What are File Structures?

File structures specify how a format arranges headers, metadata, payloads, indexes, checksums, and other byte sequences. Their rules determine how software locates and interprets stored data.

How File Structures work

A file format’s structure is its parsing grammar at the byte level, often composed of ordered records, nested chunks, length-delimited boxes, or marker-separated segments. PNG, for example, is an eight-byte signature followed by chunks that each carry a length, a four-byte type, data, and a CRC. MP4-family files nest typed boxes. ZIP places a local header before each stored file and a central directory after the file data. Classic TIFF (TIFF 6.0) starts with an eight-byte header that points to a directory, which may begin at any word boundary (an even byte offset) after it. Headers establish interpretation, while indexes and offsets permit nonsequential access to payloads elsewhere in the file. This is distinct from a codec, which defines how an individual media stream is compressed. Structural knowledge is used by demuxers, validators, repair tools, metadata readers, and security scanners.

Key facts

A leading signature narrows the format family but often does not settle the format. The WHATWG MIME sniffing signatures for WAVE, AVI, and WebP all begin with RIFF, and the bytes that follow at offset 8 tell them apart. A public bug report against a file type detection library shows .docx, .pptx, and .xlsx files from one office suite being reported as plain application/zip instead of their document types. The fix explains why: that suite stores [Content_Types].xml, which the library reads to identify the type, after the content entries, beyond the sample the library’s stream mode reads by default. A signature also says nothing about the rest of the file: the PNG specification has decoders gain further confidence from the IHDR chunk that follows and from each chunk’s CRC.
Know what each offset is measured from before moving bytes. TIFF offsets count from the start of the file, and its directory may follow the image data it describes. ZIP readers find entries through a central directory stored after the file data, whose records give each local header’s offset. In MP4-family files the stco box holds absolute chunk offsets, while a movie fragment can address its data relative to the enclosing moof box. Absolute offsets become wrong when their targets move, or when data ahead of those targets is inserted or removed, unless the writer recalculates them.
Byte order is a property of the format, not of the machine reading it. PNG stores multi-byte integers most significant byte first, OpenEXR stores them little-endian, ZIP does the same except where its specification says otherwise for a field, and TIFF declares its order in the first two bytes (II for little-endian, MM for big-endian), so a TIFF reader must handle both. Decode each length and offset field explicitly in the byte order the format specifies for it instead of casting raw bytes to native integers.
Length-prefixed records let a reader skip what it does not understand, but the format decides when skipping is safe. PNG encodes the rule in the chunk name: an unknown ancillary chunk can be ignored, while an unknown critical chunk is a fatal condition for a decoder trying to extract the image. Skipping also depends on trusting the length field. The PNG specification warns that, when CRCs are not checked, an erroneous chunk length can put a decoder out of step so that it misreads later data as a chunk header, and that a poorly written decoder can overflow a buffer because chunks may be up to 2^31-1 bytes long. Check every length and offset against the bytes actually available before using it; out-of-bounds write and out-of-bounds read rank fifth and eighth in MITRE’s 2025 CWE Top 25.

What are File Structures?

How File Structures work

Key facts

When File Structures matter

Sources

Turn media knowledge into a working pipeline