OGG Signature format

OGG Audio Signature Format: Specification & OGG Recovery Example

Ogg is an open container format maintained by the Xiph.Org Foundation. OGG container format can multiplex a number of independent streams for audio, video, text (such as subtitles), and metadata.

OGG Vorbis compressed audio files must have a signature (tag) OggS (hex: 4F 67 67 53) at the beginning of the audiofile.

OGG files are organized into data segments. Each segment is prefixed with an 27 byte header: 4 byte signature (OggS) used to identify the header and storing flags, checksum and other important information.

If header's Flags field has a bit 2, or TotalSegments field is a zero, this is the end of the audio file. At header's offset 26 there is byte, describing total segments number. After the header located sizes for each segment (one byte per segment), followed by the actual segments data. By searching for data headers and summarizing sizes for headers and data segments we can calculate total OGG file size.

Let's examine the example

When inspecting example.ogg file's text data using any Hex Viewer, like Active@ Disk Editor, which is included in Active@ File Recovery package, we can see it starts with a signature OggS (hex: 4F, 67, 67, 53). At offset 26, there is a total segments number, which is 1 (hex: 01), then goes segment size 30 (hex: 1E). Next header starts at offset 58 (27+1+30).

Signature OggS (hex: 4F, 67, 67, 53) confirms this. At offset 84 (58+26), there is a total segments number, which is 1 (hex: 01), then goes segment size 16 (hex: 10). Next header starts at offset 102 (84+1+1+16). At offset 128 (102+26) we can see number of segments 13 (hex: 0D).

Following 13 bytes give us total length of all 13 segments 3242 (12*255 (hex:FF) plus 182 (hex: B6)). Next header we should expect at offset 3384 (128 + 1 + 13 + 3242)... Calcuating and searching for OGG headers further the same way we'll pick up all Vorbis audio file data.

OGG Files Header:

struct _ogg_header
{
    quint32 Signature;
    quint8 Version;
    quint8 Flags;
    quint64 GranulePosition;
    quint32 SerialNumber;
    quint32 SequenceNumber;
    quint32 Checksum;
    quint8 TotalSegments;
};

OGG Vorbis Audio File Specifications

Active@ File Recovery Custom Scripting Example

This example just specifies OGG start signature and calculates file size based on size of all found data chunks. Syntax of the signature definition language you can read here.

[OGG_HEADER]
DESCRIPTION=Compressed Audio File Vorbis
EXTENSION=ogg
BEGIN=OGG_BEGIN
SCRIPT=OGG_SCRIPT

[OGG_BEGIN]
OggS=0|0

[OGG_SCRIPT]
next:
    signature = read(dword, size)
    if (signature != "OggS") goto exit
    flags = sum(size, 5)
    flags = read(byte, flags)
    flags = and(flags, 4)
    segments = sum(size, 26)
    segments = read(byte, segments)
    if (segments == 0) goto exit
    size = sum(size, 27)
    position = size
    size = sum(size, segments)
segment:
    value = read(byte, position)
    size = sum(size, value)
    position = sum(position, 1)
    segments = sub(segments, 1)
    if (segments != 0) goto segment
    if (flags == 0) goto next