Glossary Forensics

Codec

A codec (coder-decoder) is the method used to compress and decompress audio or video, such as H.264, H.265, AV1, AAC or MP3.

Last reviewed:

AdSense Placeholder
Slot: header_reference_page

In more detail

The codec decides quality and file size, and is separate from the file extension and the Container format. Forensic tools read the codec, bitrate and encoder tags to show how a file was made and whether it was re-encoded. Common video codecs are H.264 (AVC), H.265 (HEVC), VP9 and AV1; common audio codecs are AAC, MP3, Opus and FLAC. Lossy codecs throw away detail the eye or ear is unlikely to miss, so every re-encode loses a little more; lossless ones such as FLAC keep every sample.

Why it matters

"Unsupported file" errors are usually a codec problem, not a container problem: a player may open an MKV or MP4 yet lack the decoder for what is inside. For investigators, the codec, its profile and the encoder string can show that a clip passed through an editor or a messaging app rather than coming straight from the camera. See the Video Forensics.

Example

Copying the same streams from MP4 into Matroska changes the container but not the codecs:

$ ffprobe -v error -show_entries stream=codec_name -of compact clip.mp4
stream|codec_name=h264
stream|codec_name=aac
$ ffmpeg -i clip.mp4 -c copy clip.mkv
$ ffprobe -v error -show_entries format=format_name:stream=codec_name -of compact clip.mkv
stream|codec_name=h264
stream|codec_name=aac
format|format_name=matroska,webm

-c copy re-wraps without re-encoding, so no quality is lost.

AdSense Placeholder
Slot: footer_leaderboard