Return to Digital Photography Articles

JPEGsnoop 1.7.5 - JPEG File Decoding Utility

by Calvin Hass © 2015

JPEGsnoop is a free Windows application that examines and decodes the inner details of JPEG, MotionJPEG AVI and Photoshop files. It can also be used to analyze the source of an image to test its authenticity.

JPEGsnoop Program Icon


Latest Version: 1.7.5


Every digital photo contains a wealth of hidden information -- JPEGsnoop was written to expose these details to those who are curious.

Not only can one determine the various settings that were used in the digital camera in taking the photo (EXIF metadata, IPTC), but one can also extract information that indicates the quality and nature of the JPEG image compression used by the camera in saving the file. Each digical cameras specifies a compression quality levels, many of them wildly different, leading to the fact that some cameras produce far better JPEG images than others.

What can I do?

Check out a few of the many possible uses for JPEGsnoop!

One of the latest features in JPEGsnoop is an internal database that compares an image against a large number of compression signatures. JPEGsnoop reports what digital camera or software was likely used to generate the image. This is extremely useful in determining whether or not a photo has been edited / tampered in any way. If the compression signature matches Photoshop, then you can be pretty sure that the photo is no longer an original! This type of analysis is sometimes referred to as Digital Image Ballistics / Forensics.

JPEGsnoop reports a huge amount of information, including: quantization table matrix (chrominance and luminance), chroma subsampling, estimates JPEG Quality setting, JPEG resolution settings, Huffman tables, EXIF metadata, Makernotes, RGB histograms, etc. Most of the JPEG JFIF markers are reported. In addition, you can enable a full huffman VLC decode, which will help those who are learning about JPEG compression and those who are writing a JPEG decoder.

JPEGsnoop can now also parse and decode Photoshop files!

Other potential uses: determine quality setting used in Photoshop Save As or Save for Web settings, increasing your scanner quality, locating recoverable images / videos, decoding AVI files, examining .THM files, JPEG EXIF thumbnails, extract embedded images in Adobe PDF documents, etc.

Trying to Undelete or Unformat your Photos?

If you're interested in trying to recover your deleted / corrupted photos, check out my new page on recovering deleted photos.

File Types Supported

JPEGsnoop will open and attempt to decode any file that contains an embedded JPEG image, such as:

  • .JPG - JPEG Still Photo
  • .THM - Thumbnail for RAW Photo / Movie Files
  • .AVI* - AVI Movies
  • .DNG - Digital Negative RAW Photo
  • .PSD - Adobe Photoshop files
  • .CRW, .CR2, .NEF, .ORF, .PEF - RAW Photo
  • .MOV* - QuickTime Movies, QTVR (Virtual Reality / 360 Panoramic)
  • .PDF - Adobe PDF Documents

* Note that video file formats (such as .AVI and .MOV) are containers, which can include video streams encoded in one of a wide variety of codecs. JPEGsnoop can only interpret this video footage if the codec used is based on Motion JPEG (MJPG).

Download the Latest Version of JPEGsnoop!

Click to Download .ZIP
Version: 1.7.5
Version History

Released: 11/29/2015
Downloads: 442527

JPEGsnoop by Calvin Hass

Help Support JPEGsnoop Development

If you have found JPEGsnoop useful and would like to support its continued development, consider making a small contribution. Donations will help encourage me to add new and interesting features. Found an interesting use for the tool? Let me know!

Source Code: JPEGsnoop is now Open Source!

System Requirements

This application has been designed and tested to run on Windows XP, Windows Vista and Windows 7. As of version v1.7, Windows XP SP1 is a minimum requirement. JPEGsnoop is fully portable, so it does not require any installation!

LINUX users: JPEGsnoop apparently works on LINUX under wine

Mac users: JPEGsnoop works within CrossOver Mac

Terms of Use

JPEGsnoop is free for personal and commerial use. Commercial users are encouraged to leave me a brief private message so that I can understand your needs and make future versions more useful.


No installation required. JPEGsnoop is very portable. Simply unzip the download and run!

Version History

For information about features added in previous versions of JPEGsnoop, please check out the version history page.

Feature Requests / Bug Reports

Please feel free to add your own feature requests or bug reports by submitting to the links on the JPEGsnoop Source page

Awards and Recognition for JPEGsnoop

  • PC Magazine - Utility Guide 2009 - July 2009
  • Win Magazine - May 2009
  • Magazine - Program of the Month - April 2009 Magaine - Chip Pick - November 2012
  • Computer Bild Magazine - Issue 10/2009

Main Window
Channel Histograms
MCU Grid & Positioning


Please see the options page for information on how to use JPEGsnoop and other interesting uses for the tool

Recent Features

  • Photoshop PSD decoding
  • Batch file processing
  • XMP APP1 & ICC Header display
  • IPTC and Photoshop IRB / 8BIM parsing
  • GPS EXIF metadata display
  • Full detailed Huffman VLC decoding output for those interested in writing a decoder or learning JPEG compression
  • Automatic display of YCC DC block values (16-bit)
  • MCU Grid overlay and automatic display of mouse MCU position and file offset in image display window.
  • Test overlay function enhanced to allow quick apply and binary code readout.
  • Image zoom level from 12.5% - 800%.
  • Extract embedded JPEGs -- can be used to extract thumbnails, hidden JPEG files, as well as frames from Motion JPEG AVI files.
  • Compression detection enhanced to detect rotated signatures, comment field.
  • Full AVI file parsing (to identify MotionJPEG)
  • DQT table searches in Executables (for "hackers")
  • Detect edited images or identify original digital camera that took a photo!
  • Integrated database of thousands of compression signatures (image fingerprint) for digital cameras and editing software
  • File overlay test function
  • Multi-channel preview: RGB, YCC, R/G/B, Y/Cb/Cr
  • Pixel position lookup into file offset
  • Examine Motion JPEG .AVI or .MOV (Quicktime) files (MJPG or MJPEG) and play through!
  • Examine any file fragments that may contain a JPEG image
  • YCC to RGB Color correction / clipping statistics reports
  • Command-line execution
  • Huffman variable-length code statistics
  • Expansion of DHT (Huffman Table Expansion into bitstrings)
  • Determine IJG JPEG Quality factor

Background Material

If you want to understand some of the technical details reported by JPEGsnoop, I suggest that you read through my articles on JPEG compression:


As this is a work in progress, I would be very interested in hearing from you, particularly for feature requests, suggestions, comments, bug reports, etc. If you currently use JPEGsnoop and find it useful, let me know!


Reader's Comments:

Please leave your comments or suggestions below!
 Is it possible to use this software to remove all meta related data from images and or pdf's?
 Hi Ian - no, this tool doesn't attempt to modify/strip the metadata from images. For that, I recommend you use exiftool for that. You can run the following command to remove all metadata from a JPEG file called "input.jpg":

exiftool -all= input.jpg
 Ok.. I figured out this one again. I really should try harder before I post here next time :)

So at least in libjpeg (not sure if it's the intention of ITU T.81's standard, but we knew libjpeg is the de facto standard in implementation), the LSBs are extracted from the original integer, not the binaries after DC magnitude coding.

For example, the 1st number is -272. It's "original" integer should be 0xfffffef0, or ‭11111111111111111111111011110000‬ (keep in mind it's two's component), NOT 011101111. So we can clearly see the last bit is 0, not 1.

If we right shift it by 1 bit (‭1111111111111111111111101111000, or -136) and then apply DC magnitude coding, it will still become 0111 0111, so both way work for *first* scan (I think it can be proved mathematically). But you can see here, for the 2nd scan, there is difference (0 vs. 1).

Essentially, if the original value is odd, LSB in scan 2 should be 1 and if it's even, LSB in scan 2 should be 0.

And it's actually based on absolute number of DC value instead of the difference, which can be observed from libjpeg's code. It can be easily tested too if you create multiple (more than 1) LSB scans. In my example, the Cr-DC of MCU2 is +74, or 135 in abs. since MCU1's is 61). In "original" binary integer they are 0x0000004A (0...0 0100 1010) and 0x00000087 ‭(0...0 1000 0111)‬ respectively. I created 4 scans.

The dump of scan #2-4 are

3f (0011 1111)
0f (0000 1111)
27 (0010 0111)

So we can see here for 6th column it's 111, not 010.
 Great info, Benjamin! Thanks very much for sharing your analysis!
 Hi Calvin,

Sorry to bother you again.

Recently I am playing with successive scan decoding, but it doesn't work as what I expect.

I created a file with following scan file
(The test files I was using can be downloaded from )

0,1,2: 0-0, 0, 1 ;
0,1,2: 0-0, 1, 0;
0: 1-63, 0, 0 ;
1: 1-63, 0, 0 ;
2: 1-63, 0, 0 ;

Which means I just leave the last bit of all DCs for 2nd scan.

6 DC coefficients are (extracted from a baseline equivalent):
MCU1 (Y-DC/Cb-DC/Cr-DC):
-272 (011101111) / -16 (01111) / 61 (111101)
MCU2 (Y-DC/Cb-DC/Cr-DC):
76 (1001100) / -26 (00101) / 74 (1001010)

So I got the dump from the 1st scan, which is
9d cf 79 30 b4 bf (1001 1101 1100 1111 0111 1001 0011 0000 1011 0100 1011 1111)
With the help of two DHT:


Expanded Form of Codes:
Codes of length 01 bits:
0 = 06 (Total Len = 7)
Codes of length 02 bits:
10 = 08 (Total Len = 10)


Expanded Form of Codes:
Codes of length 01 bits:
0 = 04 (Total Len = 5)
Codes of length 02 bits:
10 = 05 (Total Len = 7)
Codes of length 03 bits:
110 = 06 (Total Len = 9)

it can be easily decoded as
01110111, 0111, 11110, 100110, 0010, 100101
Which are exactly the bits of these 6 DC values excluding the LSB (least significant bit).

BUT thing are getting weird in the 2nd scan.

The dump of 2nd scan is just one byte, 27 (0010 0111).

According to ITU T.81 G.1.2.1 and a quick look of function "encode_mcu_DC_refine" in libjpeg (I am no developer so don't quote me on this), I am pretty sure it's supposed to just sent the last bit(s) consecutively, without any modification (which means no category header, no Huffman encoding) but here you can see, the bits' number is right (6) but the values don't look right..

What we are missing should be 1,1,1,0,1,0; but here it's 001001 (+ two filling ones).

Did I miss something here?
 It's me again.

Just want to let you know, shortly after I sent the last message, I decided to investigate progressive JPEG by myself because I realize the potential of JPEGSnoop even it doesn't support decoding of progressive JPEG yet. It turns out, the data in each scan is arranged ordered by MCU 1st, then by array index (zigzag): just like sequential JPEG, but just with only selected range of lndex.

Below is my way to test, would also like to share here.

I created an simple B&W image which was 16x8 (2 MCUs) with striped patterns. Firstly I created a baseline JPEG to easily get the DCT matrix from JPEGsnoop.

For 1st MCU, only 5 coefficients are left: (after quantization) DC=-1, AC1=-46 AC6=-36, .. etc.

For 2nd MCU, similar but slightly different coefficients are left: DC=0, AC2=-37, AC9=-36, .. etc.

Then, I built a custom scan table which will do spectral selection on 0, 1-6 and 7-63 and I created another JPEG file from the same source BMP file with same q (thus same quantization tables) via `cjpeg -q 80 -sample 1x1 -scans scan.txt test.bmp > test_p.jpg` in libjpeg-turbo.

I got the dump of 2nd scan from JPEGSnoop, which is
51 cd cd 1f (0101 0001 1100 1101 1100 1101 0001 1111)

and DHT:

  Expanded Form of Codes:
    Codes of length 02 bits:
      00 = 00 (EOB)                      (Total Len =  2)
      01 = 06                            (Total Len =  8)
      10 = 16                            (Total Len =  8)
    Codes of length 03 bits:
      110 = 46                           (Total Len =  9)

Now we can manually decode the Huffman encodings:

0106 (0 run + 6 bits)
11046(4 runs + 6 bits)
1016(1 run + 6 bits)
00 EOB
11111 filling 1s

So, we can clearly see here, the order is MCU1's AC1->MCU1's AC6->MCU2's AC2, i.e. ordered by MCU firstly, then inside MCU, still same zigzag.

I didn't test Successive approximation yet, but I am pretty sure that should be the same: it will always put coefficients from the same MCU together first in every scan, no matter how many coefficients left (in this case, only 6) in that scan.

Which also means, what Wikipedia claims is wrong ( , read from "This encoding mode is called baseline sequential encoding" paragraph).. unless he is using 64 scans for each coefficients, which is impossible.
 Fantastic!! This is excellent work in determining the scan ordering. I did take a quick look through ITU-T.81 and the definition of the sequencing wasn't particularly clear to me. Your results are quite definitive, though! I examined libjpeg briefly to see what was done there. In decode_mcu_AC_first() within jdhuff.c, it looks like the HUFF_DECODE is called on the spectral selection coefficients of a given MCU's scan consecutively.
 Hi Calvin,

I cannot find a more better topic to leave this message, so please forgive me if it's not appropriate.

I knew progressive JPEG is not your focus currently, but there is one small question about JPEG compression that has been bothered me for a long time and I think you may knew the answer considering you're an expert in this field. I looked into every single web source I can find, including JPEG standard by ITU, all of them are vague about this part.

When we're encoding the AC DCT coefficients in a sequential JPEG, it would be encoded in MCU by MCU order and in each MCU, they're arranged in zig-zag order (1 to 63), that is very clear from what I learnt in your brilliant article

We know progressive JPEG would separate different coefficients in different scans (I am talking about Spectral selection. Let's omit Successive approximation at the moment). Let's say there are 3 scans, 0 (DC), 1-5, 6-63 (and let's also omitting 3 components and interleaving thing). My question is, when encoding AC parts, for example, the 2nd scan for AC1-AC5, will the coefficient be ordered in MCU first or in index first?

If MCU 1st: A1 A2 A3 A4 A5 B1 B2 B3...
If Index 1st: A1 B1 A2 B2 A3 B3...

It matters because we can see here it will definitely affect the efficiency of RLE encoding.

Multiple sources *imply* it's index first, but I have not yet find a definite answer about that.

 Hello, this is the software user, I want to know whether you consider release version of the ios software?
 Hi -- sorry, the software is only written for Windows at the moment. However, the source code has been posted, so it is possible that someone may be able to port it if desired.
 As a follow-up to Reziac's comment, I'm able to run version 1.75 without any issues on Windows XP x64. Many thanks for the program as well as the detailed JPEG documentation on the site!
 Glad to hear it!
2015-12-12Asen Anastassov
 Hello there,

Your JPEGsnoop is a very useful tool. I would like to ask- would it be possible that you release a portable version of your program which doesn't write to registry and saves all its data and settings inside its program folder?

Best regards,

 Thanks for the suggestion, Asen... yes, I think it would be a good idea to make it truly portable. It is "almost portable" right now, but moving some of the settings to a separate file in the executable directory would be good. I'd prefer not to have to manage a separate executable, so I'll take a look at what my options are and keep this feature request on the list. Thanks!
 Thanks. v1.61 does run on XP64, so you may be right about Visual Studio -- tho it seems really strange that the newer version compiles something that barfs on 64bit!

It's crashed a couple times (that's unusual) but I'm glad to have it even halfway working on the "new" machine!

If you need future versions tested on XP64, let me know. I can break anything! :)
 Ok -- so that should help me narrow it down if I get around to tackling this one :) Thanks Reziac!
 I've been using the latest version to dump AVIs to JPGs. Works great.

Except that it refuses to run at all on my WinXP64 machine! no matter how I set program compatibility, Windows whines "JPEGsnoop is not a valid Win32 application." I thought it was 64-bit compatible??
 Sorry that there seem to be troubles your execution on WinXP 64bit. I'm not sure what might be triggering that error message -- I have tested v1.7.5 successfully with Windows XP Home 32-bit, but haven't had access to XP 64-bit to test with. I suspect it might be an issue with Visual Studio 2012. If so, you might find that v1.6.1 works better on WinXP64 (as that was the last version I compiled with VS 2010).
 Is there also any version for OSX ?
Thanks, Carsten
 Hi Carsten --
At this time I don't have a version of JPEGsnoop targeted to other OSes. However, the latest version of the source (v1.7.5) has been rewritten so that it should be much easier for someone to port the core of it to LINUX or other OS. I have heard in the past that CrossOver Mac enabled JPEGsnoop to run under Mac.

If anyone is interested in porting JPEGsnoop to LINUX or other OS, please let me know and I'll try to help in any way I can.
Good news about new functions, I will try it now !

Can we have updated source on sourceforge ? And can you contact me for a commercial use, please ?

Thanks, a lot !
Best regards
 Contact info sent
2015-11-26dot tilde dot
 what license do you distribute your beautiful software under?

 Hi there -- I had originally released the software under the GPL license, but if you have questions about your use-case, let me know. Thanks!
 Hi Calvin, I'm on windows 10 and I can't see the image preview - only the text portion. Is there a way to turn image preview on, or is it something else?

 You can enable / disable the image preview with the following setting:
Options -> Scan Segment -> Decode Image
Then select File -> Reprocess File
 Thanks so much for your great tool and help!
 Great to hear it!
 Love this tool... I have used it many times for corrupt images and getting images from the .thumbdata3 file from android phones. Is it possible to use Jpegsnoop on larger files? I have a 12gb file full of thumbnails but looks as though I have hit the size limit.

ERROR: File too large for this version of JPEGsnoop. [Size=0x30002E5AF]

Double thanks for a great program!
 Glad to hear it has been useful!

Probably the easiest solution is to use a free file splitter utility (eg. ) to create smaller segments (eg. 2GB) and then feed those into JPEGsnoop in batch mode. JPEGsnoop only works on files up to 4GB.

Is there some way I can determine why most of my photos are being exported with a 1440x1080 resolution vs the 4608x3456 they should be? If we can get this fixed I would appreciate it and will increase my donation.

 What you have likely extracted is a large preview that was embedded within the original file. The original image (4608x3456) may have been corrupted and not directly recoverable. So, regrettably, you might not be able to extract a larger version of the image. That said, it is quite fortunate that you have access to such a large preview image!
2015-08-22John Anderson
 Hi Calvin,

Many thanks for a most useful analytical tool. I'm happy to make a donation to further development. How much do you suggest?

I have one question about JPEGsnoop. I tested the software with an image captured using a friend's Apple iPod. EXIF metadata confirms this. However, the compression signature is for a Konica Minolta camera.. Is it probable that both the iPod and the Minolta both use the same compression algorithm?

Look forward to hearing from you.
 Thanks for the kind feedback, John! Any help is always appreciated :) But I am also more than happy just hearing that the tool has been helpful for others.

What you have noted with the compression signature is exactly as you figured... for the particular image content and camera settings, both used the same compression table.

It is quite common to see a given table appear in multiple camera manufacturers... it could be that they reuse the same hardware image encoder or use the same library / reference tables. The notion of the compression signature being a "fingerprint" is a bit of a misnomer in that regard since there is considerable reuse.

If you don't see the Apple iPod in the list of matching signatures, then it would be best to add it (the result would be that you'll see both cameras listed as possible matches).

Hope that helps,
I have few photos which are corrupted and cannot be previewed.
the corrupted photos are almost with the same size like the good ones but i cant open the or see the preview.
i have trided to decode or fix with some software but i was not able to.
can you please explain how can i try to cut the header from a good photo and paste it on the other or help me with other solution?
thank you !

I'm trying to detect if a PDF has been photoshopped.
I have a base PDF to compare it to.

What parameters should I be looking at?
 Are you trying to determine if a PDF file has been modified? Or if an image within a PDF has been altered (ie. "photoshopped")?

In this particular situation, could you clarify what you meant by the "base PDF" -- is it another PDF that should be identical to the second PDF (but you didn't notice any differences?) Sorry if I misunderstood the question.

If the PDF file was edited according to "spec", then it may leave some traces of edits (in a ModDate or generation numbers in the objects), but this isn't guaranteed.

If you are wondering about whether an embedded JPEG within a PDF file has been altered (since originally captured), then you can use the image search function in JPEGsnoop to find the image and then process it as normally (ie. compare compression signatures, etc.).

i would test the version 1.7.4

add parameter to save the file when use
through cmd

also some pictures not ext_all through nogui only when i open it normally
 Hi there ebrahim! I have a given you a link to beta test version 1.7.5. It has a number of new features, in addition to a rewritten command-line interface that should operate better.

PNG files don't work with this tool right?
 Hi David -- at this time, JPEGsnoop doesn't analyze PNG files but I could potentially add such a feature if there were enough interest.
 I couldn't view on my PC an image saved with Photoshop CS6 Mac. With some hex-editing I could manually extract only 2 previews from this file (one in PNG, the other in JPG) but they were low-res. So I opened my image with JPEGSnooper, then I used "Tools -> Image search fwd", finally I did a "Tools -> Export JPEG -> Extract All JPEGs" and voilà, I had 3 images: one of them was the hi-res JPEG. THANK YOU!!!!!!!!!!!
 Excellent! Glad to hear it!
 I downloaded version 1.7.3 and appears during startup crash - Win XP SP3 CPU support SSE - I suspect that it is a CPU with SSE2 instructions - last acting in my version is 1.6.1
 Hi Peter -- Thanks for letting me know about it. I will followup via email to help resolve it if I can.
 Just came by to confirm URL so I can point someone here :)

I have a microscope-camera gadget called an "EyeClops" (I think it came from Toys R Us) that's not in your ID database -- do you want an image to check out?
 Hey thanks Rez! Sure, if you can email me a copy that would be great.
I am having a hard time understanding all the codes. If I sent you a photo would you be able to decipher? All I want to know is if the photo is an original? And possibly the region it was taken.
Thank you.

I am trying to use your program to recover some corrupted jpeg. Everytime I try to open the jpeg i get this error "The Parameter is in correct"

can you please help. Thank you
 Hi Mike -- if you can contact me again and provide your email address I could take a look at the file to determine what might be happening. Thanks!
 Thanks!! I used the search forward option and it finds the largest JPG now however it always stops part way through the process and only displays partial. I can get the full thumb and full smaller JPG (only 55 KB) but process always stops suddenly when I search forward to the hi res JPG. Any thoughts or setting suggestions?

A couple sample images I am trying to recover can be found on my dropbox link at

Great program! Just need to figure out how to get it to fully recover the hi-res versions.

Thanks in advance

Curious why when I export as JPEG it outputs a much smaller version of what the original image was. The original images are about 8MB in size while the output of snoop is only about 50 KB??

The reason for that is that most JPEG images (from a digicam) contain several versions of the same image. Generally you'll find a full-resolution image, a small thumbnail and sometimes a large thumbnail/preview. What you have encountered is probably a case where JPEGsnoop found the small thumbnail first (and extracted that). If you press "Search Forward" you might find that it could locate one of the larger images, thereby enabling you to extract that as well.
 Hi Chris --

Were the 3 files you posted from the output of a recovery program or were they direct from your hard drive / memory card? These files all exhibit a case of the file being a merge of multiple photos.

Long story short, the original images have been "spliced" causing only a small amount of data to be extracted. More advanced techniques are needed to get at the remainder of the data (dealing with fragmentation). But even then. you would not be able to fully recover the hi-res version -- your original images do not exist within these files.

More detail: JPEGsnoop's image decode only starts when it finds a proper header. When you perform "Search Forward", JPEGsnoop will seek the next valid JPEG header. In doing so, it is skipping over a very large amount of data that is in the file. This extra data is actually the remainder of another image data from your drive/card. It is possible to see this additional image data if one messes around with the headers.

Let's say that the original image was 8.6MB in size. In example "_SCN0336.JPG" we actually skip almost 7MB before we find the start of a valid image. That only leaves us with 1.6MB of image data before we get cut off. If we try to extract the image, we are only left with a small fraction of the original file. The extra 7MB is coming from a completely different hi-res file that happened to be on the card/drive.
 Curious why when I export as JPEG it outputs a much smaller version of what the original image was. The original images are about 8MB in size while the output of snoop is only about 50 KB??
 The reason for that is that most JPEG images (from a digicam) contain several versions of the same image. Generally you'll find a full-resolution image, a small thumbnail and sometimes a large thumbnail/preview. What you have encountered is probably a case where JPEGsnoop found the small thumbnail first (and extracted that). If you press "Search Forward" you might find that it could locate one of the larger images, thereby enabling you to extract that as well.
 Please see as the 'list of cameras detected by the software? If I go to Tools / Manage local DB the list is empty.
The DB is C:\Users\alfredo\AppData\Roaming\JPEGsnoop\JPEGsnoop_db.dat dimension 1 KByte.
 The list of cameras detected does not appear in the "user / local database". It is internal to the tool. What appears in the local DB are only the signatures that the user has captured.
 I have an SD card with some RAW images (.CR2) and JPEG's that show the correct size but won't open (invalid image). Hex editor shows all zeros in these files. JPEGsnoop says "File did not start with JPEG marker" and [Tools->Img Search Fwd] did not find anything.

Is there ANY way to recover these files?
 Unfortunately, if the file content (as viewed in a hex editor) shows all zeros then there is no way to recover the image from the file itself. The best bet is to attempt a recovery from the source media (eg. hard drive or memory card) with a more sophisticated recovery program that is able to look beyond the "logical directory structure".
 Greetings. I need to determine if the date/time value in the exif metadata of an iPhone picture has Ben modified. I understand that it's a simple value to change, eg importing pics into iPhoto then gives user option to adjust the date/time a picture was captured. I'd like to be able to tell if this field has been edited before file dissemination. Is this something your program is capable of?
Thank you in advance.
 Generally, one cannot determine that an EXIF field has been edited since there is no redundancy or checksums to confirm that the current field content (such as date/time) matches what it was at the time the image was first created. However, some cameras (and phones such as iPhone) store date/time info in several places within the JPEG image metadata. Some software programs may alter one or more fields but not all. Therefore, if you examine all date/time related fields within the metadata, there is a chance that you may find one that maintains its original setting.

For example, in an iPhone 5 JPEG image, one often finds date/time info in the following sections reported by JPEGsnoop:

  • EXIF IFD0: DateTime
  • EXIF SubIFD: DateTimeOriginal
  • EXIF SubIFD: DateTimeDigitized
  • APP1 XMP: MicrosoftPhoto:DateAcquired

In addition, some recent iPhones (typically iOS 7 or later) include Apple MakerNotes fields that (after decoding) may show further date/time info. The advantage of checking MakerNotes is that it is often harder for software to alter these fields -- instead they tend to remove them all if anything is modified. As a result, if you find a date/time in the MakerNote field, there is a reasonable chance that it is reflective of the actual date/time of capture.
 hello .. i have few images that we modified, changed and resized from the original and then emailed to me .. Is there a way i can convert these manipulated images back to the original using your software or any other method .. so far no success .. is it possible .. will appreciate your help ..
thanks ..
 Sorry, but it is highly unlikely that you could retrieve an original version of an image once it has been edited/resaved. In most cases the new file only contains the new version of the image.
 Hi There. Thanks for your reply. I have managed to get the program to export jpeg's. I had to use the EOI boxes otherwise It said ERROR. But when I click the repaired jpes's I am still getting "drawing failed" Do you have any idea what to do now??
 When you export an image, there is no guarantee that the resulting image will be valid (or readable with Windows). In many cases the file will still be corrupted. For some digital cameras, there is a second embedded (large) thumbnail which may also be worth extracting. Press Ctrl+2 for "Image Search Forward" and then try the export again.
 Hi There.
I might be stupid but I am having a problem with this program.
I click on file, It says, Open Image. which I click on. I go to my damaged pictures and click on one. I can then see a small thumbnail of the picture (no bigger than a stamp) Then open tools and click on Export jpeg. Send to my desktop. But then on my desktop there is no picture?? I have tried sending the pics to various locations with the same results. I have also tried different pictures all with the same result.
Please tell me where I am going wrong or what I am doing wrong.
Many Thanks.
 Once you click on Tools->Export JPEG... and press OK, you should see the log window say *** Exporting JPEG ***.

Below that, it should give you the full path to your file after Exporting to:. Do you see this path? Copying this full path into a windows explorer window, it should find and load the image for you.

I just wanna ask if you know a software that can restore cropped photos
Into its original form that has been put into collage?
What I mean is, knowing and extracting and getting it to its original form.
I have sent a collage pics to a friend, all pics used were all cropped
and to my surprised she identified the people I'm with from that cropped
image in the collage. She said she restored it using the embedded details
in every picture.
I'm wondering how she do that.

Help pls.

Please find posters about the Canon Raw (CR2) file format

Laurent Clévy
 Excellent! Thank you very much Laurent for this wonderfully detailed summary. I will take a look to see how much work it might be to introduce additional decoding for JPEGsnoop.
I wonder if jpeg-snoop is able to detect which jpeg image is corrupted. I have got about 10.000 jpegs and I cannot see each of them with my eyes... I'd like to have a list of what damaged, if any. Is it possible?
 Hi Adler - With the current version of JPEGsnoop, it may be possible to use the Batch Process feature to work through the 10,000 files and generate the associated log files. You could then use a free utility to search for ERROR in the *.log files. In future versions of JPEGsnoop I may add a feature (if there's enough interest) that compiles a summary report of all the results of the Batch Processing task, which could be a good way to achieve what you're after.
 Tried to post this in SourceForge... but couldn't figure out how to submit a new bug report. The new version always seems to say "files larger than 2GB not supported in this version of JPEGsnoop" even if the files are smaller than 2GB. (Have one that's 1.85GB and gives that error).
 Thanks JL! Yes, you're right. Unfortunately I had missed testing the recent version with multi-GB files and see now that the file size threshold was set too low.

I have now extended JPEGsnoop v1.7.2 to support files up to 4GB in size! I am just completing testing and will release it shortly. Thanks for your patience.
 This is funny -- I'd just got done telling someone on a forum about JPEGsnoop, and literally 5 seconds later, here in my mailbox is your notice of an update. Good karma or what? :)
 Could you please update sourceforge project? It is stuck at v. 1.5.2
 Definitely! I have just completed significant rewrites of the source code (for v1.7.x) and have updated the repository now.
 Hi Calvin

The following image

gives following error with JPEGsnoop 1.7.0:

ERROR: SetDhtTables(comp=4, TblDC = 0 TblAC = 0) out of indexed range

It worked faultlessly with JPEGsnoop 1.6.1.

Thank you!
 Hi Guido!

Thanks for providing the example file. The handling of table indices with CMYK files has been fixed in version v1.7.1, along with many other corrections. Version v1.7.1 will be posted very shortly.
2014-09-09Crash with 444 image
 The following image crashed JPEGSnoop in the latest iteration.
 Thanks for the example file to test.
This issue has been fixed in JPEGsnoop version v1.7.1
 I have about 430 JPEG wedding images that looked fine when I took them with my Nikon and can be copied off the micro SD card - the file sizes even seem correct, but only the first few are viewable and have any extended data. The last good one seems to have a corruption (plain brown on the bottom half of the image) and all of them after that are not viewable. Using your program, it looks like it's missing the SOI and cannot even find the SOS marker - could it still be recoverable? When I used CardRecovery software it didn't find any of the corrupt images except that first one, and saved it as a 54Gb file - making me think that a bad sector killed the EOF data and all of the images are combined in there somehow.
 Sorry to hear about the corruption. If you are lucky, you might find that the recovery file does indeed contain a number of intact images. Typically recovery programs will generate these massive files if the file system directory gets damaged. Although many images may still be fully intact, others will be corrupted because of file system fragmentation.

I would recommend that you split the 54GB file into 1GB chunks (keep the original) and then use JPEGsnoop with the "Image Search Forward" command to see if any images can be extracted.

There are many free utilities that will split large files. A quick search of google for "windows utility split file free" shows a few.

Good luck!
2014-06-15Puji Winasti
 thank for your page,
 Hey, I love the program, but just one quick question: My JPEG, which has been altered, leaves a red and white stripe on the bottom of the image. What is this?
 If you are referring to the area of the image outside of the dashed lines (on the right and bottom sides) then this is a region that is not normally displayed by viewers. From a simplistic perspective, JPEG images are compressed in chunks (often 8x8 pixels) so if your image doesn't quite make up a full 8 pixel tile, some "garbage" data is left outside of the real image boundary and the file instructs the viewer to trim it down to the proper size. JPEGsnoop is able to show you this "throw-away" region (aka partial MCUs).
 Fantastic program, very impressive functionality!

It's the only one to successfully fix my image. However, there doesn't appear to be a way to export the image from the program other than screenshoting it... I'd like to look at the fixed file's hex though. Is there anyway to export the fixed image, or to manually fix the image based off the data JPEGsnoop gives?
I'm not sure exactly what the program does in response to the error.
It's this type of error:

*** ERROR: @ [offset here], num_coeffs>64 [68]
*** ERROR: Bad scan data in MCU(2,10): Lum DC CSS(0,1) @ Offset 0x00002DC3.1
MCU located at pixel=(32,168)

I'm understand that there's an extra AC coefficient at the given location in the specified MCU, how do I do what the program does and remove it (w/ hex editor I'm guessing...)?

Thanks for your help, and this fantastic program!
 If JPEGsnoop is able to display your image, then you may be able to save it out using Tools -> Export TIFF.... Good luck!
 FFMPEG full scale JPEG YUV 422, 444 cannnot be decoded successful but 420 works. You can generate the JPEG file in:

ffmpeg -i my.avi -ss 00:00:10.000 -f image2 -vframes 1 -pix_fmt yuvj422 out.jpg

You can also try this:
 Thanks Allen! I have reproduced the issue and think I see what code needs to be adjusted. I filed this in the SourceForge bugtracker as (SF-bug-018).
 Hi Calvin

I think you have the knowledge and skills to point me in the right direction.

I have a custom Highlights Warning jpg target built in Photoshop that I would like to upload to my Nikon DSLR. Once uploaded this can be used to determine the exact tonal level at which the Highlights Warning starts to flash thereby indicating clipping.

The problem I am having is putting the CS jpg in the right format for the Nikon DSLR to accept it. I have tried copying, cutting, pasting and editing EXIF data, headers, thumbnails and previews from an original Nikon jpg (using tools like exiftool) but can't find the right approach. I was wondering if it would be possible to take an existing Nikon jpg and using the hex editor remove the Nikon jpg and replace it with the CS target jpg, leaving the original Nikon exif intact?

Any ideas or help would be greatly appreciated as I am running out of ideas and "skill sets".
 Hi Shane -- sounds like an interesting problem! It is quite likely that the issue is with the characteristics of the embedded JPEG thumbnail. In general you cannot simply substitute the image (scan data) with a hex editor as the quantization and huffman tables won't match up. If you send me a copy of an image direct from the Nikon and your highlight test image, I can take a look.
 I found 01D7D42C1C869993B7E598D7C109534B
posted on a blog from 2011 ...
Signature: 01191863A92FA362537A80411114BBC3
Signature (Rotated): 01D7D42C1C869993B7E598D7C109534B
File Offset: 0 bytes
Chroma subsampling: 2x2
EXIF Make/Model: NONE
EXIF Makernotes: NONE
EXIF Software: OK [Adobe Photoshop CS3 Macintosh]

I have run a photo gotten same ...
Signature: 01191863A92FA362537A80411114BBC3
Signature (Rotated): 01D7D42C1C869993B7E598D7C109534B
File Offset: 0 bytes
Chroma subsampling: 2x2
EXIF Make/Model: NONE
EXIF Makernotes: NONE
EXIF Software: NONE
**(slightly different ID on rotated)
ASSESSMENT: Class 1 - Image is processed/edited

1. Since my signature line 1 matches the old posting from 2011, is mine also from same software..
2. Is there a database update available? or a way to combine or share user databases?
3. Does the rotated signature indicate it is different from the 2011 blog posting?
(blog url )
 Hi -- that signature matches one that often appears in Photoshop files. I haven't been releasing database updates in a while, however you can load other people's databases (or share one) by selecting a new file location under Options->Configuration->Directory for User Database. The filename is "JPEGsnoop_db.dat".


Leave a comment or suggestion for this page:

(Never Shown - Optional)

NOTE: Image repair requests are not accepted. Thanks for your understanding.