Matroska (.mkv) and WebM (.webm) are the same EBML container, and it is unusually talkative about how it was made. The muxing software records itself in fine detail - often the exact version and the date its build was compiled - and because Matroska can carry whole files as attachments, a video can smuggle documents, fonts or images that no player ever shows. Chapters, track names and container tags are all typed by a person and frequently name the source.
Scan a Matroska (MKV / WebM) fileThe clearest fingerprint is the writing application. Matroska muxers identify themselves far more precisely than most formats: a real mkvmerge string can include the version, the release codename and the exact date the build was compiled, which narrows down the software installed on the machine that produced the file. The muxing library is recorded separately, an ffmpeg-produced WebM stamps its Lavf version, and a container creation date (DateUTC) records when the file was written - a value copying does not change.
Attachments are the surprise. Matroska can embed any file inside the container, and while subtitle releases legitimately carry font files so styling renders the same everywhere, the same slot can hold documents or images that travel inside the video unnoticed. The scan lists each attachment with its declared media type and total size, flags any non-font attachment as higher risk, and specifically calls out a file named like a font but declaring a different type - a deliberate attempt to make something non-routine look routine. Human-written attachment descriptions are surfaced too.
Chapters and track names are authored by whoever built the file. Chapter titles routinely name scenes, places and people, and the scan also reports chapters flagged hidden - present in the file but kept out of the player's menu. Track names are typed by the assembler and often describe the source or the person who made it. Container tags whose names identify a person or origin (artist, author, director, encoded_by, copyright, owner and the like) are pulled out separately, and a LOCATION tag holding real coordinates - which ffmpeg writes when remuxing a phone video - is parsed as GPS.
The container also exposes structure a player hides. A file split into parts records its own segment UID plus the UUID and filename of its neighbours, which names sibling files that are not present and leaks the naming scheme and folder layout used to split it. Encrypted tracks are reported with their algorithm, AES cipher mode and key-ID length, and a segment can still carry the original filename it was written with, surviving any later rename.
This is a selection. The full field manual documents the fields read from each format.
The muxing software (often with its exact version and build date), a creation date, chapter titles, track names, container tags, and any files attached inside the container. It can also carry real GPS coordinates when a phone video was remuxed into it.
Yes. Matroska attachments can hold any file type. Subtitle releases legitimately embed fonts, but the same mechanism can carry documents or images that no player displays. The scan lists every attachment and flags non-font files and any font-named file that is really something else.
A lot. Matroska muxers record themselves in unusual detail - a real string can include the version, the release codename and the date the build was compiled, which narrows down the exact software on the machine that produced the file.
No - WebM is a Matroska profile using the same EBML container, so the same fields apply. The main tell is the writing application: an ffmpeg-produced WebM records its Lavf library version, which dates the ffmpeg build used.
This tool views metadata rather than stripping it in the browser. Locally, remuxing with mkvmerge or ffmpeg lets you drop tags, chapters and attachments, but the writing application then records your muxer - the fingerprint moves, it does not vanish.
File X-Ray reads Matroska (MKV / WebM) files entirely in your browser - the file never leaves your device. For this format you can also download a clean copy with the metadata removed. Scan a file now.