iOS 11: HEVC and HEIF (heic) files
In a previous post, we took a look at some of the features of the iPhone X and the Apple Watch Series 3 which were announced in September 2017. During the same event, Apple showed off the latest version of its operating system for iPhones and iPads, iOS 11. One of the many changes in iOS 11 is the adoption of a couple of new media file formats: the ubiquitous JPEG and H.264 (MPEG-4 AVC) have been replaced by HEIF and HEVC respectively.
HEVC, which stands for High Efficiency Video Coding, is a video standard (ITU-T Recommendation H.265 and ISO/IEC International Standard 23008-2 / MPEG-H part 2) designed to succeed the previous generation of video standards such as H.264/MPEG-4 AVC. For similar quality videos, H.265/HEVC can offer about double the compression as H.264/AVC. bbc.co.uk
HEVC files created on iOS 11 are saved using the “.mov” file extension. The following is a non-exhaustive list of platforms and programs which support HEVC-playback: iOS 11
macOS 10.13 (High Sierra)
HEIF, which stands for High Efficiency Image File Format, is a container format (ISO/IEC 23008-12 / MPEG-H Part 12) for storing individual images, image sequences and their metadata. [Nokia Tech] Picture files created using iOS 11 store HEVC encoded data in HEIF containers, with the file extension “.heic”. The immediate benefit to users is that a picture will be about half the size of its JPEG equivalent, but the new format may allow other new features in the future:
Since it can store image sequences, HEIF files could be used to support features such as burst mode. [Support Apple]
Similarly, a file which has been edited (e.g. cropped) could contain previous versions of the picture.
It has the capability to replace GIFs or to be used to store Live Photos. [Support Apple]
If you’re wondering about pronunciation, at least amongst Apple employees, HEIF and HEIC are pronounced to rhyme with heef and heek.
The following platforms can support HEIF (.heic) files natively:
macOS 10.13 (High Sierra)
At the time of writing, there is no native support in any of the major Linux distributions or in Windows 10. The list of Windows programs which can handle HEIF files that I have been able to compile is rather small:
ExifTool 10.62 [Exiftool]
XnView 2.42 with a plug-in [Forum XN View]
MOBILedit Forensic Express 4.2 [Mobile DIT]
It appears that the XnView plug-in is based on source code published by Nokia whose licence [GitHub Nokia Tech] restricts its use to non-commercial purposes of evaluation, testing and academic research. I don’t have access to a licence for MOBILedit, so cannot verify its support for HEIF files.
Converting HEIF to JPEG
For Linux and Macintosh systems, heiftojpeg [GitHub] is a command line utility which can convert HEIF files to JPEG format, but it too is based on the parser published by Nokia and therefore cannot be used for commercial purposes. There are also several websites which offer HEIF to JPEG conversion online. Neither of these are suitable options for our needs.
One solution in the short-term, until image viewers and forensic tools add support, might be to use the iPhone/iPad itself to do the conversion:
There is a setting in iOS (Settings → Photos) which dictates whether photos copied to a computer are kept in their original format, or automatically transcoded to a compatible format. As illustrated in the following screenshots, with the default setting of Automatic, iOS automatically presents a JPEG file (6.2 MB) to a Windows PC. The Keep Originals setting results in a HEIF file (3.1 MB) being made available instead. Both files contain similar EXIF metadata.
A backup created using iTunes or a forensic tool will however contain the original HEIF files.
We still have much to learn about these new file formats and their adoption is bound to grow. They will provide many benefits to end users, but we may have to wait a little while before digital forensic tools as well as non-Apple operating systems catch up.
Principal Analyst (Research & Development)