Return to Digital Photography Articles

JPEGsnoop 1.7.3 - JPEG File Decoding Utility

by Calvin Hass © 2014

JPEGsnoop is a free Windows application that examines and decodes the inner details of JPEG and MotionJPEG AVI files. It can also be used to analyze the source of an image to test its authenticity.

JPEGsnoop Program Icon

Overview

Latest Version: 1.7.3


Introduction

Every digital photo contains a wealth of hidden information -- JPEGsnoop was written to expose these details to those who are curious.

Not only can one determine the various settings that were used in the digital camera in taking the photo (EXIF metadata, IPTC), but one can also extract information that indicates the quality and nature of the JPEG image compression used by the camera in saving the file. Each digical cameras specifies a compression quality levels, many of them wildly different, leading to the fact that some cameras produce far better JPEG images than others.

What can I do?

Check out a few of the many possible uses for JPEGsnoop!

One of the latest features in JPEGsnoop is an internal database that compares an image against a large number of compression signatures. JPEGsnoop reports what digital camera or software was likely used to generate the image. This is extremely useful in determining whether or not a photo has been edited / tampered in any way. If the compression signature matches Photoshop, then you can be pretty sure that the photo is no longer an original! This type of analysis is sometimes referred to as Digital Image Ballistics / Forensics.

JPEGsnoop reports a huge amount of information, including: quantization table matrix (chrominance and luminance), chroma subsampling, estimates JPEG Quality setting, JPEG resolution settings, Huffman tables, EXIF metadata, Makernotes, RGB histograms, etc. Most of the JPEG JFIF markers are reported. In addition, you can enable a full huffman VLC decode, which will help those who are learning about JPEG compression and those who are writing a JPEG decoder.

Other potential uses: determine quality setting used in Photoshop Save As or Save for Web settings, increasing your scanner quality, locating recoverable images / videos, decoding AVI files, examining .THM files, JPEG EXIF thumbnails, extract embedded images in Adobe PDF documents, etc.

Trying to Undelete or Unformat your Photos?

If you're interested in trying to recover your deleted / corrupted photos, check out my new page on recovering deleted photos.

File Types Supported

JPEGsnoop will open and attempt to decode any file that contains an embedded JPEG image, such as:

  • .JPG - JPEG Still Photo
  • .THM - Thumbnail for RAW Photo / Movie Files
  • .AVI* - AVI Movies
  • .DNG - Digital Negative RAW Photo
  • .PSD - Adobe Photoshop files
  • .CRW, .CR2, .NEF, .ORF, .PEF - RAW Photo
  • .MOV* - QuickTime Movies, QTVR (Virtual Reality / 360 Panoramic)
  • .PDF - Adobe PDF Documents

* Note that video file formats (such as .AVI and .MOV) are containers, which can include video streams encoded in one of a wide variety of codecs. JPEGsnoop can only interpret this video footage if the codec used is based on Motion JPEG (MJPG).

Download the Latest Version of JPEGsnoop!


Click to Download .ZIP 		Version: 1.7.3
Version History

Released: 09/28/2014
Downloads: 410344

JPEGsnoop by Calvin Hass

Help Support JPEGsnoop Development

If you have found JPEGsnoop useful and would like to support its continued development, consider making a small contribution. Donations will help encourage me to add new and interesting features. Found an interesting use for the tool? Let me know!

Source Code: JPEGsnoop is now Open Source!

System Requirements

This application has been designed and tested to run on Windows XP, Windows Vista and Windows 7. As of version v1.7, Windows XP SP1 is a minimum requirement. JPEGsnoop is fully portable, so it does not require any installation!

LINUX users: JPEGsnoop apparently works on LINUX under wine

Mac users: JPEGsnoop works within CrossOver Mac

Terms of Use

JPEGsnoop is free for personal and commerial use. Commercial users are encouraged to leave me a brief private message so that I can understand your needs and make future versions more useful.

Installation

No installation required. JPEGsnoop is very portable. Simply unzip the download and run!

Version History

For information about features added in previous versions of JPEGsnoop, please check out the version history page.

Feature Requests / Bug Reports

Please feel free to add your own feature requests or bug reports by submitting to the links on the JPEGsnoop Source page

Awards and Recognition for JPEGsnoop

  • PC Magazine - Utility Guide 2009 - July 2009
  • Win Magazine - May 2009
  • CHIP.de Magazine - Program of the Month - April 2009
    CHIP.de Magaine - Chip Pick - November 2012
  • Computer Bild Magazine - Issue 10/2009
Main Window
Channel Histograms
MCU Grid & Positioning

Documentation

Please see the options page for information on how to use JPEGsnoop and other interesting uses for the tool

Recent Features

  • Photoshop PSD decoding
  • Batch file processing
  • XMP APP1 & ICC Header display
  • IPTC and Photoshop IRB / 8BIM parsing
  • GPS EXIF metadata display
  • Full detailed Huffman VLC decoding output for those interested in writing a decoder or learning JPEG compression
  • Automatic display of YCC DC block values (16-bit)
  • MCU Grid overlay and automatic display of mouse MCU position and file offset in image display window.
  • Test overlay function enhanced to allow quick apply and binary code readout.
  • Image zoom level from 12.5% - 800%.
  • Extract embedded JPEGs -- can be used to extract thumbnails, hidden JPEG files, as well as frames from Motion JPEG AVI files.
  • Compression detection enhanced to detect rotated signatures, comment field.
  • Full AVI file parsing (to identify MotionJPEG)
  • DQT table searches in Executables (for "hackers")
  • Detect edited images or identify original digital camera that took a photo!
  • Integrated database of thousands of compression signatures (image fingerprint) for digital cameras and editing software
  • File overlay test function
  • Multi-channel preview: RGB, YCC, R/G/B, Y/Cb/Cr
  • Pixel position lookup into file offset
  • Examine Motion JPEG .AVI or .MOV (Quicktime) files (MJPG or MJPEG) and play through!
  • Examine any file fragments that may contain a JPEG image
  • YCC to RGB Color correction / clipping statistics reports
  • Command-line execution
  • Huffman variable-length code statistics
  • Expansion of DHT (Huffman Table Expansion into bitstrings)
  • Determine IJG JPEG Quality factor

Background Material

If you want to understand some of the technical details reported by JPEGsnoop, I suggest that you read through my articles on JPEG compression:

Suggestions

As this is a work in progress, I would be very interested in hearing from you, particularly for feature requests, suggestions, comments, bug reports, etc. If you currently use JPEGsnoop and find it useful, let me know!

 

Reader's Comments:

Please leave your comments or suggestions below!
2015-08-22John Anderson
 Hi Calvin,

Many thanks for a most useful analytical tool. I'm happy to make a donation to further development. How much do you suggest?

I have one question about JPEGsnoop. I tested the software with an image captured using a friend's Apple iPod. EXIF metadata confirms this. However, the compression signature is for a Konica Minolta camera.. Is it probable that both the iPod and the Minolta both use the same compression algorithm?

Look forward to hearing from you.
 Thanks for the kind feedback, John! Any help is always appreciated :) But I am also more than happy just hearing that the tool has been helpful for others.

What you have noted with the compression signature is exactly as you figured... for the particular image content and camera settings, both used the same compression table.

It is quite common to see a given table appear in multiple camera manufacturers... it could be that they reuse the same hardware image encoder or use the same library / reference tables. The notion of the compression signature being a "fingerprint" is a bit of a misnomer in that regard since there is considerable reuse.

If you don't see the Apple iPod in the list of matching signatures, then it would be best to add it (the result would be that you'll see both cameras listed as possible matches).

Hope that helps,
Cal
2015-08-06Adeen
 Hi,

I'm trying to detect if a PDF has been photoshopped.
I have a base PDF to compare it to.

What parameters should I be looking at?
 Are you trying to determine if a PDF file has been modified? Or if an image within a PDF has been altered (ie. "photoshopped")?

In this particular situation, could you clarify what you meant by the "base PDF" -- is it another PDF that should be identical to the second PDF (but you didn't notice any differences?) Sorry if I misunderstood the question.

If the PDF file was edited according to "spec", then it may leave some traces of edits (in a ModDate or generation numbers in the objects), but this isn't guaranteed.

If you are wondering about whether an embedded JPEG within a PDF file has been altered (since originally captured), then you can use the image search function in JPEGsnoop to find the image and then process it as normally (ie. compare compression signatures, etc.).
2015-07-26ebrahim
 hello,

i would test the version 1.7.4

suggestion:
add parameter to save the file when use
-ext_all
through cmd

also some pictures not ext_all through nogui only when i open it normally
 Hi there ebrahim! I have a given you a link to beta test version 1.7.5. It has a number of new features, in addition to a rewritten command-line interface that should operate better.
2015-07-24david
 Hi

PNG files don't work with this tool right?
 Hi David -- at this time, JPEGsnoop doesn't analyze PNG files but I could potentially add such a feature if there were enough interest.
2015-07-01Egon
 I couldn't view on my PC an image saved with Photoshop CS6 Mac. With some hex-editing I could manually extract only 2 previews from this file (one in PNG, the other in JPG) but they were low-res. So I opened my image with JPEGSnooper, then I used "Tools -> Image search fwd", finally I did a "Tools -> Export JPEG -> Extract All JPEGs" and voilà, I had 3 images: one of them was the hi-res JPEG. THANK YOU!!!!!!!!!!!
 Excellent! Glad to hear it!
2015-06-17Peter
 I downloaded version 1.7.3 and appears during startup crash - Win XP SP3 CPU support SSE - I suspect that it is a CPU with SSE2 instructions - last acting in my version is 1.6.1
 Hi Peter -- Thanks for letting me know about it. I will followup via email to help resolve it if I can.
2015-06-09Reziac
 Just came by to confirm URL so I can point someone here :)

I have a microscope-camera gadget called an "EyeClops" (I think it came from Toys R Us) that's not in your ID database -- do you want an image to check out?
 Hey thanks Rez! Sure, if you can email me a copy that would be great.
2015-05-17chris
 Hello,
I am having a hard time understanding all the codes. If I sent you a photo would you be able to decipher? All I want to know is if the photo is an original? And possibly the region it was taken.
Thank you.
2015-05-15Mke
 Hi,

I am trying to use your program to recover some corrupted jpeg. Everytime I try to open the jpeg i get this error "The Parameter is in correct"

can you please help. Thank you
 Hi Mike -- if you can contact me again and provide your email address I could take a look at the file to determine what might be happening. Thanks!
2015-05-07Chris
 Thanks!! I used the search forward option and it finds the largest JPG now however it always stops part way through the process and only displays partial. I can get the full thumb and full smaller JPG (only 55 KB) but process always stops suddenly when I search forward to the hi res JPG. Any thoughts or setting suggestions?

A couple sample images I am trying to recover can be found on my dropbox link at https://www.dropbox.com/sh/c4j0z5o3sy7exnb/AACXfEUOarN9iDu-hnIDsXTDa?dl=0

Great program! Just need to figure out how to get it to fully recover the hi-res versions.

Thanks in advance
Chris

*******************************************
Curious why when I export as JPEG it outputs a much smaller version of what the original image was. The original images are about 8MB in size while the output of snoop is only about 50 KB??

The reason for that is that most JPEG images (from a digicam) contain several versions of the same image. Generally you'll find a full-resolution image, a small thumbnail and sometimes a large thumbnail/preview. What you have encountered is probably a case where JPEGsnoop found the small thumbnail first (and extracted that). If you press "Search Forward" you might find that it could locate one of the larger images, thereby enabling you to extract that as well.
 Hi Chris --

Were the 3 files you posted from the output of a recovery program or were they direct from your hard drive / memory card? These files all exhibit a case of the file being a merge of multiple photos.

Long story short, the original images have been "spliced" causing only a small amount of data to be extracted. More advanced techniques are needed to get at the remainder of the data (dealing with fragmentation). But even then. you would not be able to fully recover the hi-res version -- your original images do not exist within these files.

More detail: JPEGsnoop's image decode only starts when it finds a proper header. When you perform "Search Forward", JPEGsnoop will seek the next valid JPEG header. In doing so, it is skipping over a very large amount of data that is in the file. This extra data is actually the remainder of another image data from your drive/card. It is possible to see this additional image data if one messes around with the headers.

Let's say that the original image was 8.6MB in size. In example "_SCN0336.JPG" we actually skip almost 7MB before we find the start of a valid image. That only leaves us with 1.6MB of image data before we get cut off. If we try to extract the image, we are only left with a small fraction of the original file. The extra 7MB is coming from a completely different hi-res file that happened to be on the card/drive.
2015-05-06Chris
 Curious why when I export as JPEG it outputs a much smaller version of what the original image was. The original images are about 8MB in size while the output of snoop is only about 50 KB??
 The reason for that is that most JPEG images (from a digicam) contain several versions of the same image. Generally you'll find a full-resolution image, a small thumbnail and sometimes a large thumbnail/preview. What you have encountered is probably a case where JPEGsnoop found the small thumbnail first (and extracted that). If you press "Search Forward" you might find that it could locate one of the larger images, thereby enabling you to extract that as well.
2015-04-27Alfredo
 Please see as the 'list of cameras detected by the software? If I go to Tools / Manage local DB the list is empty.
The DB is C:\Users\alfredo\AppData\Roaming\JPEGsnoop\JPEGsnoop_db.dat dimension 1 KByte.
 The list of cameras detected does not appear in the "user / local database". It is internal to the tool. What appears in the local DB are only the signatures that the user has captured.
2015-04-12Zvi
 I have an SD card with some RAW images (.CR2) and JPEG's that show the correct size but won't open (invalid image). Hex editor shows all zeros in these files. JPEGsnoop says "File did not start with JPEG marker" and [Tools->Img Search Fwd] did not find anything.

Is there ANY way to recover these files?
 Unfortunately, if the file content (as viewed in a hex editor) shows all zeros then there is no way to recover the image from the file itself. The best bet is to attempt a recovery from the source media (eg. hard drive or memory card) with a more sophisticated recovery program that is able to look beyond the "logical directory structure".
2015-01-16Scott
 Greetings. I need to determine if the date/time value in the exif metadata of an iPhone picture has Ben modified. I understand that it's a simple value to change, eg importing pics into iPhoto then gives user option to adjust the date/time a picture was captured. I'd like to be able to tell if this field has been edited before file dissemination. Is this something your program is capable of?
Thank you in advance.
 Generally, one cannot determine that an EXIF field has been edited since there is no redundancy or checksums to confirm that the current field content (such as date/time) matches what it was at the time the image was first created. However, some cameras (and phones such as iPhone) store date/time info in several places within the JPEG image metadata. Some software programs may alter one or more fields but not all. Therefore, if you examine all date/time related fields within the metadata, there is a chance that you may find one that maintains its original setting.

For example, in an iPhone 5 JPEG image, one often finds date/time info in the following sections reported by JPEGsnoop:

  • EXIF IFD0: DateTime
  • EXIF SubIFD: DateTimeOriginal
  • EXIF SubIFD: DateTimeDigitized
  • APP1 XMP: MicrosoftPhoto:DateAcquired

In addition, some recent iPhones (typically iOS 7 or later) include Apple MakerNotes fields that (after decoding) may show further date/time info. The advantage of checking MakerNotes is that it is often harder for software to alter these fields -- instead they tend to remove them all if anything is modified. As a result, if you find a date/time in the MakerNote field, there is a reasonable chance that it is reflective of the actual date/time of capture.
2015-01-08amit
 hello .. i have few images that we modified, changed and resized from the original and then emailed to me .. Is there a way i can convert these manipulated images back to the original using your software or any other method .. so far no success .. is it possible .. will appreciate your help ..
thanks ..
 Sorry, but it is highly unlikely that you could retrieve an original version of an image once it has been edited/resaved. In most cases the new file only contains the new version of the image.
2014-12-17brian.
 Hi There. Thanks for your reply. I have managed to get the program to export jpeg's. I had to use the EOI boxes otherwise It said ERROR. But when I click the repaired jpes's I am still getting "drawing failed" Do you have any idea what to do now??
 When you export an image, there is no guarantee that the resulting image will be valid (or readable with Windows). In many cases the file will still be corrupted. For some digital cameras, there is a second embedded (large) thumbnail which may also be worth extracting. Press Ctrl+2 for "Image Search Forward" and then try the export again.
2014-12-10brian
 Hi There.
I might be stupid but I am having a problem with this program.
I click on file, It says, Open Image. which I click on. I go to my damaged pictures and click on one. I can then see a small thumbnail of the picture (no bigger than a stamp) Then open tools and click on Export jpeg. Send to my desktop. But then on my desktop there is no picture?? I have tried sending the pics to various locations with the same results. I have also tried different pictures all with the same result.
Please tell me where I am going wrong or what I am doing wrong.
Many Thanks.
 Once you click on Tools->Export JPEG... and press OK, you should see the log window say *** Exporting JPEG ***.

Below that, it should give you the full path to your file after Exporting to:. Do you see this path? Copying this full path into a windows explorer window, it should find and load the image for you.
2014-11-27artist
 Hi!

I just wanna ask if you know a software that can restore cropped photos
Into its original form that has been put into collage?
What I mean is, knowing and extracting and getting it to its original form.
I have sent a collage pics to a friend, all pics used were all cropped
and to my surprised she identified the people I'm with from that cropped
image in the collage. She said she restored it using the embedded details
in every picture.
I'm wondering how she do that.

Help pls.
Thanks
2014-11-12Laurent
 Hi,

Please find posters about the Canon Raw (CR2) file format

https://github.com/lclevy/libcraw2/blob/master/docs/cr2_poster.pdf
https://github.com/lclevy/libcraw2/blob/master/docs/cr2_lossless.pdf

Laurent Clévy
@lorenzo2472
http://lclevy.free.fr/cr2
 Excellent! Thank you very much Laurent for this wonderfully detailed summary. I will take a look to see how much work it might be to introduce additional decoding for JPEGsnoop.
2014-09-22Adler
 Hi,
I wonder if jpeg-snoop is able to detect which jpeg image is corrupted. I have got about 10.000 jpegs and I cannot see each of them with my eyes... I'd like to have a list of what damaged, if any. Is it possible?
 Hi Adler - With the current version of JPEGsnoop, it may be possible to use the Batch Process feature to work through the 10,000 files and generate the associated log files. You could then use a free utility to search for ERROR in the *.log files. In future versions of JPEGsnoop I may add a feature (if there's enough interest) that compiles a summary report of all the results of the Batch Processing task, which could be a good way to achieve what you're after.
2014-09-14JL
 Tried to post this in SourceForge... but couldn't figure out how to submit a new bug report. The new version always seems to say "files larger than 2GB not supported in this version of JPEGsnoop" even if the files are smaller than 2GB. (Have one that's 1.85GB and gives that error).
 Thanks JL! Yes, you're right. Unfortunately I had missed testing the recent version with multi-GB files and see now that the file size threshold was set too low.

I have now extended JPEGsnoop v1.7.2 to support files up to 4GB in size! I am just completing testing and will release it shortly. Thanks for your patience.
2014-09-14Reziac
 This is funny -- I'd just got done telling someone on a forum about JPEGsnoop, and literally 5 seconds later, here in my mailbox is your notice of an update. Good karma or what? :)
 =)
2014-09-14Al
 Could you please update sourceforge project? It is stuck at v. 1.5.2
 Definitely! I have just completed significant rewrites of the source code (for v1.7.x) and have updated the repository now.
2014-09-13Guido
 Hi Calvin

The following image
http://www.berlininart.com/wp-content/uploads/2012/08/1330_Kim.jpg

gives following error with JPEGsnoop 1.7.0:

ERROR: SetDhtTables(comp=4, TblDC = 0 TblAC = 0) out of indexed range

It worked faultlessly with JPEGsnoop 1.6.1.

Thank you!
 Hi Guido!

Thanks for providing the example file. The handling of table indices with CMYK files has been fixed in version v1.7.1, along with many other corrections. Version v1.7.1 will be posted very shortly.
 
2014-09-09Crash with 444 image
 The following image crashed JPEGSnoop in the latest iteration.

http://www.w3.org/MarkUp/Test/xhtml-print/20050519/tests/jpeg444.jpg
 Thanks for the example file to test.
This issue has been fixed in JPEGsnoop version v1.7.1
2014-07-22Tebulon
 I have about 430 JPEG wedding images that looked fine when I took them with my Nikon and can be copied off the micro SD card - the file sizes even seem correct, but only the first few are viewable and have any extended data. The last good one seems to have a corruption (plain brown on the bottom half of the image) and all of them after that are not viewable. Using your program, it looks like it's missing the SOI and cannot even find the SOS marker - could it still be recoverable? When I used CardRecovery software it didn't find any of the corrupt images except that first one, and saved it as a 54Gb file - making me think that a bad sector killed the EOF data and all of the images are combined in there somehow.
 Sorry to hear about the corruption. If you are lucky, you might find that the recovery file does indeed contain a number of intact images. Typically recovery programs will generate these massive files if the file system directory gets damaged. Although many images may still be fully intact, others will be corrupted because of file system fragmentation.

I would recommend that you split the 54GB file into 1GB chunks (keep the original) and then use JPEGsnoop with the "Image Search Forward" command to see if any images can be extracted.

There are many free utilities that will split large files. A quick search of google for "windows utility split file free" shows a few.

Good luck!
2014-06-15Puji Winasti
 thank for your page,
2014-05-22Matt
 Hey, I love the program, but just one quick question: My JPEG, which has been altered, leaves a red and white stripe on the bottom of the image. What is this?
 If you are referring to the area of the image outside of the dashed lines (on the right and bottom sides) then this is a region that is not normally displayed by viewers. From a simplistic perspective, JPEG images are compressed in chunks (often 8x8 pixels) so if your image doesn't quite make up a full 8 pixel tile, some "garbage" data is left outside of the real image boundary and the file instructs the viewer to trim it down to the proper size. JPEGsnoop is able to show you this "throw-away" region (aka partial MCUs).
2014-05-21Danny
 Fantastic program, very impressive functionality!

It's the only one to successfully fix my image. However, there doesn't appear to be a way to export the image from the program other than screenshoting it... I'd like to look at the fixed file's hex though. Is there anyway to export the fixed image, or to manually fix the image based off the data JPEGsnoop gives?
I'm not sure exactly what the program does in response to the error.
It's this type of error:

*** ERROR: @ [offset here], num_coeffs>64 [68]
*** ERROR: Bad scan data in MCU(2,10): Lum DC CSS(0,1) @ Offset 0x00002DC3.1
MCU located at pixel=(32,168)

I'm understand that there's an extra AC coefficient at the given location in the specified MCU, how do I do what the program does and remove it (w/ hex editor I'm guessing...)?

Thanks for your help, and this fantastic program!
 If JPEGsnoop is able to display your image, then you may be able to save it out using Tools -> Export TIFF.... Good luck!
2014-05-21AllenKK
 FFMPEG full scale JPEG YUV 422, 444 cannnot be decoded successful but 420 works. You can generate the JPEG file in:

ffmpeg -i my.avi -ss 00:00:10.000 -f image2 -vframes 1 -pix_fmt yuvj422 out.jpg

You can also try this:
https://trac.ffmpeg.org/raw-attachment/ticket/143/yuvj422.jpg
 Thanks Allen! I have reproduced the issue and think I see what code needs to be adjusted. I filed this in the SourceForge bugtracker as (SF-bug-018).
2014-04-28Shane
 Hi Calvin

I think you have the knowledge and skills to point me in the right direction.

I have a custom Highlights Warning jpg target built in Photoshop that I would like to upload to my Nikon DSLR. Once uploaded this can be used to determine the exact tonal level at which the Highlights Warning starts to flash thereby indicating clipping.

The problem I am having is putting the CS jpg in the right format for the Nikon DSLR to accept it. I have tried copying, cutting, pasting and editing EXIF data, headers, thumbnails and previews from an original Nikon jpg (using tools like exiftool) but can't find the right approach. I was wondering if it would be possible to take an existing Nikon jpg and using the hex editor remove the Nikon jpg and replace it with the CS target jpg, leaving the original Nikon exif intact?

Any ideas or help would be greatly appreciated as I am running out of ideas and "skill sets".
 Hi Shane -- sounds like an interesting problem! It is quite likely that the issue is with the characteristics of the embedded JPEG thumbnail. In general you cannot simply substitute the image (scan data) with a hex editor as the quantization and huffman tables won't match up. If you send me a copy of an image direct from the Nikon and your highlight test image, I can take a look.
2014-03-10awesome_man
 I found 01D7D42C1C869993B7E598D7C109534B
posted on a blog from 2011 ...
Signature: 01191863A92FA362537A80411114BBC3
Signature (Rotated): 01D7D42C1C869993B7E598D7C109534B
File Offset: 0 bytes
Chroma subsampling: 2x2
EXIF Make/Model: NONE
EXIF Makernotes: NONE
EXIF Software: OK [Adobe Photoshop CS3 Macintosh]

I have run a photo gotten same ...
Signature: 01191863A92FA362537A80411114BBC3
Signature (Rotated): 01D7D42C1C869993B7E598D7C109534B
File Offset: 0 bytes
Chroma subsampling: 2x2
EXIF Make/Model: NONE
EXIF Makernotes: NONE
EXIF Software: NONE
**(slightly different ID on rotated)
...MYRESULTS...
ASSESSMENT: Class 1 - Image is processed/edited

Questions.
1. Since my signature line 1 matches the old posting from 2011, is mine also from same software..
2. Is there a database update available? or a way to combine or share user databases?
3. Does the rotated signature indicate it is different from the 2011 blog posting?
(blog url )
http://forum.nexoneu.com/archive/index.php?t-336514.html
 Hi -- that signature matches one that often appears in Photoshop files. I haven't been releasing database updates in a while, however you can load other people's databases (or share one) by selecting a new file location under Options->Configuration->Directory for User Database. The filename is "JPEGsnoop_db.dat".
2014-03-10Chris
 A friend had their JPEGS encrypted by Cryptorbit I used Anti-Cryptorbit v2 to unencrypt the jpegs but noticed that they had all been resized to 160x120 which is thumbnail size.

I found that running the pictures through JPEGSnoop clicking Tools IMG Search FWD, then click Export JPEG then tick Missing EOI, then I save the JPG and the image size/resolution is restored, which is great but I have several thousand files to restore, as I am having to do each one individually it will take me a long time, I know JPEGSnoop has a batch process function but I cannot seem to find out how to get this to automate what I am trying to do, does anyone know how to use the batch process function so that I can restore the photos automatically without going through them one at a time.

Below is a video on what I am doing to restore the size of each photo

http://youtu.be/HHJhaNPr4bA
 Hi -- that's great to hear that the export worked to recover the full-res images. Unfortunately the batch process or command-line parameters don't currently support the automation that you're trying to achieve. I could add it to the list of options to consider in future versions if there is enough interest.

In the meantime, you might be able to workaround it in the following way:

  • Open windows command prompt
  • Change to the directory containing your images
  • copy /b *.JPG > all_images.bin
  • Open all_images.bin in JPEGsnoop
  • Tools -> Export JPEG..., click on "Extract All JPEGs" (and "Force EOI" if that is found to help in your case), then
  • Select an output directory and filename, click Save
  • Now you should see many of your images (full-res and thumbnails) extracted to your directory

Good luck!
2014-03-03Guy
 Hi,
Great tool. I have been experimenting with Google+/Picasaweb and trying to check that when I download files back to my PC, they haven't been compromised. I noticed that they are slightly smaller, and using your software I have been able to show that one of the thumbnails is missing from the file recovered from Google. That's fine, but it doesn't account for all the kb lost. If I export as a TIF, the resulting files are exactly the same size. Does this prove that my original has not been re-compressed? The 2 signatures are the same. The metadata seems to be the same, but I really just want to make sure it is the same image data in there.
Guy
 Exporting to TIFF and comparing file size will not give you any indication of whether edits or recompression has occurred to the image. TIFF is often uncompressed which means that file size will largely be directly related to the image dimensions and not the content. The best bet is to compare the rest of the metadata in JPEGsnoop. If the compression signature is the same, then it is very likely that the image has not been recompressed. Instead, what you are probably seeing is the removal of metadata (such as makernotes) which can also include a larger thumbnail/preview image.
2013-12-25John
 Hi
I have used a number of EXIF utilities for my Android to find the date some pics were taken, but I cannot find this info on images that were texted to me or that I download. They all work on pictures taken on my own phone, but not those downloaded via text or the net. Any hints on that? Does yours manage to do this? If so, I will download but I have to find a PC to do so, since I am on a Mac, unless there is a version directly for Android that you have?
Thanks, John
 Generally photos uploaded to the web or that are sent via text message are recompressed and often have their metadata stripped. Therefore you lose some of the identifying information (such as the EXIF DateTime fields). It is possible that there are still other metadata fields that were left intact that don't show up on the PC/Mac file properties. Running JPEGsnoop on the files will show you nearly all possible metadata fields. Some people have had luck running JPEGsnoop on the Mac under wine.
2013-06-28andy
 Hello!

This is a fantastic little tool, and you don't even charge people for it - brilliant! Unfortunately, this dumped out some sort of protection fault here on Linux. I hope you have some of your friends around with a Linux box. It appears to trigger much likely if you SCROLL quickly up and down in the GUI.

http://pastebin.com/wGkzaBEn

I hope this will make any sense to you.
To reduce the clutter: first part is output from console, then after ' ... ' there is the second part copypasted from the error message window.
 Hi Andy -- glad to hear the tool has been useful! Unfortunately, I don't have access to debugging facilities in LINUX to see where the bug may be cropping up in the wine "emulation", so it may be difficult for me to help diagnose this. It is possible that it is a wine DLL issue as noted in the following text from the winehq FAQ, so you might want to give this a try:
"You may have run into a bug in Wine's RICHED20.DLL. You can try using Microsoft's RICHED20.DLL by running winetricks and selecting riched20. This may let you work around the problem until the Wine developers fix the bug."
2013-06-27Al
 Hello - I am trying to put together a slideshow from pics that are about 10 years old. Unfortunately they must have been on an external hard drive at one point that had issues because now almost all my images look something like this: http://i268.photobucket.com/albums/jj4/SmedRoc/P4070035.jpg (I found that one from Google Images but its the same idea). When I open the jpg in jpegsnoop, the preview at the bottom looks perfect and I can export it but it exports it at a much smaller size - instead of 1600x1200 it gives me an image of 160 x 120! Is there anyway to export it out at the same full size resolution that I imported it?

Thank you!
 Unfortunately your images have become corrupted. Your JPEG files actually contain two parts, the main image and the thumbnail image. When a file becomes corrupt, there is a greater chance of the corruption impacting the main image while leaving the thumbnail image intact. So, when you exported from within JPEGsnoop, you were probably just exporting the thumbnail image (160x120). If the main image content was corrupted (likely in your case), the JPEGsnoop export wouldn't be able to recover the original 1600x1200 image. Recovering the 1600x1200 image would require advanced image repair techniques that are not generally possible with automated software.
2013-06-23zekegonzalez
 Alright! This is a fabulous little utility!! I had some pix I value greatly saved on my HDD and suddenly they got corrupted somehow. They were showing data there w/ a file size and everything but the dimensions were reading 0 x 0 and I wasn't seeing the pic, plus they wouldn't open w/ Paint and MS Office Picture Manager wouldn't process them either.

I was able save the first two I tried. Maybe I should fork out a few bucks for this handy little program...
2013-04-15travis
 Just wanted to follow up on my earlier comment ... you might want to post this since it could be of use to other users.

I never could get windows7 to open a jpeg with separate scan data sections for each image component (Alex posted an example image in a comment here from may 2011).

My solution was to used jpegtran, available for free nearly unrestricted use, to "optimize" the jpeg without re-encoding and in the process it combines the 3 scan data sections to 1 which makes windows happy.

Thanks again for the great site, i never would have looked for a lossless jpeg optimizer if I hadn't realized that such a thing was possible from reading over your site.

A bonus is the optimized images are combing back about 10% smaller in file size!
 Excellent news that you found jpegtran can reformulate the multiple scans into one. Thanks for sharing this workaround!
2013-04-12travis
 Really enjoy your site and tool ... hows the baby?

Was hoping you could tell me something about images with 3 scan data sections, each with one component of a 3 component image (one Y scan data section and another for each of CR and CB).

I have some images like that that the windows imaging components in windows 7 don't like (so cant open in image viewer, internet explorer, .net programs).

In my case if I isolate any of the 3 sections, (deleting the other 2 with a hex editor) that component will show fine ... but with the 3 together, or some combinations of 2, windows thinks the file is corrupt.

I appreciate that you can't help everyone fix their corrupt jpegs but any insights in the 3 scan images might help me out, thanks a lot
 As you've noticed, some JPEG decoders are not fully compatible with the separate-scans arrangement. This arrangement is permitted in the T.81 JPEG standard, but I seldom see it being used. I imagine that many developers have not tested with this sequencing. I see in your later post that you discovered jpegtran can help combine the scans, which is great news!
2013-03-18Mauro
 I am writing an application for processing a set of photos and I need two function in C++, one for decoding the DC coefficient of any 8x8 compressed matrix and another function in C++ for coding the DC coefficient.
Please, let me know if you can send me these two functions and how much you will charge to do that.
Thank you for your help. Mauro Pacelli
 The best place to start would be to look at the source for IJG libjpeg. From there, check out the functions in cjpeg and djpeg.
2013-01-31sherrialicia
 I have a photo that I've been going crazy trying to get an origin for, mainly the date it was taken. I have tried quite a few programs and the only thing I get is a file date. There is nothing under properties except under comments it says LEAD Technologies Inc. V1.01. Your program has given me the most information but I don't understand most of it. At least I know what camera was used! lol Please email me if you can help me with this mystery. Thanks
2013-01-23jaber
 thanks
2013-01-23matt
 Hi,
I have recovered thousands of pictures from my hard drive and they are all not working, JPEGsnoop has saved my life but is there an option to export many JPEG's at one time? I can process the batch but just don't know how to export them all at once. Could you help please?
Thanks, Matt
 Hi Matt -- That's great to hear that you managed to recover a number of photos with JPEGsnoop's export function. At the moment, the Batch processing feature doesn't support the "Extract all JPEGs" function. I have added this to the list of requested features (#3603202). Thanks!
2013-01-10ozzie
 Hi,
How can I tell WHERE a photo was taken? I understood that the GPS in many cameras will give the location.
Thanks!
2012-12-09Shawn
 Greetings - will this utility locate images that have been renamed to other extensions? Example: I renamed a .jpg to .xls and moved it and forgot what it is called. Will this scan a folder or drive and locate such mis-named images? Thanks!
 Hi -- JPEGsnoop cannot currently do this type of search directly. However, there are a couple ways you could potentially achieve this: assuming you had a folder with possible misnamed files, make a duplicate of the folder, use a batch rename utility to change the extension of all files to ".jpg". Now, you have two options: with Windows Explorer you can enable "view by Icons" and it will attempt to rebuild the image thumbnails of each file it can decode. If you see an image thumbnail appear for some of the files, then you're done. Alternately, you could use JPEGsnoop to do a "batch process" (on subfolders). It will save a ".txt" file next to each file in your directories with what it found during an attempted decode. Files that are larger than about 1KB usually indicate that an image was found.
2012-11-19cd
 A portable (stealth) Version would be great.

Thanks for this great tool!
 While the current version doesn't require installation, it does create a couple registry entries to save the settings. To make it truly portable, I had created a sourceforge feature request (ID:3104043). Shouldn't be that hard to implement.
2012-10-12Tom O
 The new Samsung phones have a "cartoon" option that alters the picture to look something like a pastel painting. Do you happen to know if pictures taken in style can be converted back to normal?
 Hi Tom -- No, it is very likely that when the phone's camera is set in that mode, it only saves a "post-processed" JPEG image. The original capture would have been discarded (unless it saves both the original and the cartoon version to the memory card, which is unlikely).
2012-10-12smallest
 Hi,

I have a question about the EXIF decodng in JPEGSnoop. Specifically, I'm trying to figure out why it says the file in question has an "EXIF IFD2" IFD.

http://www.smalleranimals.com/isource/exifouttest.jpg (2K)

As far as I can tell, it doesn't. I've parsed it with our EXIF parser, ImgSource (http://www.smalleranimals.com/isource.htm) . And I've walked through the bytes manually. But I don't see why JPEGsnoop finding that IFD. I can see the data that it _thinks_ is the IFD, but I don't know how or why JPEGsnoop is getting there.

We use JPEGsnoop as a sanity check for our own EXIF processing as well as for JPEG structural analysis, so if there's a bug in our stuff, I'd like to know. And if there's a bug in JPEGsnoop, I assume you'd like to know.

Can you shine any light on this?

[JPEGsnoop output trimmed]
Start Offset: 0x00000000
*** Marker: SOI (xFFD8) ***
  OFFSET: 0x00000000
 
*** Marker: APP0 (xFFE0) ***
  OFFSET: 0x00000002
... trim ...
 
*** Marker: APP1 (xFFE1) ***
  OFFSET: 0x00000014
... trim ...

  EXIF IFD0 @ Absolute 0x00000026
    Dir Length = 0x0009
... trim ...
    Offset to Next IFD = 0x000002C3

  EXIF IFD1 @ Absolute 0x000002E1
    Dir Length = 0x0006
... trim ...
    Offset to Next IFD = 0x00000048

  EXIF IFD2 @ Absolute 0x00000066
    Dir Length = 0x0003
    Offset to Next IFD = 0x00020131

  EXIF SubIFD @ Absolute 0x000000F6
    Dir Length = 0x001B
... trim ...
 Hi there!

I had a quick look (thanks to baby!) at the file and it appears that the "Offset to Next IFD" at the end of the IFD1 is non-zero (0x48). This is prompting us to advance on to parse another IFD (which auto-increments to IFD2). Is it possible that the "Offset to Next IFD" might be set incorrectly?

I also double-checked this with exiftool. It seems that the exiftool parser also reports that we start processing IFD2.

Hope that helps! Let me know if you want me to debug it further, Cal.
2012-08-12Dr_Radialist
 Hello!! Thank you for quite detailed description for JPEG format. I am a Cardiology doctor. Thus, it is very difficult to understand. However, I will do my best to understand, since this document looks best in the world for JPEG teaching. In the Cardiology field, we use DICOM-XA format frequently. It is a motion picture for the heart. Is is compresed using JPEG Lossless DC. I spent several years in order to write a C++ program to decode it, although I failed every time. Finally, I met this page. Thank you again from Japan!
 Thanks! It's good to hear that it was useful!

 

Leave a comment or suggestion for this page:

(Never Shown - Optional)
 

NOTE: Image repair requests are not accepted. Thanks for your understanding.