WebM Video
| Format | WebM Video |
|---|---|
| Short name | WebM |
| Category | media |
| Platforms | Windows, macOS, Linux, iOS, Android, QNX |
| Crush support | Supported (MediaParser) |
| Status | Reviewed |
| Last reviewed | 2026-10-04 |
Forensic relevance
Web-optimised video container based on a restricted subset of Matroska/EBML. Used by browsers (Chrome, Firefox, Edge), WebRTC recordings, YouTube downloads, and some Android apps. Shares the EBML magic (0x1A 0x45 0xDF 0xA3) with MKV — distinguished by DocType 'webm' in the EBML header. Restricted to VP8, VP9, or AV1 video with Vorbis or Opus audio only. Same Segment Info metadata as MKV: DateUTC (nanoseconds since 2001-01-01 UTC), WritingApp and MuxingApp identify the creation software. Browser-cached WebM segments from streaming services may contain partial content rather than complete videos. WebRTC recordings from browser video calls are commonly stored as WebM.
Signatures
| Offset | Hex | ASCII (non-printable as .) | Description |
|---|---|---|---|
| offset unknown | 1A 45 DF A3 | .E.. | EBML header (Matroska/WebM) — DocType 'webm' identifies WebM |
Known extensions
.webm
References
- WebM container guidelines (WebM Project) https://www.webmproject.org/docs/container/
- WebM overview (Wikipedia) https://en.wikipedia.org/wiki/WebM
- Matroska format spec (RFC 9559) — WebM base format https://datatracker.ietf.org/doc/rfc9559/
Cite this entry
Crush Format Reference, “WebM Video”. https://kalink0.github.io/crush-forensics/formats/webm/ — source: crush/data/build_formats_db.py at commit 640a2a9928f4e36a976b89901512a8dce824d093, built 2026-10-21 06:46:19 UTC.
Entry in the source at this commit · Change history of the source · Report a correction