page) |
Known extensions
.opus
References
- Opus codec specification (RFC 6716) https://datatracker.ietf.org/doc/html/rfc6716
- Ogg encapsulation for Opus (RFC 7845) https://datatracker.ietf.org/doc/html/rfc7845
- Opus FAQ (Xiph.org) https://wiki.xiph.org/OpusFAQ
Cite this entry
Crush Format Reference, “Opus Audio”. https://kalink0.github.io/crush-forensics/formats/opus/ — source: crush/data/build_formats_db.py at commit 640a2a9928f4e36a976b89901512a8dce824d093, built 2026-10-21 06:46:19 UTC.
Entry in the source at this commit · Change history of the source · Report a correction