3

Two files containing same song, both in M4A format, output two different results when I calculate their hashes:

md5sum
f149e2d2a232a410fcf61627578c101a  new.m4a
ad26ed675342f0f45dcb5f9de9d586df  old.m4a

They contain same number of bytes:

ls -l
-rw-rw-r-- 1 cdc cdc 2978666 Jun 26 19:49 new.m4a
-rwxrwxr-x 1 cdc cdc 2978666 Jun 26 19:49 old.m4a

The exiftool output differs only in dates of creation (pastebin for new.m4a and pastebin for old.m4a).

I used Audacity's tools to compare two files (by inverting and mixing them, which makes them nullify each other's similarities) and the result was silence, since there was nothing left, meaning there is no difference between two files.

Command cmp gives me:

cmp -l
     54 375  23
     55  51 305
     56  41 112
     58 375  23
     59  51 305
     60  45 116
    170 375  23
    171  51 305
    172  41 112
    174 375  23
    175  51 305
    176  41 112
    270 375  23
    271  51 305
    272  41 112
    274 375  23
    275  51 305
    276  41 112

cmp -b
new.m4a old.m4a differ: byte 54, line 1 is 375 M-}  23 ^S

The only real difference is that old.m4a file was downloaded in December, 2020, and new.m4a was downloaded few hours ago.

If needed, you can download new.m4a here and old.m4a here. Originally, both were downloaded from artist's Bandcamp page.

P.S. My human ear says that these two are identical.

4
  • 6
    If the "creation date" differs, then there's some m4a meta data, as stored in the file's data that differs, so those files contain different sequences of bytes. See cmp -l {old,new}.m4a to see the difference. Jun 26, 2021 at 21:05
  • @StéphaneChazelas I got nothing running that command.
    – Igor V.
    Jun 26, 2021 at 21:30
  • 1
    Try running md5sum {old,new}.m4a again. The ones you posted on pcloud are identical and return the same md5sum (f149e2d2a232a410fcf61627578c101a) for me. Jun 26, 2021 at 21:32
  • Can you re-download it, please? I guess I screwed up initial upload, somehow... Now I do get some output from cmp: 54 375 23 55 51 305 56 41 112 58 375 23 59 51 305 60 45 116 170 375 23 171 51 305 172 41 112 174 375 23 175 51 305 176 41 112 270 375 23 271 51 305 272 41 112 274 375 23 275 51 305 276 41 112
    – Igor V.
    Jun 26, 2021 at 21:45

1 Answer 1

13

The metadata as printed by exiftool is part of the file-data. I.e:

$ diff <(exiftool old.m4a) <(exiftool new.m4a)
2c2
< File Name                       : old.m4a
---
> File Name                       : new.m4a
18,19c18,19
< Create Date                     : 2020:12:31 18:13:30
< Modify Date                     : 2020:12:31 18:13:34
---
> Create Date                     : 2021:06:26 18:57:37
> Modify Date                     : 2021:06:26 18:57:41
32,33c32,33
< Track Create Date               : 2020:12:31 18:13:30
< Track Modify Date               : 2020:12:31 18:13:30
---
> Track Create Date               : 2021:06:26 18:57:37
> Track Modify Date               : 2021:06:26 18:57:37
40,41c40,41
< Media Create Date               : 2020:12:31 18:13:30
< Media Modify Date               : 2020:12:31 18:13:30
---
> Media Create Date               : 2021:06:26 18:57:37
> Media Modify Date               : 2021:06:26 18:57:37

(This is after making both files have same file dates - as in dates stored on disk - not the meata-data stored in the file)

When md5 sum is created all data is used. As bytes differ, check-sum differ.

That said; the audio data is the same.


Besides the cmp you can do a hex dump to view the raw diff.

For example (skip first 50 bytes, max 300 type hex ):

$ diff <(od -j 50 -N 300 -t x1 old.m4a) <(od -j 50 -N 300 -t x1 new.m4a)
1c1
< 0000062 00 00 dc 13 c5 4a dc 13 c5 4e 00 00 ac 44 00 71
---
> 0000062 00 00 dc fd 29 21 dc fd 29 25 00 00 ac 44 00 71
8c8
< 0000242 68 64 00 00 00 07 dc 13 c5 4a dc 13 c5 4a 00 00
---
> 0000242 68 64 00 00 00 07 dc fd 29 21 dc fd 29 21 00 00
14,15c14,15
< 0000402 00 20 6d 64 68 64 00 00 00 00 dc 13 c5 4a dc 13
< 0000422 c5 4a 00 00 ac 44 00 71 bc 00 55 c4 00 00 00 00
---
> 0000402 00 20 6d 64 68 64 00 00 00 00 dc fd 29 21 dc fd
> 0000422 29 21 00 00 ac 44 00 71 bc 00 55 c4 00 00 00 00

For example:

OLD: 00 00 dc 13 c5 4a  dc 13 c5 4e 00 00 ac 44 00 71
          |___________||___________|
---
NEW: 00 00 dc fd 29 21  dc fd 29 25 00 00 ac 44 00 71
          |___________||___________|

Then by converting to dates:

m4a uses Apple Mac OS X HFS+ timestamp (number of seconds since midnight, January 1, 1904, GMT).

old:
dc 13 c5 4a => 3692283210 => Thursday, December 31, 2020 18:13:30
dc 13 c5 4e => 3692283214 => Thursday, December 31, 2020 18:13:34

new:
dc fd 29 21 => 3707578657 => Saturday, June 26, 2021 18:57:37
dc fd 29 25 => 3707578661 => Saturday, June 26, 2021 18:57:41
2
  • what an impressive forensic !
    – Archemar
    Jun 27, 2021 at 6:02
  • It's delightful to, not only solve the problem, but learn something new with answers like this one.
    – Igor V.
    Jun 27, 2021 at 12:45

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .