运城建胜数据恢复

网站首页 > 数据恢复案例 > 技术文章

运城建胜数据恢复-MOV文件结构分析

2018-01-30 12:04:37 运城建胜数据恢复 阅读

一、基本概念和定义

 The basic data unit in a QuickTime file is the atom. Each atom contains size and type  information  along with its data. Atom是quickTime文件的基本数据单元,每个Atom包含size和type,以及之后的数据部分。

The size field indicates the number of bytes in the atom, including the size andtype fields. The type field specifies the type of data stored in the atom and, by implication, the format of that data.

size部分指明Atom的字节数量,包括size和type的字节。

type指明数据存储的类型,也指明了数据的格式。

 

Atom types are specified by a 32-bit integer, typically a four-character code.

1、关于size的定义

atom size :

A 32-bit integer that indicates the size of the atom, including both the atom header and theatom’s contents, including any contained atoms. Normally, the size field contains the actualsize of the atom, in bytes, expressed as a 32-bit unsigned integer. However, the size field cancontain special values that indicate an alternate method of determining the atom size. (Thesespecial values are normally used only for media data (‘mdat’) atoms.) If the size field is setto 0, which is allowed only for a top-level atom, this is the last atom in the file and it extendsto the end of the file. If the size field is set to 1, then the actual size is given in the extendedsize field, an optional 64-bit field that follows the type field. This accomodates media dataatoms that contain more than 2^32 bytes.

 

2、atom type:

 

A 32-bit integer that contains the type of the atom. This can often be usefully treated as afour-character field with a mnemonic value, such as ‘moov’ (0x6D6F6F76) for a movie atom,or ‘trak’ (0x7472616B) for a track atom, but non-ASCII values (such as 0x00000001) arealso used. Knowing an atom’s type allows you to interpret its data. An atom’s data can bearranged as any arbitrary collection of fields, tables, or other atoms. The data structure isspecific to the atom type. An atom of a given type has a defined data structure. If yourapplication encounters an atom of an unknown type, it should not attempt to interpret theatom’s data. Use the atom’s size field to skip this atom and all of its contents. This allows adegree of forward compatability with extensions to the QuickTime file format.

3、Extended Size

If the size field of an atom is set to 1, the type field is followed by a 64-bit extended size

field, which contains the actual size of the atom as a 64-bit unsigned integer. This is used whenthe size of a media data atom exceeds 2^32 bytes.

 

4 、version

 

All version fields must be set to0, unless this document states otherwise.

 

二、数据分析

 

1、wide atom

 

The ‘wide’ atom is exactly 8 bytes in size, and consists solely of its size and type fields. It containsno other data.

 

运城建胜数据恢复中心

上面是mov文件整体的结构分析,下面分析moov和mdat内部的结构。

运城建胜数据恢复中心

 

看一下整体的关系:

运城建胜数据恢复中心


Powered by MetInfo 5.3.19 ©2008-2018 www.metinfo.cn