I am doing a forensic analysis of an AVI file that appears to have been created with Adobe Premiere Pro. My documentation on AVI file format does not include some of the material I have found.
The file begins with RIFF (size) AVI . The next element is a LIST (size) hdrl. Then the avih header. Then a LIST (size) strl, containining two stream header lists. Then I expected a chunk beginning with a FourCC code of "odml", but I encountered a chunk with a FourCC code of "PrmL" of size 282 bytes. Inside this 'PrmL' is a piece of information that may be evidentiary, but I have no way of explaining how this 'PrmL' chunk is written by Premiere Pro. Following this is another chunk with the FourCC code of 'cr8r', and then another with FourCC code of 'JUNQ'. After that, the data streams begin.
Is there anyone out there with a full understanding of AVI file structure that can explain the 'PrmL' chunk for me?