FileAnalyzer

The Path Concept

The FileAnalyzer understands the internal structure of files, i.e. the chunks, blocks and elements within a binary file that are strung together or nested within each other, similar to a file system or a folder structure, so that each element, each chunk and each block can be addressed and found uniquely via a path.

In this article, we would like to take a closer look at that path concept used by the FileAnalyzer. Among other things, we will explain how you can deal with same-named and thus ambiguous paths and we will give you some tips on how to work with paths more easily. However, we will start with a simple practical example that illustrates this concept.

Example of a Path

As an example of using a path, we would like to look at the ISO Base Media File Format, a container format that is used to store images, videos and audio files, for example in one of the formats MP4, M4A, MOV, 3GP, HEIC, HEIF, AVIF or CR3. An MP4 video file or an M4A audio file typically contains chunks such as the File Type Box (ftyp), the Media Data Container (mdat) or the Movie Box (moov) on the first level. We can access these chunks via the first-level paths /ftyp, /mdat or /moov.

If we now want to read out a property such as the playing time of one of these files, we have to delve deeper into the file structure. The playing time of MP4 videos or M4A audios is stored in the track header (tkhd). The track header is located in the track container (trak), which in turn is located within the movie box (moov). Since the Movie Box is on the first level, we are done and the resulting path is "/moov/trak/tkhd", which we can use for our task.

Ambiguous Paths

Some files can also contain several paths with the same name so that these paths become ambiguous. While audio files typically only contain one single audio track, video files, for example, can have both an audio track as well as a video track. MP4 files that contain both, an audio track and a video track, therefore contain two track containers below their movie box (moov), both of which have the same name "trak". In this case, our path "/moov/trak/tkhd" from the last example is of course no longer unique. To make that path unique, the FileAnalyzer numbers such paths with an index starting at 0. The first path of such a file would therefore be clearly accessible via "/moov/trak[0]/tkhd", the second via "/moov/trak[1]/tkhd".

So, if we use one of these two paths with an index, for example, in the search function of the FileAnalyzer, we only search in the respective (first or second) path and not in both. If, on the other hand, we use the same path without an index (here "/moov/trak/tkhd"), the search function would search both, the audio track header and the video track header. By omitting or specifying an index, we can therefore control whether we mean a specific chunk or all chunks of the respective type.

How to Read and Copy Paths directly from Files

Of course, we don't need to know by memory which properties are stored in which path of a specific file format. Just open a file of your choice in the FileAnalyzer and browse the file using the tree structure on the left side of the program or use the search functions to find specific properties.

If you have selected an element within the tree structure, the respective path of this element is automatically displayed below the tree structure. If you right-click on the element, the path can also be conveniently copied to the clipboard so that you do not have to enter the path manually and you can, for example, copy it directly into your scripts for the script control of the FileAnalyzer.

How to Use Paths directly for Searches or Comparisons

In addition, you can also start searches within a path or comparisons of paths directly from the file structure or from the details table of the FileAnalyzer without having to enter the path manually.

To do this, simply right-click on an element in the tree structure of the file structure view in the main window of the FileAnalyzer on the right-hand side and then select "Search Path" or "Compare Path" from the context menu to automatically start the corresponding search dialogs with this path preselected. If you click on a path that is not unique in this way, you will get two entries in the context menu. With "at this position" you use the path as described above with an index, i.e. only within this unique element (of this or several files) - while with "at all positions" you use the path without an index, i.e. you would carry out the search or comparison across all paths with the same name (of this or several files).

The same applies when you right-click on entries within the "Details" table in the main window of the FileAnalyzer. Here, too, the context menu gives you the option of searching or comparing properties in the selected path only at this or at all positions with the same name.

Addressing Properties in Paths

The path concept can also be used to address individual or multiple properties stored in a path. The properties must be separated from the path with a colon, as shown in the next example for the property "Duration" in the path "/moov/trak/tkhd" to the track header of ISOBMFF files:

/moov/trak/tkhd:Duration

To address multiple properties, separate them with a comma. The next example shows this for the properties Width and Height in the image header (path "/ihdr") of PNG images:

/ihdr:Width,Height

This option to restrict the path specification to individual properties can be used, for example for the comparison function of the FileAnalyzer, which allows not only the comparison of entire elements with all their contained properties within the structure of files, but also only individual properties from them.

That's all you need to know about the path concept of the FileAnalyzer.