Qtch
This is currently being merged. After a discussion, consensus to merge this into QuickTime File Format was found. You can help implement the merge by following the instructions at Help:Merging and the resolution on the discussion. Process started in February 2024. |
This article has multiple issues. Please help improve it or discuss these issues on the talk page. (Learn how and when to remove these messages)
|
QTCH (.qtch) is a filetype used by QuickTime to store audio or video files streamed from a server on the client's computer hard drive.
File Format Description
[edit]The first 16 bytes are:
Hex ; ASCII 00 00 00 50 71 74 63 68 00 00 00 02 00 00 00 02 ; ...Pqtch........
This file type seems to have been introduced with QuickTime Player 7.x. The file is normally stored in any sub-directories of the following location:
%USERPROFILE%\Local Settings\Application Data\Apple Computer\QuickTime\downloads
For example,
C:\Documents and Settings\Administrator\Local Settings\Application Data\Apple Computer\QuickTime\downloads\08\02\82580278-44f0f184-c8c435b8-526b4f79.qtch
Comparison with QuickTime Player 6.x
[edit]Previously, QuickTime Player 6.x would store these audio and video (a/v) streams as files on the hard drive that had auto generated names such as 59B8794Ad01
. Unlike .qtch files, these files had the correct a/v magic number and could be played by an appropriate player.
For example, the first 16 bytes of an m4v file are:
Hex ; ASCII 00 00 00 20 66 74 79 70 4D 34 56 20 00 00 00 ; ... ftypM4V ...
Using the Firefox browser the location of these files would be:
%USERPROFILE%\Local Settings\Application Data\Mozilla\Firefox\Profiles\<session id>\Cache\
For example,
C:\Documents and Settings\Administrator\Local Settings\Application Data\Mozilla\Firefox\Profiles\jb4efpu5.default\Cache\59B8794Ad01
File Format Comparison between QuickTime Player 6.x and QuickTime Player 7.x
[edit]Although the files have different headers their a/v payload can often be the same (see iTunes exception below). In this example the same a/v file was streamed from a server and stored on the hard drive using QuickTime Player 6.x and QuickTime Player 7.x respectively:
The first 16 bytes of the file are totally different:
- QuickTime Player 6.x
00 00 00 14 66 74 79 70 33 67 70 34 00 00 04 00 ; ....ftyp3gp4....
- QuickTime Player 7.x
00 00 00 50 71 74 63 68 00 00 00 02 00 00 00 02 ; ...Pqtch........
However the a/v data starts at:
7D 57 3F 1A 9A D6 CE 94 95 59 D0 CE 02 C1 E2 92
From here both files are identical. To prove that the a/v information is intact within the .qtch file you can replace the .qtch file contents above this start a/v hex value with that from the QuickTime Player 6.x file and it will play normally.
Identifying embedded file types within qtch
[edit]It may be impossible to know the filetype embedded within a .qtch file without having a side-by-side comparison with the same file streamed using QuickTime Player 6.x (as above). Tools such as TrID/32 - File Identifier would, when analysing the file in the above example, only give you this information:
75.0% (.QTCH) QuickTime Cached data (9000/1)
It would not tell you the embedded file type.
Currently[when?] the only known way to establish the file type of a .qtch file is to employ a packet sniffer and search for the stream's file type as it is received by the network card. For example, for QuickTime you would search for the leaf atom called ftyp
. Even then knowledge would be required to build the correct header to the point of the actual a/v data start.
qtch files and iTunes
[edit]Although iTunes stores .qtch files in the same way as described above the a/v content appears to be scrambled in some fashion so that a side-by-side comparison of the original file with the stored streamed file would find no match in the a/v data.