Learning About Digital Forensics

With iOS 11 and macOS High Sierra (10.13), Apple has introduced a file container format called High Efficiency Image File Format (aka HEIF – evidently it’s pronounced “heef”). Apple is using HEIF to store camera/video/Apple “Live Photos”. ISO/IEC 23008-12-MPEG-H Part 2 / ITU H.265 for compressing the actual still video and picture data.

Also referred to as High Efficiency Video Coding (HEVC). Theoretically, HEIF could use other compression algorithms but Apple is using it specifically with HEVC / H.265. It around halves the file size for confirmed image/video quality. It permits an individual file to contain multiple media (eg multiple animated still pictures AND sound e.g. an Apple “Live Photo”). Apple HEIF images will have a .heic file extension. Apple HEVC encoded movies will have the familiar Quicktime .mov extension but internally they will use HEVC / H.265 compression.

  • Must love break up tests and experimentation with technological approach
  • ► November (35)
  • Setup the website
  • How to Make Jungle Juice
  • At least 1 participating content a day

The ISO Base Media File Format ISO (14496-12) is based upon the Quicktime file structure therefore it will apply to both .heic HEVC and images .mov files. Since it uses a more technical compression algorithm than prior specifications (eg H.264 and JPEG), only recent model Apple devices have the required hardware to make HEVC content.

Software decoding support is evidently available for all Apple devices (presumably running iOS 11 / High Sierra) but playback performance will most likely suffer on old hardware. We won’t be discussing how HEVC / H.265 compression works. For an instant overview on some basic principles and the difference between H.264 and H.265, please watch this video.

Special Because of Maggie Gaffney from Teeltech USA for providing us with iPhone 8 Plus test mass media files. We used sample also .heic documents from an Ars Technica review (iPad Pro) and sample files provided to the FFmpeg discussion board (iPhone 7 Plus). Here is an article showing how to create an iOS 11 device to save/transfer .heic files in their original format (Camera set to “High Efficiency” and “Photos – Transfer to Mac or PC” established to “Keep Originals”).

Apple can auto-magically convert .heic data files to .jpg data files (and h.265 .mov to h.264 .Mov) when transferring to non-compatible devices/places (eg PC or emails). So if you are not receiving .heic files, check those iOS configurations. Apart from observing them natively on iOS or High Sierra (eg using Apple Photos or Preview), we found the easiest way to view .heic data files was using this free Home windows energy by @liuziangexit HEIF. Note: there are two versions – Chinese and English. Being the uncultured lapdog monkey that we are, we downloaded the English version.

Be sure to learn the readme document included. Redistributable deal which was included in the download zip document conveniently. There is a website that converts also .heic to .jpeg but this may not be appropriate for sensitive photos. For playing HEVC/H.265 encoded .mov documents, we found that IrfanView and VLC player proved helpful OK (IrfanView seemed to have better performance than VLC when observing high-res videos). This copies all other streams (eg sound, subtitles) to the new result document and re-encodes/outputs the foundation video stream to H.264. See for details on using the FFmpeg map debate here.

We found the simplest way to send a test .heic from an iPhone to a PC was to publish it to Dropbox which includes been updated to support .heic and H.265 encoded .mov documents. Unfortunately, it appears that Dropbox might rename the files upon upload. Dropbox was something similar to “Photo Oct 08, 10 20 05.heic”. Consequently, a hash compare of the source/destination documents may be asked to confirm exact copies. Exiftool (v10.63) added improved support for HEIF and it will display the EXIF data from an Apple generated.H or heic.265 .mov document.

It has not been confirmed if iOS created .heic / HEVC .mov data files will maintain ALL of their original EXIF metadata after being auto-magically changed into .jpg / H.264 documents. We have not had the opportunity to find a non-Apple viewer for HEVC encoded “Live Photos”. Seeking to transfer them via Dropbox resulted in a “Live Photo” .heic file containing a single image (no audio or other animation).