Return to Digital Photography Articles

JPEGsnoop 1.7.3 - JPEG File Decoding Utility

by Calvin Hass © 2014

JPEGsnoop is a free Windows application that examines and decodes the inner details of JPEG and MotionJPEG AVI files. It can also be used to analyze the source of an image to test its authenticity.

JPEGsnoop Program Icon

Overview

Latest Version: 1.7.3


Introduction

Every digital photo contains a wealth of hidden information -- JPEGsnoop was written to expose these details to those who are curious.

Not only can one determine the various settings that were used in the digital camera in taking the photo (EXIF metadata, IPTC), but one can also extract information that indicates the quality and nature of the JPEG image compression used by the camera in saving the file. Each digical cameras specifies a compression quality levels, many of them wildly different, leading to the fact that some cameras produce far better JPEG images than others.

What can I do?

Check out a few of the many possible uses for JPEGsnoop!

One of the latest features in JPEGsnoop is an internal database that compares an image against a large number of compression signatures. JPEGsnoop reports what digital camera or software was likely used to generate the image. This is extremely useful in determining whether or not a photo has been edited / tampered in any way. If the compression signature matches Photoshop, then you can be pretty sure that the photo is no longer an original! This type of analysis is sometimes referred to as Digital Image Ballistics / Forensics.

JPEGsnoop reports a huge amount of information, including: quantization table matrix (chrominance and luminance), chroma subsampling, estimates JPEG Quality setting, JPEG resolution settings, Huffman tables, EXIF metadata, Makernotes, RGB histograms, etc. Most of the JPEG JFIF markers are reported. In addition, you can enable a full huffman VLC decode, which will help those who are learning about JPEG compression and those who are writing a JPEG decoder.

Other potential uses: determine quality setting used in Photoshop Save As or Save for Web settings, increasing your scanner quality, locating recoverable images / videos, decoding AVI files, examining .THM files, JPEG EXIF thumbnails, extract embedded images in Adobe PDF documents, etc.

Trying to Undelete or Unformat your Photos?

If you're interested in trying to recover your deleted / corrupted photos, check out my new page on recovering deleted photos.

File Types Supported

JPEGsnoop will open and attempt to decode any file that contains an embedded JPEG image, such as:

  • .JPG - JPEG Still Photo
  • .THM - Thumbnail for RAW Photo / Movie Files
  • .AVI* - AVI Movies
  • .DNG - Digital Negative RAW Photo
  • .PSD - Adobe Photoshop files
  • .CRW, .CR2, .NEF, .ORF, .PEF - RAW Photo
  • .MOV* - QuickTime Movies, QTVR (Virtual Reality / 360 Panoramic)
  • .PDF - Adobe PDF Documents

* Note that video file formats (such as .AVI and .MOV) are containers, which can include video streams encoded in one of a wide variety of codecs. JPEGsnoop can only interpret this video footage if the codec used is based on Motion JPEG (MJPG).


Download the Latest Version of JPEGsnoop!


Click to Download .ZIP
Version: 1.7.3
Version History

Released: 09/28/2014
Downloads: 370977

JPEGsnoop by Calvin Hass

Help Support JPEGsnoop Development

If you have found JPEGsnoop useful and would like to support its continued development, consider making a small contribution. Donations will help encourage me to add new and interesting features. Found an interesting use for the tool? Let me know!

Source Code: JPEGsnoop is now Open Source!


System Requirements

This application has been designed and tested to run on Windows XP, Windows Vista and Windows 7. As of version v1.7, Windows XP SP1 is a minimum requirement. JPEGsnoop is fully portable, so it does not require any installation!

LINUX users: JPEGsnoop apparently works on LINUX under wine

Mac users: JPEGsnoop works within CrossOver Mac

Terms of Use

JPEGsnoop is free for personal and commerial use. Commercial users are encouraged to leave me a brief private message so that I can understand your needs and make future versions more useful.

Installation

No installation required. JPEGsnoop is very portable. Simply unzip the download and run!

Version History

For information about features added in previous versions of JPEGsnoop, please check out the version history page.

Feature Requests / Bug Reports

Please feel free to add your own feature requests or bug reports by submitting to the links on the JPEGsnoop Source page


Awards and Recognition for JPEGsnoop

  • PC Magazine - Utility Guide 2009 - July 2009
  • Win Magazine - May 2009
  • CHIP.de Magazine - Program of the Month - April 2009
    CHIP.de Magaine - Chip Pick - November 2012
  • Computer Bild Magazine - Issue 10/2009


Main Window
Channel Histograms
MCU Grid & Positioning

Documentation

Please see the options page for information on how to use JPEGsnoop and other interesting uses for the tool

Recent Features

  • Photoshop PSD decoding
  • Batch file processing
  • XMP APP1 & ICC Header display
  • IPTC and Photoshop IRB / 8BIM parsing
  • GPS EXIF metadata display
  • Full detailed Huffman VLC decoding output for those interested in writing a decoder or learning JPEG compression
  • Automatic display of YCC DC block values (16-bit)
  • MCU Grid overlay and automatic display of mouse MCU position and file offset in image display window.
  • Test overlay function enhanced to allow quick apply and binary code readout.
  • Image zoom level from 12.5% - 800%.
  • Extract embedded JPEGs -- can be used to extract thumbnails, hidden JPEG files, as well as frames from Motion JPEG AVI files.
  • Compression detection enhanced to detect rotated signatures, comment field.
  • Full AVI file parsing (to identify MotionJPEG)
  • DQT table searches in Executables (for "hackers")
  • Detect edited images or identify original digital camera that took a photo!
  • Integrated database of thousands of compression signatures (image fingerprint) for digital cameras and editing software
  • File overlay test function
  • Multi-channel preview: RGB, YCC, R/G/B, Y/Cb/Cr
  • Pixel position lookup into file offset
  • Examine Motion JPEG .AVI or .MOV (Quicktime) files (MJPG or MJPEG) and play through!
  • Examine any file fragments that may contain a JPEG image
  • YCC to RGB Color correction / clipping statistics reports
  • Command-line execution
  • Huffman variable-length code statistics
  • Expansion of DHT (Huffman Table Expansion into bitstrings)
  • Determine IJG JPEG Quality factor

Background Material

If you want to understand some of the technical details reported by JPEGsnoop, I suggest that you read through my articles on JPEG compression:

Suggestions

As this is a work in progress, I would be very interested in hearing from you, particularly for feature requests, suggestions, comments, bug reports, etc. If you currently use JPEGsnoop and find it useful, let me know!

 


Reader's Comments:

Please leave your comments or suggestions below!
2014-09-22Adler
 Hi,
I wonder if jpeg-snoop is able to detect which jpeg image is corrupted. I have got about 10.000 jpegs and I cannot see each of them with my eyes... I'd like to have a list of what damaged, if any. Is it possible?
 Hi Adler - With the current version of JPEGsnoop, it may be possible to use the Batch Process feature to work through the 10,000 files and generate the associated log files. You could then use a free utility to search for ERROR in the *.log files. In future versions of JPEGsnoop I may add a feature (if there's enough interest) that compiles a summary report of all the results of the Batch Processing task, which could be a good way to achieve what you're after.
2014-09-14JL
 Tried to post this in SourceForge... but couldn't figure out how to submit a new bug report. The new version always seems to say "files larger than 2GB not supported in this version of JPEGsnoop" even if the files are smaller than 2GB. (Have one that's 1.85GB and gives that error).
 Thanks JL! Yes, you're right. Unfortunately I had missed testing the recent version with multi-GB files and see now that the file size threshold was set too low.

I have now extended JPEGsnoop v1.7.2 to support files up to 4GB in size! I am just completing testing and will release it shortly. Thanks for your patience.
2014-09-14Reziac
 This is funny -- I'd just got done telling someone on a forum about JPEGsnoop, and literally 5 seconds later, here in my mailbox is your notice of an update. Good karma or what? :)
 =)
2014-09-14Al
 Could you please update sourceforge project? It is stuck at v. 1.5.2
 Definitely! I have just completed significant rewrites of the source code (for v1.7.x) and have updated the repository now.
2014-09-13Guido
 Hi Calvin

The following image
http://www.berlininart.com/wp-content/uploads/2012/08/1330_Kim.jpg

gives following error with JPEGsnoop 1.7.0:

ERROR: SetDhtTables(comp=4, TblDC = 0 TblAC = 0) out of indexed range

It worked faultlessly with JPEGsnoop 1.6.1.

Thank you!
 Hi Guido!

Thanks for providing the example file. The handling of table indices with CMYK files has been fixed in version v1.7.1, along with many other corrections. Version v1.7.1 will be posted very shortly.
2014-09-09Crash with 444 image
 The following image crashed JPEGSnoop in the latest iteration.

http://www.w3.org/MarkUp/Test/xhtml-print/20050519/tests/jpeg444.jpg
 Thanks for the example file to test.
This issue has been fixed in JPEGsnoop version v1.7.1
2014-07-22Tebulon
 I have about 430 JPEG wedding images that looked fine when I took them with my Nikon and can be copied off the micro SD card - the file sizes even seem correct, but only the first few are viewable and have any extended data. The last good one seems to have a corruption (plain brown on the bottom half of the image) and all of them after that are not viewable. Using your program, it looks like it's missing the SOI and cannot even find the SOS marker - could it still be recoverable? When I used CardRecovery software it didn't find any of the corrupt images except that first one, and saved it as a 54Gb file - making me think that a bad sector killed the EOF data and all of the images are combined in there somehow.
 Sorry to hear about the corruption. If you are lucky, you might find that the recovery file does indeed contain a number of intact images. Typically recovery programs will generate these massive files if the file system directory gets damaged. Although many images may still be fully intact, others will be corrupted because of file system fragmentation.

I would recommend that you split the 54GB file into 1GB chunks (keep the original) and then use JPEGsnoop with the "Image Search Forward" command to see if any images can be extracted.

There are many free utilities that will split large files. A quick search of google for "windows utility split file free" shows a few.

Good luck!
2014-06-15Puji Winasti
 thank for your page,
2014-05-22Matt
 Hey, I love the program, but just one quick question: My JPEG, which has been altered, leaves a red and white stripe on the bottom of the image. What is this?
 If you are referring to the area of the image outside of the dashed lines (on the right and bottom sides) then this is a region that is not normally displayed by viewers. From a simplistic perspective, JPEG images are compressed in chunks (often 8x8 pixels) so if your image doesn't quite make up a full 8 pixel tile, some "garbage" data is left outside of the real image boundary and the file instructs the viewer to trim it down to the proper size. JPEGsnoop is able to show you this "throw-away" region (aka partial MCUs).
2014-05-21Danny
 Fantastic program, very impressive functionality!

It's the only one to successfully fix my image. However, there doesn't appear to be a way to export the image from the program other than screenshoting it... I'd like to look at the fixed file's hex though. Is there anyway to export the fixed image, or to manually fix the image based off the data JPEGsnoop gives?
I'm not sure exactly what the program does in response to the error.
It's this type of error:

*** ERROR: @ [offset here], num_coeffs>64 [68]
*** ERROR: Bad scan data in MCU(2,10): Lum DC CSS(0,1) @ Offset 0x00002DC3.1
MCU located at pixel=(32,168)

I'm understand that there's an extra AC coefficient at the given location in the specified MCU, how do I do what the program does and remove it (w/ hex editor I'm guessing...)?

Thanks for your help, and this fantastic program!
 If JPEGsnoop is able to display your image, then you may be able to save it out using Tools -> Export TIFF.... Good luck!
2014-05-21AllenKK
 FFMPEG full scale JPEG YUV 422, 444 cannnot be decoded successful but 420 works. You can generate the JPEG file in:

ffmpeg -i my.avi -ss 00:00:10.000 -f image2 -vframes 1 -pix_fmt yuvj422 out.jpg

You can also try this:
https://trac.ffmpeg.org/raw-attachment/ticket/143/yuvj422.jpg
 Thanks Allen! I have reproduced the issue and think I see what code needs to be adjusted. I filed this in the SourceForge bugtracker as (SF-bug-018).
2014-04-28Shane
 Hi Calvin

I think you have the knowledge and skills to point me in the right direction.

I have a custom Highlights Warning jpg target built in Photoshop that I would like to upload to my Nikon DSLR. Once uploaded this can be used to determine the exact tonal level at which the Highlights Warning starts to flash thereby indicating clipping.

The problem I am having is putting the CS jpg in the right format for the Nikon DSLR to accept it. I have tried copying, cutting, pasting and editing EXIF data, headers, thumbnails and previews from an original Nikon jpg (using tools like exiftool) but can't find the right approach. I was wondering if it would be possible to take an existing Nikon jpg and using the hex editor remove the Nikon jpg and replace it with the CS target jpg, leaving the original Nikon exif intact?

Any ideas or help would be greatly appreciated as I am running out of ideas and "skill sets".
 Hi Shane -- sounds like an interesting problem! It is quite likely that the issue is with the characteristics of the embedded JPEG thumbnail. In general you cannot simply substitute the image (scan data) with a hex editor as the quantization and huffman tables won't match up. If you send me a copy of an image direct from the Nikon and your highlight test image, I can take a look.
2014-03-10awesome_man
 I found 01D7D42C1C869993B7E598D7C109534B
posted on a blog from 2011 ...
Signature: 01191863A92FA362537A80411114BBC3
Signature (Rotated): 01D7D42C1C869993B7E598D7C109534B
File Offset: 0 bytes
Chroma subsampling: 2x2
EXIF Make/Model: NONE
EXIF Makernotes: NONE
EXIF Software: OK [Adobe Photoshop CS3 Macintosh]

I have run a photo gotten same ...
Signature: 01191863A92FA362537A80411114BBC3
Signature (Rotated): 01D7D42C1C869993B7E598D7C109534B
File Offset: 0 bytes
Chroma subsampling: 2x2
EXIF Make/Model: NONE
EXIF Makernotes: NONE
EXIF Software: NONE
**(slightly different ID on rotated)
...MYRESULTS...
ASSESSMENT: Class 1 - Image is processed/edited

Questions.
1. Since my signature line 1 matches the old posting from 2011, is mine also from same software..
2. Is there a database update available? or a way to combine or share user databases?
3. Does the rotated signature indicate it is different from the 2011 blog posting?
(blog url )
http://forum.nexoneu.com/archive/index.php?t-336514.html
 Hi -- that signature matches one that often appears in Photoshop files. I haven't been releasing database updates in a while, however you can load other people's databases (or share one) by selecting a new file location under Options->Configuration->Directory for User Database. The filename is "JPEGsnoop_db.dat".
2014-03-10Chris
 A friend had their JPEGS encrypted by Cryptorbit I used Anti-Cryptorbit v2 to unencrypt the jpegs but noticed that they had all been resized to 160x120 which is thumbnail size.

I found that running the pictures through JPEGSnoop clicking Tools IMG Search FWD, then click Export JPEG then tick Missing EOI, then I save the JPG and the image size/resolution is restored, which is great but I have several thousand files to restore, as I am having to do each one individually it will take me a long time, I know JPEGSnoop has a batch process function but I cannot seem to find out how to get this to automate what I am trying to do, does anyone know how to use the batch process function so that I can restore the photos automatically without going through them one at a time.

Below is a video on what I am doing to restore the size of each photo

http://youtu.be/HHJhaNPr4bA
 Hi -- that's great to hear that the export worked to recover the full-res images. Unfortunately the batch process or command-line parameters don't currently support the automation that you're trying to achieve. I could add it to the list of options to consider in future versions if there is enough interest.

In the meantime, you might be able to workaround it in the following way:

  • Open windows command prompt
  • Change to the directory containing your images
  • copy /b *.JPG > all_images.bin
  • Open all_images.bin in JPEGsnoop
  • Tools -> Export JPEG..., click on "Extract All JPEGs" (and "Force EOI" if that is found to help in your case), then
  • Select an output directory and filename, click Save
  • Now you should see many of your images (full-res and thumbnails) extracted to your directory

Good luck!
2014-03-03Guy
 Hi,
Great tool. I have been experimenting with Google+/Picasaweb and trying to check that when I download files back to my PC, they haven't been compromised. I noticed that they are slightly smaller, and using your software I have been able to show that one of the thumbnails is missing from the file recovered from Google. That's fine, but it doesn't account for all the kb lost. If I export as a TIF, the resulting files are exactly the same size. Does this prove that my original has not been re-compressed? The 2 signatures are the same. The metadata seems to be the same, but I really just want to make sure it is the same image data in there.
Guy
 Exporting to TIFF and comparing file size will not give you any indication of whether edits or recompression has occurred to the image. TIFF is often uncompressed which means that file size will largely be directly related to the image dimensions and not the content. The best bet is to compare the rest of the metadata in JPEGsnoop. If the compression signature is the same, then it is very likely that the image has not been recompressed. Instead, what you are probably seeing is the removal of metadata (such as makernotes) which can also include a larger thumbnail/preview image.
2013-12-25John
 Hi
I have used a number of EXIF utilities for my Android to find the date some pics were taken, but I cannot find this info on images that were texted to me or that I download. They all work on pictures taken on my own phone, but not those downloaded via text or the net. Any hints on that? Does yours manage to do this? If so, I will download but I have to find a PC to do so, since I am on a Mac, unless there is a version directly for Android that you have?
Thanks, John
 Generally photos uploaded to the web or that are sent via text message are recompressed and often have their metadata stripped. Therefore you lose some of the identifying information (such as the EXIF DateTime fields). It is possible that there are still other metadata fields that were left intact that don't show up on the PC/Mac file properties. Running JPEGsnoop on the files will show you nearly all possible metadata fields. Some people have had luck running JPEGsnoop on the Mac under wine.
2013-06-28andy
 Hello!

This is a fantastic little tool, and you don't even charge people for it - brilliant! Unfortunately, this dumped out some sort of protection fault here on Linux. I hope you have some of your friends around with a Linux box. It appears to trigger much likely if you SCROLL quickly up and down in the GUI.

http://pastebin.com/wGkzaBEn

I hope this will make any sense to you.
To reduce the clutter: first part is output from console, then after ' ... ' there is the second part copypasted from the error message window.
 Hi Andy -- glad to hear the tool has been useful! Unfortunately, I don't have access to debugging facilities in LINUX to see where the bug may be cropping up in the wine "emulation", so it may be difficult for me to help diagnose this. It is possible that it is a wine DLL issue as noted in the following text from the winehq FAQ, so you might want to give this a try:
"You may have run into a bug in Wine's RICHED20.DLL. You can try using Microsoft's RICHED20.DLL by running winetricks and selecting riched20. This may let you work around the problem until the Wine developers fix the bug."
2013-06-27Al
 Hello - I am trying to put together a slideshow from pics that are about 10 years old. Unfortunately they must have been on an external hard drive at one point that had issues because now almost all my images look something like this: http://i268.photobucket.com/albums/jj4/SmedRoc/P4070035.jpg (I found that one from Google Images but its the same idea). When I open the jpg in jpegsnoop, the preview at the bottom looks perfect and I can export it but it exports it at a much smaller size - instead of 1600x1200 it gives me an image of 160 x 120! Is there anyway to export it out at the same full size resolution that I imported it?

Thank you!
 Unfortunately your images have become corrupted. Your JPEG files actually contain two parts, the main image and the thumbnail image. When a file becomes corrupt, there is a greater chance of the corruption impacting the main image while leaving the thumbnail image intact. So, when you exported from within JPEGsnoop, you were probably just exporting the thumbnail image (160x120). If the main image content was corrupted (likely in your case), the JPEGsnoop export wouldn't be able to recover the original 1600x1200 image. Recovering the 1600x1200 image would require advanced image repair techniques that are not generally possible with automated software.
2013-06-23zekegonzalez
 Alright! This is a fabulous little utility!! I had some pix I value greatly saved on my HDD and suddenly they got corrupted somehow. They were showing data there w/ a file size and everything but the dimensions were reading 0 x 0 and I wasn't seeing the pic, plus they wouldn't open w/ Paint and MS Office Picture Manager wouldn't process them either.

I was able save the first two I tried. Maybe I should fork out a few bucks for this handy little program...
2013-04-15travis
 Just wanted to follow up on my earlier comment ... you might want to post this since it could be of use to other users.

I never could get windows7 to open a jpeg with separate scan data sections for each image component (Alex posted an example image in a comment here from may 2011).

My solution was to used jpegtran, available for free nearly unrestricted use, to "optimize" the jpeg without re-encoding and in the process it combines the 3 scan data sections to 1 which makes windows happy.

Thanks again for the great site, i never would have looked for a lossless jpeg optimizer if I hadn't realized that such a thing was possible from reading over your site.

A bonus is the optimized images are combing back about 10% smaller in file size!
 Excellent news that you found jpegtran can reformulate the multiple scans into one. Thanks for sharing this workaround!
2013-04-12travis
 Really enjoy your site and tool ... hows the baby?

Was hoping you could tell me something about images with 3 scan data sections, each with one component of a 3 component image (one Y scan data section and another for each of CR and CB).

I have some images like that that the windows imaging components in windows 7 don't like (so cant open in image viewer, internet explorer, .net programs).

In my case if I isolate any of the 3 sections, (deleting the other 2 with a hex editor) that component will show fine ... but with the 3 together, or some combinations of 2, windows thinks the file is corrupt.

I appreciate that you can't help everyone fix their corrupt jpegs but any insights in the 3 scan images might help me out, thanks a lot
 As you've noticed, some JPEG decoders are not fully compatible with the separate-scans arrangement. This arrangement is permitted in the T.81 JPEG standard, but I seldom see it being used. I imagine that many developers have not tested with this sequencing. I see in your later post that you discovered jpegtran can help combine the scans, which is great news!
2013-03-18Mauro
 I am writing an application for processing a set of photos and I need two function in C++, one for decoding the DC coefficient of any 8x8 compressed matrix and another function in C++ for coding the DC coefficient.
Please, let me know if you can send me these two functions and how much you will charge to do that.
Thank you for your help. Mauro Pacelli
 The best place to start would be to look at the source for IJG libjpeg. From there, check out the functions in cjpeg and djpeg.
2013-01-31sherrialicia
 I have a photo that I've been going crazy trying to get an origin for, mainly the date it was taken. I have tried quite a few programs and the only thing I get is a file date. There is nothing under properties except under comments it says LEAD Technologies Inc. V1.01. Your program has given me the most information but I don't understand most of it. At least I know what camera was used! lol Please email me if you can help me with this mystery. Thanks
2013-01-23jaber
 thanks
 
2013-01-23matt
 Hi,
I have recovered thousands of pictures from my hard drive and they are all not working, JPEGsnoop has saved my life but is there an option to export many JPEG's at one time? I can process the batch but just don't know how to export them all at once. Could you help please?
Thanks, Matt
 Hi Matt -- That's great to hear that you managed to recover a number of photos with JPEGsnoop's export function. At the moment, the Batch processing feature doesn't support the "Extract all JPEGs" function. I have added this to the list of requested features (#3603202). Thanks!
2013-01-10ozzie
 Hi,
How can I tell WHERE a photo was taken? I understood that the GPS in many cameras will give the location.
Thanks!
2012-12-09Shawn
 Greetings - will this utility locate images that have been renamed to other extensions? Example: I renamed a .jpg to .xls and moved it and forgot what it is called. Will this scan a folder or drive and locate such mis-named images? Thanks!
 Hi -- JPEGsnoop cannot currently do this type of search directly. However, there are a couple ways you could potentially achieve this: assuming you had a folder with possible misnamed files, make a duplicate of the folder, use a batch rename utility to change the extension of all files to ".jpg". Now, you have two options: with Windows Explorer you can enable "view by Icons" and it will attempt to rebuild the image thumbnails of each file it can decode. If you see an image thumbnail appear for some of the files, then you're done. Alternately, you could use JPEGsnoop to do a "batch process" (on subfolders). It will save a ".txt" file next to each file in your directories with what it found during an attempted decode. Files that are larger than about 1KB usually indicate that an image was found.
2012-11-19cd
 A portable (stealth) Version would be great.

Thanks for this great tool!
 While the current version doesn't require installation, it does create a couple registry entries to save the settings. To make it truly portable, I had created a sourceforge feature request (ID:3104043). Shouldn't be that hard to implement.
2012-10-12Tom O
 The new Samsung phones have a "cartoon" option that alters the picture to look something like a pastel painting. Do you happen to know if pictures taken in style can be converted back to normal?
 Hi Tom -- No, it is very likely that when the phone's camera is set in that mode, it only saves a "post-processed" JPEG image. The original capture would have been discarded (unless it saves both the original and the cartoon version to the memory card, which is unlikely).
2012-10-12smallest
 Hi,

I have a question about the EXIF decodng in JPEGSnoop. Specifically, I'm trying to figure out why it says the file in question has an "EXIF IFD2" IFD.

http://www.smalleranimals.com/isource/exifouttest.jpg (2K)

As far as I can tell, it doesn't. I've parsed it with our EXIF parser, ImgSource (http://www.smalleranimals.com/isource.htm) . And I've walked through the bytes manually. But I don't see why JPEGsnoop finding that IFD. I can see the data that it _thinks_ is the IFD, but I don't know how or why JPEGsnoop is getting there.

We use JPEGsnoop as a sanity check for our own EXIF processing as well as for JPEG structural analysis, so if there's a bug in our stuff, I'd like to know. And if there's a bug in JPEGsnoop, I assume you'd like to know.

Can you shine any light on this?

[JPEGsnoop output trimmed]
Start Offset: 0x00000000
*** Marker: SOI (xFFD8) ***
  OFFSET: 0x00000000
 
*** Marker: APP0 (xFFE0) ***
  OFFSET: 0x00000002
... trim ...
 
*** Marker: APP1 (xFFE1) ***
  OFFSET: 0x00000014
... trim ...

  EXIF IFD0 @ Absolute 0x00000026
    Dir Length = 0x0009
... trim ...
    Offset to Next IFD = 0x000002C3

  EXIF IFD1 @ Absolute 0x000002E1
    Dir Length = 0x0006
... trim ...
    Offset to Next IFD = 0x00000048

  EXIF IFD2 @ Absolute 0x00000066
    Dir Length = 0x0003
    Offset to Next IFD = 0x00020131

  EXIF SubIFD @ Absolute 0x000000F6
    Dir Length = 0x001B
... trim ... 
 Hi there!

I had a quick look (thanks to baby!) at the file and it appears that the "Offset to Next IFD" at the end of the IFD1 is non-zero (0x48). This is prompting us to advance on to parse another IFD (which auto-increments to IFD2). Is it possible that the "Offset to Next IFD" might be set incorrectly?

I also double-checked this with exiftool. It seems that the exiftool parser also reports that we start processing IFD2.

Hope that helps! Let me know if you want me to debug it further, Cal.
2012-08-12Dr_Radialist
 Hello!! Thank you for quite detailed description for JPEG format. I am a Cardiology doctor. Thus, it is very difficult to understand. However, I will do my best to understand, since this document looks best in the world for JPEG teaching. In the Cardiology field, we use DICOM-XA format frequently. It is a motion picture for the heart. Is is compresed using JPEG Lossless DC. I spent several years in order to write a C++ program to decode it, although I failed every time. Finally, I met this page. Thank you again from Japan!
 Thanks! It's good to hear that it was useful!
2012-08-04Thomas
 Hi,
Are there some news regarding the open file dialog and long file names (see 2011-10-29)?

I can't test it, but I think you have to point FileDlg.m_ofn.lpstrFile to a larger buffer and set FileDlg.m_ofn.nMaxFile to the size of the buffer before FileDlg.DoModal() is executed. Or it's lpstrFileTitle and nMaxFileTitle. Should be something along that line.
See an old example here (though that's for selecting multiple files and was written in order to show a limitation in increasing the buffer size - which surely isn't there anymore):
http://support.microsoft.com/kb/179372/en-us
I think, when not setting the buffers, the default size for the whole path is MAX_PATH=260 characters (?), and apparently only 64 characters for the file name.
See also catching a CommDlgExtendedError when the buffer is too small (DoModal returns IDCANCEL).
Maybe all that is also dependent of compiler and/or operating system, don't know. (I have no Visual C++ here, so there's a lot of guessing involved, sorry.)
 Hi Thomas -- thanks very much for following up with some very helpful details. I have made an update and it now supports much longer filenames. Please send me your email address so that I can send you a beta version (1.6.1) to test out.

Thanks!
2012-07-25Andrew
 Hi, compliment for this very useful program...
I'm tryin to write a sw that implements jpeg compression algorithm, but when i scan the file i written with jpegsnoop, it shows this errors:
*** ERROR: Can't find huffman bitstring @ 0x0009815C.6, table 0, value [0xff6267c0]
*** ERROR: Bad huffman code @ 0x0009815C.5
*** ERROR: Bad scan data in MCU(5,72): Lum DC CSS(0,0) @ Offset 0x0009815C.6
MCU located at pixel=(40,576)
*** ERROR: @ 0x00098171.1, num_coeffs>64 [70]
*** ERROR: Bad scan data in MCU(6,72): Lum DC CSS(0,0) @ Offset 0x00098173.5
MCU located at pixel=(48,576)
*** ERROR: Can't find huffman bitstring @ 0x000ED202.6, table 0, value [0xff0b73c0]
*** ERROR: Bad huffman code @ 0x000ED202.5
*** ERROR: Bad scan data in MCU(82,112): Lum DC CSS(0,0) @ Offset 0x000ED202.6
MCU located at pixel=(656,896)
image is http://imageshack.us/f/155/test25072012091052.jpg/
I can't understand where can be the problem, i try a handling decoding with other images with same errors and finding nothing wrong, i really hope you can help
thank you in advice.
 Hi Andrew -- please note that just because other decoders don't present an error doesn't necessarily mean that they didn't encounter the same decoding error internally.

Having a look at your sample file, it is very difficult to determine whether the decoding is occurring properly because the image content appears to be random. JPEGsnoop decoder indicates that the Luminance DC component bitstring did not match any of the huffman codes defined in the DHT tables.

I would suggest you run your decoder on a simpler test image first, and then use the Detailed Decode feature of JPEGsnoop to see if the huffman bitstring decoding is operating as expected or not.

Hope that helps and good luck!
2012-07-24Dianne
 There is a new photo of an angel in the clouds above the movie theater where the shooting occurred in Colorado. I'm skeptical and the image doesn't look right to me when I play with the hue.
The software suggests it was edited in Picasa.
I'm not really all that sure what I'm seeing though.
Can anyone confirm?

http://www.wptv.com/dpp/news/local_news/youreport/Copy_of_colorado-theater-shooting-victims-vigil-angel-woman-says-photo-shows-angel-over-vigil
 The image that you linked to is most certainly a resized (smaller) version of the original. Therefore, JPEGsnoop will just pick up on the software that was used to resize it. If you can find the original full-resolution image, then you can run JPEGsnoop on it to help determine if it was direct from the camera or not.
2012-07-23Colin O
 Hi - Any chance of including Sony RAW files (.arw). Lot more Sony's around now, as their innovations are proving popular, & cost-effective.
 Hi Colin -- unfortunately, I don't think I will be adding RAW formats since most of them are proprietary and the primary focus of JPEGsnoop was in decoding JPEG compressed files. Thanks for the suggestion.
2012-07-10Frank
 Hi there! You have written a wonderful program for jpeg analysis!
I would like to suggest 2 features:
1. Error Level Analysis
2. Luminance gradient
seen on: http://www.hackerfactor.com/blog/index.php?/categories/14-Forensics
the scientific paper: http://blackhat.com/presentations/bh-dc-08/Krawetz/Whitepaper/bh-dc-08-krawetz-WP.pdf

These would make your program a complete tool for image forensics.
 Thanks! I completely agree. Adding ELA was definitely on the to-do list but I'm not sure when I would get around to coding it. As the tool is open-source, I'd be more than happy if someone wanted to add it :)
2012-07-08Nisha
 Hi
Can you pls clarify somthing. I ran JPEG snoop and I have been given 2 different dates and times... the first time and date is in EXIF IFD0 section, and the second time is in the EXIF Subifd section, can you please clarify what this means.

Thanks
 There are several ways that dates and times can be encoded into a JPEG (JFIF) file. There are also date/time values captured by Windows when files are created, updated and/or copied. It would be hard to say with any certainty what may have caused the different dates you see in the IFD0 and SubIFD sections, but note that many programs can update these dates (especially if an edit is made or you are trying to adjust time zones). Also, it is trivial for someone to modify these dates manually (eg. in Windows explorer you can open up File Properties, click on the Details tab and then adjust the Origin-Date taken field).
2012-04-06hasmukh
 Dear Sir,
We require jpeg decoder for windows based application. Actually we require this decoder for video security system software.

we require decoder function that will take Raw jpeg buffer and its size and it will give output buffer in YUV420 format, and its height , width, Y Stride and UV Stride.
if you provide this type of decoder for windows then send us a quotation of it as well demo sample.

waiting for your reply...
2012-03-29Stephen Mcgahan
 Hi there i am writing this comment in the hope that you can clarify something for me, i have had 2 parking tickets one day after each other however i wasnt there the day after so i know that the photos i recieved have been altered some how but i am not able to figure out how to prove this i have ran the software and get results that make me optismitic but i would really appreciate your help on clarifying the results, i understand you will be busy but any help would be great thanks
2012-03-18Frédéric Kayser
 Hello,
I think I've found a bug in JPEGsnoop, I've produced a JFIF file that has 3 different quantization tables (each component Y', Cb, Cr has its own).

*** Marker: SOF0 (Baseline DCT) (xFFC0) ***
OFFSET: 0x000000E3
Frame header length = 17
Precision = 8
Number of Lines = 216
Samples per Line = 256
Image Size = 256 x 216
Raw Image Orientation = Landscape
Number of Img components = 3
Component[1]: ID=0x01, Samp Fac=0x11 (Subsamp 1 x 1), Quant Tbl Sel=0x00 (Lum: Y)
Component[2]: ID=0x02, Samp Fac=0x11 (Subsamp 1 x 1), Quant Tbl Sel=0x01 (Chrom: Cb)
Component[3]: ID=0x03, Samp Fac=0x11 (Subsamp 1 x 1), Quant Tbl Sel=0x02 (Chrom: Cr)

The problem lies in the fact that apparently JPEGsnoop does not use the right quantization table when decoding the Cr component since the resulting picture has practically no resulting red when displayed in RGB (Cr when displayed alone is near medium gray), other decoders display the expected picture.

It can be retrieved here:
http://cryopng.free.fr/sam.jpg

Best regards
 Hi Frederic -- you're right! Thank you very much for providing a great testcase. I have fixed this issue (and several others) in release 1.6.0.
2012-03-13Jack Binds
 I have a question. Can the this software figure out if an image has been manipulated, if the image was originally a Tff file that has been saved as a PDF file along with text?
Thanks
2012-03-09Pete Prossen
 Have you ever considered adding support for MxPEG files? The world really needs a utility to work with these.

If you aren't familiar with MxPEG files, they are a high quality compression scheme for motion JPEG recorded by Mobotix surveillance cameras. A single MxPEG file contains multiple JFIF records, each followed with incremental information for subsequent recorded image frames. The manufacturer provides good documentation and a SDK. They also provide an Active Show codec, but no useful tools to work with the files.

Please let me know if you might be interested.

Pete
2012-02-29Bill
 Hi Calvin,
Great software. I was wondering if you can tell me if JpegSnoop has the ability to determine if the EXIF data has been changed? Ie. if someone changes the dates using an exif editor will that be revealed in the jpegsnoop output. I ran a photo and it said that the "following IJG-based editors also match this signature:" then listed about 8 programs such as GIMP, IrfanView etc. Some of the programs can alter EXIF. The final assessment indicated that the Image was process/edited. Seeing as how the only program that shows up in the EXIF is Microsoft Windows Photo Gallery does this mean that it was processed or edited by that program or one of the 8 editors listed in the jpegsnoop. Microsoft Windows Photo Gallery does not allow for changing of certain EXIF fields such as date and times.
Thanks.
 Hi Bill -- JPEGsnoop is not able to determine if the EXIF info has been changed. The reason for this is that there is very little in the typical JPEG file that provides any redundancy that we can use to see if anything has changed (for example, there is no "checksum"). If you see MS Windows Photo Gallery showing up in the EXIF info, then it is very likely that this program was indeed used at some point to alter the file (in some way, but note that could include rotating, resizing, etc.). The fact that MS Windows Photo Gallery shows up in the EXIF is a reasonably good indication that it was used (and not one of the other matching editors listed with the same signature), although it is possible for people to modify the EXIF "software" tags to change it to anything one pleases (though most people wouldn't naturally do this). If MS Windows Photo Gallery doesn't allow one to change specific fields such as date and times, please note that there are countless other programs that will allow such edits and without leaving behind any other indications (ie. they will leave the EXIF software field intact, etc.)
2012-02-17Joe
 Hi, this is a cool program, but I was toying with it a bit. I work for a ghost tour company, and as such have seen very interesting pictures first hand when they were taken. I was sent a pic and wanted to see if it was, or wasn't real. I noticed that with pictures that I shot myself, I'd get different classes (my cell phone pictures was class 2, whereas my camera photos were class 4, perfectly explainable). The part I don't get however, is when I insert a picture that I witnessed firsthand, to see how the program responds to it, I get a class one. Question is... what is processed defined as? I've looked to no avail. Does it mean the act of downloading it onto your computer, and sending it over the internet in a jpeg file or another format?
 Hi Joe -- In general terms, processed is defined as being "not direct from digicam encoder". So, once an image has been copied from the camera's memory card, it often gets re-encoded when it is rotated, edited, cropped, resized, converted to another format or uploaded to websites. Note that there are cases where real digicams produce compression signatures or EXIF metadata characteristics that imply a processed image when in fact they are not, so it is not foolproof (a more careful examination may be required to validate that the tool wasn't tripped up by a false-positive through one of these characteristics). FYI, Class 1 is generally triggered by one of the following: Photoshop markers, lack of EXIF make/model info, comment field set to known software editors, RAW converter traces, etc.
2012-02-15Irtiza Kaleem
 Can it also tell if the image has been cropped? How may that be confirmed?
 While you can't directly tell that an image has been cropped, one way that may give you some indication is by comparing the resolution to the identified camera's standard resolution. By examining the EXIF metadata, you may be able to determine what mode the camera was in and derive the expected resolution. Of course, it is quite possible to crop and then resize to fill the original dimensions, but this could potentially be detected with advanced image analysis techniques.
2012-01-17Ron
 Hi,

Jpegsnoop is great for certain applications. I am on the LA Superior Court Panel of Experts. Currently I am involved in the Defense of a man facing 27 years to life. The prosecution used Jpegsnoop to validate authenticity of an image. Do you have any comment on this?

Thanks,
Ron
 Hi Ron -- JPEGsnoop cannot be used (on its own) to prove authenticity of an image. The program output specifically states that an image may only exhibit a "high probability of being original" since it is known that there are conceivable scenarios in which an altered image may still produce a "signature match". I have described a few of the issues surrounding the proof of an image's originality in the page Identifying Edited Photos. Please feel free to contact me for further details.
2012-01-09Shitansh Sinha
 Great software. :)
2011-12-26ronnie
 this program is a big help but i used the forward image search and ran in to a few warning and errors i was wondering if theres anyway to get around any of the errors or warnings in jpeg snoop and if so if you could make a tutorial with some pro tips in them about how to get around them or something like that and thank you for the program its very useful
 Hi Ronnie -- unfortunately, image corruption is such a challenging issue to deal with that there is never a set single way to fix them. Apart from the "Header Replacement" method I mentioned elsewhere, unfortunately there is no easy list of steps or tips to fix an image.
2011-12-06Someone
 Hi Calvin,

I have been thinking that I can translate your version of JPEGsnoop 1.5.2 to Spanish. If you are agree with my idea, please send me your approval and I will start to it.
 Fantastic... that would be great! Please feel free to send me an email so that we can coordinate.
2011-11-25Simon
 Hi,

thanks for your great piece of software, it helped me a lot to understand how JPEG (de)compression works!

Minor comment: In the "Expanded Form of Codes" section you annotate the "00" code as EOB for both DC and AC which confused me at first, because strictly speaking "00" is not an EOB code when decoding a DC coefficient (it means that the DC coefficient is the same as the last one from the same component but does not necessarily imply that the 63 following AC coefficients are all 0).

Kind regards, Simon
 Thanks for pointing this out. I will remove the EOB annotation for the DC component.

 


Leave a comment or suggestion for this page:

(Never Shown - Optional)
 

NOTE: Image repair requests are not accepted. Thanks for your understanding.