Return to Digital Photography Articles
JPEGsnoop - Options
This page details some of the main options you'll find in JPEGsnoop
Return to JPEGsnoop Main Page
Documentation
JPEGsnoop is very easy to use... quite simply:
Steps to Process a File
- Select the decoding options under Options->
- Open your JPEG file with File->Open...
- Save the output with File->Save Log... if desired
Alternately, you can drag-and-drop a JPEG file onto the JPEGsnoop icon or main window and have the report automatically generated. Opening a JPEG file will automatically start the decoding process and generation of the log file.
Decoding Options
There are several options you can enable in decoding the JPEG file. These display additional information about the JPEG file. If the Auto Reprocess option in the Configuration window is disabled, then any changes to the Options below will not be reflected in the log until either a new file is opened, or you manually File->Reprocess.
- Hide unknown EXIF tags - This option will turn off decoding of EXIF tags that are not currently known in JPEGsnoop's database.
- DHT Expand - Expands the JFIF Huffman code table into the actual list of variable-length binary strings that are searched during the decoding process. This is a much more human-readable form of the huffman code list.
- Scan Segment - Decode Image - This option turns on the real decoding of the Scan data segment. In doing so, several checks are performed to ensure that all the variable length codes are valid and that there is no data corruption. It also performs the color conversion step from YCC to RGB and reports any color channel clipping.
- Scan Segment - Histogram RGB - If Decode Image is enabled, the Histogram RGB option will show a histogram for the RGB components, in addition to the reporting of any YCC/RGB clipping. Note that this option slows down the color conversion process (and is off by default).
- Scan Segment - Histogram Y - If Decode Image and Histogram RGB options are enabled, the Histogram Y option will show a histogram depicting the luminance (Y) DC component of the image. In addition, a full 2048-bin histogram dump is written to the log file. This dump shows the number of MCUs (8x8 pixel blocks) that exist in the (DC) image for each intensity level (-1024 to +1023). Counts are written in hexadecimal notation.
- Scan Segment - Full IDCT - When this option is enabled, the scan decode process does a full IDCT (Inverse Discrete Cosine Transform) to generate the high-resolution image view. Both the DC and AC coefficients of each MCU is computed. This mode is computation-intensive and can be slow.
- Scan Segment - No IDCT - When this option is enabled, the scan decode process does not do IDCT, and can produces a low-resolution image view. Only the DC coefficients of each MCU is computed. This mode is much faster than the IDCT mode but the result is low-res and less accurate. Default mode of operation.
- Scan Segment - Scan Dump - Enabling this option dumps out the first 640 bytes of scan data (in the Start of Scan (SOS) segment) in hexadecimal, after byte stuffing has been handled.
- Scan Segment - Detailed Decode... - Use this option to dump out detailed info about the Huffman VLC (variable-length codes) that make up the Scan bitstream. This is extremely useful for those who are trying to understand JPEG compression at a low level or build their own encoder/decoder. A dialog box will ask you for a starting MCU coordinates and MCU length. Prior to entering the dialog box, you can mouse-over or click in the area of the image that you want to start decode, and take note of the MCU X & Y coords. Enter these values into the dialog and then hit Reprocess or Open a new file to see the results. The detailed decode is included in the Start of Scan segment in the log.
Note: The DC component shown in each DCT matrix is the DC contribution from the current block -- it does not represent the running DC total (ie. the inverse DPCM step). - Maker Notes - Decode the Maker Note section (manufacturer-specific data) if it is a make supported by JPEGsnoop. As some cameras store a lot of unknown data in this section, you may want to disable it to avoid clutter.
- Configuration - Opens a window where you can set a number of additional options. Please see the Configuration Window section below.
- Check for Updates - This will manually check the ImpulseAdventure.com website for newer releases of JPEGsnoop.
Note that the image and histograms are only displayed if Decode Scan Image is enabled.
Tools Menu

- Image Search Fwd - Searches in the most recently opened file from the current file position forwards, looking for the next potential embedded JPEG image. This command is searching for the SOI (Start of Image 0xFFD8) marker, and may encounter the occasional false positive.
- Image Search Rev - Same as SOI Search Fwd, but in the reverse direction.
- Lookup MCU Offset... - Enter a pixel coordinate, press Recalc and determine the file offset to the start of the MCU! This is extremely useful for locating sections of a corrupt JPEG. Note that offsets are provided in the format: 0x<byte position in hex> : <bit position> . In other words 0x0000C832:4 means that the MCU starts at file position 0xC832 (or 51250) bytes, at the 4th bit (from the most significant bit). The MCU positioning is also displayed automatically in the lower image window's status bar when the mouse moves across the image window.
- File Overlay... - NOTE: This function will be described in greater detail in a later release, but it can be used a number of different ways, including the ability to fix corrupt JPEG files. Enter a file position offset, click Load Original (to see the current value) and then have the ability to overwrite these values with new hex values (no spaces between bytes). Click on the Enabled checkbox to have this overlay used for further decodes, or uncheck it to disable it. Specify the number of bytes to overwrite (up to 8).
- Search Executable for DQT - Allows advanced users to identify compression quality tables within an executable or library. For more imformation, please see the section in the Interesting Uses page.
- Export JPEG - Attempts to export the JPEG image that has been decoded at the current file offset (e.g. after Image Search or File Offset). This can be used to extract JPEG thumbnail images, extract AVI MJPEG frames, etc. The user will be presented with a dialog that asks whether or not the default MJPEG DHT tables should be inserted (for AVI frame export) and whether or not any user-defined file overlays will be used to generate the output.
- Add Camera / SW to DB... - Add the compression signature of the image to the database! This shared database is used to determine what digital camera (or photo software) was used to create the image. The database is growing and will be constantly updated by other JPEGsnoop users. Please only add a camera compression signature to the database if you are reasonably sure that the image is direct from the camera (i.e. not processed or edited in any way) or processed from a known software program. When submitting the compression signature, absolutely no image content or EXIF data is recorded -- only the compression statistics and quality setting.
- Manage Local DB If you want to clear out the user database (for example, if you have added incorrectly-described signatures), or simply remove a single entry, this option will bring up a dialog box that lets you delete one or more entries.
Note that you can hold down the control-key shortcuts (Ctrl-2 or Ctrl-1), which will step through a file at high speed. For MotionJPEG AVI files, this will play the video while decoding the tables and histogram!
View Menu
- Image Chan - Select the channel to display in the image area. You can select full-color RGB or YCC in addition to the individual sub-channels: R/G/B or Y/Cb/Cr.
- Image Zoom - Selects the zoom level in displaying the DC component image. At 12.5%, each 8x8 pixel block is represented by a single pixel. At 800%, each image pixel is represented by an 8x8 pixel region.
- Overlays - MCU Grid - Toggles the display of the MCU grid. The grid marks the MCU boundaries in the image, according to the current chroma subsampling levels. Pressing Ctrl-G will toggle the display of the grid. Note that the grid is automatically hidden when the zoom level is less than 100%.

File Menu
- Offset... - Allows you to specify a starting offset for the JPEG decoding process. In the dialog, the default is for entry in hexadecimal notation, but you can click on the decimal radio button to convert.
- Reprocess - Reloads the last file and reprocesses the image with the current set of configured options. Note that this is not necessary if the Auto Reprocess option under Configuration is enabled.
- Print - Standard printing support for the main report window.
Command Line Invocation
As requested by some users, command-line execution is supported. You can enable most options from the command line and generate the unlimited output file automatically. Example:
JPEGsnoop.exe -i c:\temp\20050203_1234.jpg -o c:\temp\20050203_1234_snoop.txt -nogui
The above will open up the JPEG file located at c:\temp\20050203_1234.jpg, write out to the log file c:\temp\20050203_1234_snoop.txt and do this without bringing up the GUI (application window).
Other options include:
- -i fname - Opens JPEG file named fname for processing.
- -o fname - Opens text file named fname for the generated output log file.
- -nogui - Performs the command-line actions without leaving open the application window. If you don't specify this option, the command line options are still performed, but the application window will be left open.
- -scan - Enables Scan Parse mode.
- -scandump - Enables Scan Dump mode.
- -histo_y - Enables Luminance Histogram Dump mode.
- -dhtexp - Enables DHT Expand mode.

Reader's Comments:
Please leave your comments or suggestions below!is it possible to run 'extract all jpgs' from a command line? i'd like to batch run that command on all 500 of my corrupt photos. thanks
i expected to get some negative values for some of the coefficients but jpeg snoop gave me all positive integer values .
So when i plotted the histogram , i did not get the expected gaussian histogram shape. please help.
i need it for a class i teach :)
DCT Matrix=[ -825 -75 6 50 -49 24 0 0] [ 12 52 -4 -36 40 -17 0 0] [ 4 12 5 -7 0 0 0 0] [ -12 -5 -7 18 -15 0 0 0] [ -10 -7 0 0 0 0 0 0] [ 0 0 0 0 0 0 0 0] [ 15 0 0 0 0 0 0 0] [ 0 0 0 0 0 0 0 0]Hope that helps!I have over 200 images from a trip to Rio de Janeiro Brazil that I CANNOT lose. Someone please help?
Firstly congrats on the baby; I hope that you're not having too many sleepless nights (I'm a dad of one ;)).
It's unfortunate (for me) that I've stumbled across this program after a major catastrophe with a CF card and my daughters birthday. I'm trying to repair the saved files (which of course are corrupted >( ). I have 2 questions for you: Firstly when JPEG snoop cycles through the files and comes up with a message e.g. Expected marker 0xFF, got 0xDB @ offset 0x0000D1B5, how do I interpret that location in a hex editor? And could you explain it for someone who is a complete newbie to this side of photography and understands the basics (very basics) of programming.
The second question is if the beta version still requires a novice tester would you be willing to let me loose on a copy of it?
Thanks in advance
Greetings from Vienna/Austria.
PS: A baby? Grats :)
Thanks!
THanks
I'm looking for version 1.5.3 you mentioned below, which supports the option to extract all embedded images and rename sequentially, but on your website I find only 1.5.2. Where can I find this version?
Thanks for this great software!
I want to know how to detect if a picture has been retouched.
thank you
"Perhaps the option would extract all embedded images and rename sequentially"
Yes !! Please implement this. I will personally pay pal you $20 for this addition.
I specifically wish to extract all frames of a corrupted mjpeg video file from a recovered image of a corrupted SD card. It works one by one but would take me forever to extract all frames of my video.
Note: please ensure the names are 8 digits or more ie. 00000001.jpg
Thanks and keep up the awesome work !!
[UPDATE 08/25/2011: This feature has been added to release 1.5.3 of JPEGsnoop!]
How does one indentify the date the photo was taken; where does it appear in the meta data? Thanks.
Could you point me in the right direction as to how this works?
i m doing a project on steganalysis of jpeg images using huffman bit code length statitistics. For all the diff. same resolutionstego images i m getting same huffman table. i hv used the LSB steganography algo. Please help me in analyzing HBCL statistics....
I have four corrupt photos, and the lower 3/4 of each picture is solid grey.
When I load them up in JPEGSnoop, the pictures are still 3/4 grey until I run 'Tools > Image Search FWD', then the whole image is displayed but is massively reduced in size.
Is there any way of preventing this downsizing of my image? I am VERY impressed that JPEGSnoop has managed to recover the missing sections of my images, but I would be even more impressed if I could keep them at their correct size.
Is this possible? Any advice would be greatly appreciated.
Thanks.
I'd like to use JPEGsnoop in batch mode for WinXp sp3 like here:
for %%f in (*.jpg) do jpegsnoop.exe -i %f -o %f.log -nogui -scan
with additional batch option for Image Search Fwd.
ur website is very useful for developing softwares working with images.thx a lot...
i think i finally solved the subsampling stage. i duplicate the values in pixel 0,0 to the 2x2 area vertically and horizontally. i read in your articles in jpeg huffman coding on the DCT to RGB section. you said that there is a gain of DCT transform. how do i know the gain of dct transform? is this information provided by jpegsnoop?
i am doing a project to decode JPEG files. i did all correct untill the quantization stage. i compare the values i get with the values decoded by jpegsnoop. but i dont know about the idct stage, coz jpegsnoop doesnt show the results of the idct stage.
i realized that before doing the idct stage, i need to do something about the chroma subsampling involving the Cb and Cr blocks. how do you make the 8x8 block of Cb and Cr into 16x16??
A question: Can I delete some data from the jpg like all "Photoshop" tags?
Thank you for this great tool!
Toddie
I really enjoy your site and insight. I was wondering if you could program a software that detects broken JPEGs in a multiple folders (recursive) much like this Japanese program I found from 90s: http://jpeg-checker.jp.brothersoft.com/download/ - The company making this software (Mity Software) quit and this is the only download link I was able to uncover.
You basically give this software a folder to start with and it runs through every single image in that folder and its subfolders and creates a neat sortable report on which images are missing EOF markers or have any other problems.
I work with hundreds of thousands of photos at an agency and that kind of a software can really come in handy for us and I'm sure others dealing with as many photos as we do. Sadly the Japanese software JPEG Checker is extremely old (and I don't know Japanese) so I go through it through intuition for the most part.
Please let me know if you would be interested in overtaking such a project.
I work with an organization of volunteers that handle cheating reports for a first person shooter game. I have to say your software is incredible and has been extremely helpful to us, however our administrators and the staff that use the software do not have the skills to take full advantage of the software.
We use JPEGSnoop to check for images altered after they where generated by either the FPS game itself or a popular in game screen shot software like xfire or fraps.
We have looked at creating special db entries for screen shots taken directly from those sources and I would like to know if you have any plans to create a db of commonly used editing software publicly available or any suggestions on how precisely identify the source of an image that is already processed.
Thanks!
I have several jjpeg's I am checking out, would you know of a way to be sure all the pictures came from the same pc, they all are the same size and have the same compression signature, are there other things I can check.
Thanks for great website. I enjoyed a lot. Your trips were amazing and your photos are really interesting too. Lucky you!
I've searched so much in JPEG. I think you know it completely.
I've read a lot about header, and I know it as well, but I can't find any things about MCU. JPEGsnoop has a tool named "Lookup MCU offset". It determines the file offset to the start of the MCU. It is a great job, but I didn't know how to determine the start of each MCU programmatically? (I got that is possible.) I don't know what is separator data between MSUs, which My program have to recognize it.
I also have another question. For example if first MCU started at (n)th byte, and the second one started at (n+X)th byte. How could I have RGB data for 8*8 pixels from X byte data in this MCU? I want to get pixels data from MCU like GetPixel() method in Bitmap class.
Everybody says (like you) MCUs are independent, but when I write header and then add all MCUs in a new file, there is no problem, but if I write header and skip from first MCU, then add the others in a new file, my new file doesn't have correct color around first MCU. It means that second MCU depends first MCU.
What is language of JPEGsnoop?
Would you please help me. I'm really confused.
Regards
Zari
JPEGsnoop is really a MUST HAVE software to understand jpeg quality of JPEG pictures, "Bravo". One suggestion: could JPEGsnoop remember it's window size / position and size of the bottom part at start-up?
JPEGsnoop terminal font blocky
Courrier New is installed, and works fine in other programs. In fact, I'm using it in the text editor that I copy and paste the results into. I tried the installer you linked to, but it didn't fix the issue, even with a reboot.
I did discover the source of the problem though, or at least why the Terminal font isn't being displayed properly. See the third paragraph in the font's Wikipedia article...
http://en.wikipedia.org/wiki/Terminal_(typeface)
My 'Language for non-Unicode programs' setting in Regional and Language Options isn't set to English, which results in the Terminal font not displaying correctly in JPEGsnoop. When I set it to US English and reboot, the output appears as it should, though that's not exactly an ideal solution. It doesn't really explain why it's attempting to load Terminal in the first place either.
Aside from that, it's a great utility. : ) I'd only suggest displaying the most relevant info, like detected compression levels and whether the file has been edited, in a summary view that can be taken in at a glance. The detailed log view is great to have, though I'm guessing the vast majority of people using this program would rather not have to wade through all that information most of the time. Nice work though, and I look forward to future updates!
PS: I moved the link to your screenshot to my local server so that you don't have to maintain it further.
Great tool!! I am investigating a project that involves Lossless JPEG (SOF3) and I was wondering if you had any plans to support it in the near future?
Again, great tool!!!
Thanks!
Is there any way to choose font in the main window? somehow my pic has ugly, blocky, unreadable terminal font, and i cannot read what they say. i can read it if i copy paste the text to some other software.
Or if you could point me how to fix this problem of my computer, that is even better...
http://prdownloads.sourceforge.net/corefonts/courie32.exe?download
Hope that works for you.
I have 350 photos that were corrupted when I pulled the memory card out of the built-in card reader on my PC. I learned my lesson the hard way! I erased the card and wrote over it. But I was able to recover 2 of the 350 photos. So, I am using Hex Workshop to compare one of the corrupted jpegs to its exact recovered jpeg. There were 11 instances where the data was different. Each instance there were 4 bytes that were incorrect. They were copied from the previous 4 bytes and all located at different XxXXXXXXFC through XxXXXXXXFF locations.
for example:
at location 0x001DD3F8 though 0x001DD3FF on the corrupt jpeg
F9 59 19 87 F9 59 19 87
same location on the exact recovered jpeg
F9 59 19 87 28 DB B0 FC
Using your jpegsnoop i am able to find about half of these copied/corrupt instances. Is there a way to scan the jpeg data to find all of these corrupt 4 byte copied instances? Then, if I can isolate all instances, how do I determine the correct new data to input.
Sorry, if my lingo is a little off. I know nothing about this...I just like a good time consuming challenge!
I can send you a the corrupt and recovered image I am speaking of. FYI all 350 corrupted photos were taken from a static tripod. I was doing a time lapse photo shoot of a retail space that I was building out.
Thanks,
Steve
The type of occurrence you're observing in the data is typical of a "buffer underrun" event (the transfer process ran out of data and so it replicated the previous 32-bit data word). JPEGsnoop may identify some of these, but only if they have triggered a decoding error (which is not guaranteed). In some cases, you may be able to correct this type of situation by deleting those 4-byte sections, but that is not generally the case. Trying to determine the data to replace is a very difficult process!
I have the problem with greyed out portions on MANY photos I transferred to a USB Hard Drive. I understand that some may be recovered by copying header data from a nearby photo but I'm unsure exactly how I can use your program to identify the start and finish of a header, AND exactly how much of a header to overwrite.
Any help would be appreciated.
Thank you so much!
An upcoming version of JPEGsnoop will automate this process, so the tedious steps below will not be required!
The answer to the first part of your question is easy: open a "good" image in JPEGsnoop, taken with the same digital camera, in the same "orientation" (ie. portrait versus landscape), and then scroll down to the line:
The above indicates that the header ends at 0x42D4 and the main scan data section starts at 0x42D5 (generally). This implies that we may be able to reuse the portion of the file from 0x0000 to 0x42D4 (inclusive) as the replacement header for a file whose header has been damaged.
Now, for the more difficult part, we'd like to figure out what to replace in the damaged file. Unfortunately, damaged files can come in an infinite variety, with key markers missing, so there is no simple way to determine what has been damaged and what remains valid. Similarly, it is not always easy to locate the end of the header to replace.
However, to keep things very simple, let's take the scenario where only a small amount of the damaged file's header has been corrupted. In this case, JPEGsnoop should be able to parse most of the header (of the damaged file) and report the position of it's Start of Scan (SOS) marker.
In this example, I might see the following reported by JPEGsnoop (in the damaged file):
Using a backup of the damaged file, open it up in a hex editor of your choice. With the above information, I know that I will have to replace the file contents from 0x0000-0x4F28 of the damaged file with the section 0x0000-0x4D24 of the good file. After saving, reopen the file in JPEGsnoop and see if the file can be processed.
As mentioned earlier, this type of "repair" is very basic and can only address a very small fraction of damaged files, but in some cases it is sufficient. I plan to add a more advanced form of header repair in upcoming releases of JPEGsnoop, so stay tuned.
The Img Search Fwd states the file was not found, but i have it on my desktop. I dragged it into the JPEGsnoop window and when I try to open folder from JPEGsnoop it cannot be located either.
What could be the problem? Is there any way someone could TeamViewer with me and help me work the application?
I just can't export the file, so I can view it in other programs. Any tips?
If it doesn't view well in other programs, then it is likely that there was some type of corruption or error in the file. An upcoming version of JPEGsnoop adds in TIFF export which will enable you to open the resulting file in other software as well.
Thanks!
The above should search through all JPG files in a directory, run JPEGsnoop on them and save the report with a ".log" extension, but using the command-line interface is not ideal. I may provide true batch capability in the future which would be a lot more flexible and useful for your needs.
If no, is there an alternative tool for jpeg file analyze directly on phone mobile and that Mobile forensics consider valid?
Thank for support.
it is possible discovering by metadata if data creation of image file has been modified after photo has been done with a mobile phone?
Thank
have some wierd jpeg with few missing markers (from storage thumbs.db some odd version of it) aparently there are 4 channels in this files:
original :
*** Marker: SOS (Start of Scan) (xFFDA) ***
OFFSET: 0x00000018
ERROR: SOS before valid DHT defined
now I've manually rebuilt header+DHT+quant
*** Marker: SOS (Start of Scan) (xFFDA) ***
OFFSET: 0x000001D1
Scan header length = 14
Number of img components = 4
Component[1]: selector=0x52, table=0x00
Component[2]: selector=0x47, table=0x00
Component[3]: selector=0x42, table=0x00
Component[4]: selector=0x41, table=0x00
Spectral selection = 0 .. 63
Successive approximation = 0x00
NOTE: Scan parsing doesn't support CMYK files yet.
any chance we get support for 4 channel or any tips how to do it since my image looks very wierd when loaded via .NET 2.0 into Image object. and I am becomming clueless since image channels are wrong, think format inside this JPEG file is ABGR and I need RGB or some other wierd conversion is needed.
any chance to swap channels in file prior to parsing?
some small example would be nice
big thanks
//SA
In your case, the SOS component identifiers seem to imply RGBA.
I'll add 4-channel decode to my to-do list. I don't imagine it would be that hard to do, but in all honesty I rarely ever run into these examples. The challenge would be to extend the decoder while still maintaining the decoder's memory footprint for 3-channel images. I'll revisit the code and give it some thought. thx.
could you telll us what constitutes HD Jpeg and can the Jpeg snoop tell if it is a HD Jpeg file ?
I would like to see the original article, where you explain the decoding process with a very simple image composed only with a black square adjacent to a white square. Thanks.
Will
Can this program dump all pixels to a db so I can find the brightest pixel(s) with VB or UBasic? (From email: Is there any way that the JPEGSnoop can reveal the brightest pixel ? I've come up with an idea to re do the famous M&M experiment and need some software to do this hopefully in a batch command line mode or in a stream)
NOTE: Image repair requests are not accepted. Thanks for your understanding.