I am not aware of an defining document for the NEC protocol, sorry. Many are referring to San Bergman's text
[Link: sbprojects.net] , but it is clearly not a defining document. Another document is
[Link: techdocs.altium.com]Regardless of parametrization, there is a payload of 32 bits. Following Bergman (section "Extended NEC Protocol"), we take the first 8, ordered as LSB first, as "device" ("D"), next 8 as "subcommand") ("S"), and the next 8 bits as "function" ("F"). Last 8 bits are the (one) complement of the F. (There are some variations though).
Of course, it is possible to make your own interpretation of the 32 bits. Particularly popular ( :-) ) it appears to use MSB-first representation. Note that there is a priori no way to tell if, e.g. "0100000" denotes 64 with MSB-first, or 3 LSB-first...
What is the difference between NEC and NEC1 as seen in IrScrutinizer?
There are different methods a NEC signal can repeat. Using the method in the second link, we call that protocol NEC1. If a captured signal is not containing any repeat at all, it is probably an incomplete capture, and called "NEC".