http://www.onicos.com/staff/iz/formats/ogg.html
Byte order: Little-endian
Offset Length Contents
[ 0 4 bytes "OggS"
4 1 byte Stream structure version (0x00)
5 1 byte Packet flag:
bit 0: true if page continued
bit 1: true if first page
bit 2: true if last page
bit 3..7: reserved
6 8 bytes The end pcm sample position (64bit integer)
14 4 bytes Stream serial number
18 4 bytes Page number
22 4 bytes Check sum
26 1 byte Number of segments(s)
27 (s)bytes Sengment table
27+(s) (b)bytes Body (b := header[27] + header[27+1] + ... + header[27+s-1])
]*
http://www.file-recovery.com/ogg-signature-format.htm
OGG Audio Signature Format: Specification & OGG Recovery Example
Ogg is an open container format maintained by the Xiph.Org
Foundation. OGG container format can multiplex a number of independent
streams for audio, video, text (such as subtitles), and metadata.
OGG Vorbis compressed audio files must have a signature (tag) OggS (hex: 4F 67 67 53) at the beginning of the audiofile.
OGG files are organized into data segments. Each segment is prefixed with an 27 byte header:
4 byte signature (OggS) used to identify the header and
storing flags, checksum and other important information.
If header's Flags field has a bit 2, or TotalSegments field is a zero,
this is the end of the audio file.
At header's offset 26 there is byte, describing total segments number.
After the header located sizes for each segment (one byte per segment),
followed by the actual segments data. By searching for data headers and
summarizing sizes for headers and data segments we can calculate total
OGG file size.
Let's examine the example
When inspecting example.ogg file's text data using any Hex Viewer, like Active@ Disk Editor, which is included in Active@ File Recovery package,
we can see it starts with a signature OggS (hex: 4F, 67, 67, 53). At offset 26, there is a
total segments number, which is 1 (hex: 01), then goes segment size 30 (hex: 1E). Next header starts at offset 58 (27+1+30).
Signature OggS (hex: 4F, 67, 67, 53) confirms this. At
offset 84 (58+26), there is a total segments number, which is 1 (hex:
01),
then goes segment size 16 (hex: 10). Next header starts at offset 102
(84+1+1+16). At offset 128 (102+26) we can see number of segments 13
(hex: 0D).
Following 13 bytes give us total length of all 13 segments 3242 (12*255
(hex:FF) plus 182 (hex: B6)).
Next header we should expect at offset 3384 (128 + 1 + 13 + 3242)...
Calcuating and searching for OGG headers further the same way we'll pick
up all Vorbis audio file data.
More info:
OGG Files Header:
struct _ogg_header
{
quint32 Signature;
quint8 Version;
quint8 Flags;
quint64 GranulePosition;
quint32 SerialNumber;
quint32 SequenceNumber;
quint32 Checksum;
quint8 TotalSegments;
};
OGG Vorbis Audio File Specifications
Active@ File Recovery Custom Scripting Example
This example just specifies OGG start signature and calculates file size based on size of all found data chunks.
Syntax of the signature definition language you can read here.
[OGG_
