Return to Digital Photography Articles

JPEGsnoop 1.7.5 - JPEG File Decoding Utility

by Calvin Hass © 2015

JPEGsnoop is a free Windows application that examines and decodes the inner details of JPEG, MotionJPEG AVI and Photoshop files. It can also be used to analyze the source of an image to test its authenticity.

JPEGsnoop Program Icon


Latest Version: 1.7.5


Every digital photo contains a wealth of hidden information -- JPEGsnoop was written to expose these details to those who are curious.

Not only can one determine the various settings that were used in the digital camera in taking the photo (EXIF metadata, IPTC), but one can also extract information that indicates the quality and nature of the JPEG image compression used by the camera in saving the file. Each digical cameras specifies a compression quality levels, many of them wildly different, leading to the fact that some cameras produce far better JPEG images than others.

What can I do?

Check out a few of the many possible uses for JPEGsnoop!

One of the latest features in JPEGsnoop is an internal database that compares an image against a large number of compression signatures. JPEGsnoop reports what digital camera or software was likely used to generate the image. This is extremely useful in determining whether or not a photo has been edited / tampered in any way. If the compression signature matches Photoshop, then you can be pretty sure that the photo is no longer an original! This type of analysis is sometimes referred to as Digital Image Ballistics / Forensics.

JPEGsnoop reports a huge amount of information, including: quantization table matrix (chrominance and luminance), chroma subsampling, estimates JPEG Quality setting, JPEG resolution settings, Huffman tables, EXIF metadata, Makernotes, RGB histograms, etc. Most of the JPEG JFIF markers are reported. In addition, you can enable a full huffman VLC decode, which will help those who are learning about JPEG compression and those who are writing a JPEG decoder.

JPEGsnoop can now also parse and decode Photoshop files!

Other potential uses: determine quality setting used in Photoshop Save As or Save for Web settings, increasing your scanner quality, locating recoverable images / videos, decoding AVI files, examining .THM files, JPEG EXIF thumbnails, extract embedded images in Adobe PDF documents, etc.

Trying to Undelete or Unformat your Photos?

If you're interested in trying to recover your deleted / corrupted photos, check out my new page on recovering deleted photos.

File Types Supported

JPEGsnoop will open and attempt to decode any file that contains an embedded JPEG image, such as:

  • .JPG - JPEG Still Photo
  • .THM - Thumbnail for RAW Photo / Movie Files
  • .AVI* - AVI Movies
  • .DNG - Digital Negative RAW Photo
  • .PSD - Adobe Photoshop files
  • .CRW, .CR2, .NEF, .ORF, .PEF - RAW Photo
  • .MOV* - QuickTime Movies, QTVR (Virtual Reality / 360 Panoramic)
  • .PDF - Adobe PDF Documents

* Note that video file formats (such as .AVI and .MOV) are containers, which can include video streams encoded in one of a wide variety of codecs. JPEGsnoop can only interpret this video footage if the codec used is based on Motion JPEG (MJPG).

Download the Latest Version of JPEGsnoop!

Click to Download .ZIP
Version: 1.7.5
Version History

Released: 11/29/2015
Downloads: 458423

JPEGsnoop by Calvin Hass

Help Support JPEGsnoop Development

If you have found JPEGsnoop useful and would like to support its continued development, consider making a small contribution. Donations will help encourage me to add new and interesting features. Found an interesting use for the tool? Let me know!

Source Code: JPEGsnoop is now Open Source!

System Requirements

This application has been designed and tested to run on Windows XP, Windows Vista and Windows 7. As of version v1.7, Windows XP SP1 is a minimum requirement. JPEGsnoop is fully portable, so it does not require any installation!

LINUX users: JPEGsnoop apparently works on LINUX under wine

Mac users: JPEGsnoop works within CrossOver Mac

Terms of Use

JPEGsnoop is free for personal and commerial use. Commercial users are encouraged to leave me a brief private message so that I can understand your needs and make future versions more useful.


No installation required. JPEGsnoop is very portable. Simply unzip the download and run!

Version History

For information about features added in previous versions of JPEGsnoop, please check out the version history page.

Feature Requests / Bug Reports

Please feel free to add your own feature requests or bug reports by submitting to the links on the JPEGsnoop Source page

Awards and Recognition for JPEGsnoop

  • PC Magazine - Utility Guide 2009 - July 2009
  • Win Magazine - May 2009
  • Magazine - Program of the Month - April 2009 Magaine - Chip Pick - November 2012
  • Computer Bild Magazine - Issue 10/2009

Main Window
Channel Histograms
MCU Grid & Positioning


Please see the options page for information on how to use JPEGsnoop and other interesting uses for the tool

Recent Features

  • Photoshop PSD decoding
  • Batch file processing
  • XMP APP1 & ICC Header display
  • IPTC and Photoshop IRB / 8BIM parsing
  • GPS EXIF metadata display
  • Full detailed Huffman VLC decoding output for those interested in writing a decoder or learning JPEG compression
  • Automatic display of YCC DC block values (16-bit)
  • MCU Grid overlay and automatic display of mouse MCU position and file offset in image display window.
  • Test overlay function enhanced to allow quick apply and binary code readout.
  • Image zoom level from 12.5% - 800%.
  • Extract embedded JPEGs -- can be used to extract thumbnails, hidden JPEG files, as well as frames from Motion JPEG AVI files.
  • Compression detection enhanced to detect rotated signatures, comment field.
  • Full AVI file parsing (to identify MotionJPEG)
  • DQT table searches in Executables (for "hackers")
  • Detect edited images or identify original digital camera that took a photo!
  • Integrated database of thousands of compression signatures (image fingerprint) for digital cameras and editing software
  • File overlay test function
  • Multi-channel preview: RGB, YCC, R/G/B, Y/Cb/Cr
  • Pixel position lookup into file offset
  • Examine Motion JPEG .AVI or .MOV (Quicktime) files (MJPG or MJPEG) and play through!
  • Examine any file fragments that may contain a JPEG image
  • YCC to RGB Color correction / clipping statistics reports
  • Command-line execution
  • Huffman variable-length code statistics
  • Expansion of DHT (Huffman Table Expansion into bitstrings)
  • Determine IJG JPEG Quality factor

Background Material

If you want to understand some of the technical details reported by JPEGsnoop, I suggest that you read through my articles on JPEG compression:


As this is a work in progress, I would be very interested in hearing from you, particularly for feature requests, suggestions, comments, bug reports, etc. If you currently use JPEGsnoop and find it useful, let me know!


Reader's Comments:

Please leave your comments or suggestions below!
 Hello Calvin.
Thank you so much for your hard work on your program!
I have a 4GmicroSD that is at full capacity that became corrupted. I ran it through a recovery program and was able to retrieve some of my childs infant photos, which were unfortunately corrupted (i thought all was lost). But low and behold because I found your wonderful program JSnoop I was able to extract thumbnails from over 80 corrupted jpg's!! --Thank you soo much!!

I have a question to ask you if I may...
When running my sdCard through the recovery program only about 1/4 of the pictures on the card were recovered. When I check the memory card details it is still at full capacity with no free space. So my question would be: Where did the rest of the photos go & how might I retrieve them uncorrupted?
Your insight is greatly appreciated.
 Hi Nonie -- it seems likely that the memory card's directory has become corrupted. Most important -- do not attempt to use this memory card for anything other than recovery! The reason I say this is that there is still a reasonable chance of recovering more photos.

JPEGsnoop will attempt to locate the embedded thumbnails from the files that it can see on the drive; it's great to hear that the thumbnail extraction was useful.

As for why the card appears full but without any files on it, this is because the directory (called FAT32) has been corrupted. The photos have been fragmented across the card (like cutting a picture into a jigsaw puzzle). The directory is like an answer key for the puzzle as it tells the computer where to find all of the pieces for each photo on the drive. With a bad directory, the computer can't locate the images but knows that it doesn't have room for any more puzzle pieces.

There is still a reasonable chance that you can find an advanced recovery program that will locate more of your photos (uncorrupted). Search for a recovery program that supports "file fragmentation". Good luck!
2016-09-27Lawrence Oyaniyi

My name is Lawrence Oyaniyi, a Master student from the Federal University of Technology, Akure, Nigeria. My area of research is photo forensic, I greatly appreciate your software JPEGsnoop.

I wish to request for your assistance in developing a similar software for my thesis.

Thank you

 Hi Lawrence -- Sure, I can try to give you some ideas to get started... just send me an email. Thx, Cal.
 Hi Calvin,
The ZTE Axom Elite phone has the feature of choosing focus and depth of field after the shot is done. Apparently this is based on distance information obtained from the dual camera. This distance information (basically a 3D map) is apparently packed into the jpg file. Do you have any information how this is done and can JPEGsnoop reveal 3D maps from those files? It would be cool to have this 3D map and then play around with the picture in another way than done by ZTE's phone software.
 Interesting... I tried searching for some original images from the ZTE Axon Elite to analyze, but I'm not sure if the samples I saw had the additional metadata enabled. I wasn't able to locate any obvious depth metadata other than a sizeable MakerNote field (which I don't have information for decoding). It seems that there are a number of ways in which manufacturers are encoding depth info: embedding a second low-res image, a PNG-like depth map, dual pixel RAW, separate XMP files on the memory card, etc. In the cases where a second image is embedded, the depth map generation is presumably left to post-processing, which would be beyond the scope of JPEGsnoop :)
 Very fascinating Q&A! After reading all of the posts and your willingness to provide your knowledge to help with solutions for most dilemma's, I've confirmed what the concensus has suggested. That being, you're humility in which you choose to conduct yourself is only outweighed by the intelligence you possess in the field(s) in which you've chosen to apply your abilities. Some may read that and think that I have displayed a profound technique of nose browning. Although there may be some truth behind that assumption, the personal buttering of compliments, to be honest, may have been my attempt for a respectful coercion of some of that forementioned intellect. Despite my intent, it shouldn't diminish the validity of anything that was stated.

Moving right along.......

I first heard your name in the comment section of an article from a site that I won't give a plug, but its name has direct correlation to a 15 min. car insurance mascot and it's preferred mealtime appeFLYser. Basically, the gentleman, who's name escapes me at the moment but he created the Foto Forensics program. He was very politely correcting the writer of his errors/omissions in the article and threw in a touch of copyright education as well. He mentioned you and how genuinely personable you are in his comments which has led me here. This is such a long winded, random jumbled pile of thoughts turned to words for my question, so my apologies.

My question is a simple one but i was hoping if you had the time, you could give a more detailed answser than would seem to warrant such. I have no experience, knowledge of or basically any real understanding on any aspect of your expertise. Reading the q&a, I was actually awakened to how ignorant I was, regarding, being so unaware of how much technical data goes into this field. Allllllll that said, I have a stronger desire than I can express, to hopefully get to a comparable intellectual level as yourself in understanding the workings of your trade. So my question to you is, Where should I start? Books to read, classes to take, people to follow (in a non creepy way), programs to be helpful or any input at all would be amazing and sincerely appreciated. I may not be the best looking gal in the brothel (metaphorically speaking in regards to intelligence and gender) but you'd be hard pressed to find another, who's willing to take on the workload to satisfy the proverbial client, which is my brain.
 Thanks Erik for the kind words! I'm a firm believer in learning by taking things apart and trying to figure out how they work :) ... though this is not necessarily a good or expedient way to learn! I'm not sure which domain specifically you are interested in, so perhaps you can send me a private message and I'll try to point you towards some references that might be useful. Good luck!
2016-07-22Michael B
 Hi! I am learning so much from your Site. I am wondering if you'd like to see a batch action I have created (with help from Exif Tag Remover programmer (uses ExifTool)). It catches corrupts, wipes Exif data (if selected), is multi-threaded, sorts large, small and non-jpeg, coverts TO jpg, sorts gif-single-frame and gif-multi-frame, retitles extensions (reads headers) correctly, sizes down the oversized (selectable weight/ dimensions), and leaves you a log (not the brown type).
 Sure, that would be great to share it. Thanks!
 Is it possible to use this software to remove all meta related data from images and or pdf's?
 Hi Ian - no, this tool doesn't attempt to modify/strip the metadata from images. For that, I recommend you use exiftool for that. You can run the following command to remove all metadata from a JPEG file called "input.jpg":

exiftool -all= input.jpg
 Ok.. I figured out this one again. I really should try harder before I post here next time :)

So at least in libjpeg (not sure if it's the intention of ITU T.81's standard, but we knew libjpeg is the de facto standard in implementation), the LSBs are extracted from the original integer, not the binaries after DC magnitude coding.

For example, the 1st number is -272. It's "original" integer should be 0xfffffef0, or ‭11111111111111111111111011110000‬ (keep in mind it's two's component), NOT 011101111. So we can clearly see the last bit is 0, not 1.

If we right shift it by 1 bit (‭1111111111111111111111101111000, or -136) and then apply DC magnitude coding, it will still become 0111 0111, so both way work for *first* scan (I think it can be proved mathematically). But you can see here, for the 2nd scan, there is difference (0 vs. 1).

Essentially, if the original value is odd, LSB in scan 2 should be 1 and if it's even, LSB in scan 2 should be 0.

And it's actually based on absolute number of DC value instead of the difference, which can be observed from libjpeg's code. It can be easily tested too if you create multiple (more than 1) LSB scans. In my example, the Cr-DC of MCU2 is +74, or 135 in abs. since MCU1's is 61). In "original" binary integer they are 0x0000004A (0...0 0100 1010) and 0x00000087 ‭(0...0 1000 0111)‬ respectively. I created 4 scans.

The dump of scan #2-4 are

3f (0011 1111)
0f (0000 1111)
27 (0010 0111)

So we can see here for 6th column it's 111, not 010.
 Great info, Benjamin! Thanks very much for sharing your analysis!
 Hi Calvin,

Sorry to bother you again.

Recently I am playing with successive scan decoding, but it doesn't work as what I expect.

I created a file with following scan file
(The test files I was using can be downloaded from )

0,1,2: 0-0, 0, 1 ;
0,1,2: 0-0, 1, 0;
0: 1-63, 0, 0 ;
1: 1-63, 0, 0 ;
2: 1-63, 0, 0 ;

Which means I just leave the last bit of all DCs for 2nd scan.

6 DC coefficients are (extracted from a baseline equivalent):
MCU1 (Y-DC/Cb-DC/Cr-DC):
-272 (011101111) / -16 (01111) / 61 (111101)
MCU2 (Y-DC/Cb-DC/Cr-DC):
76 (1001100) / -26 (00101) / 74 (1001010)

So I got the dump from the 1st scan, which is
9d cf 79 30 b4 bf (1001 1101 1100 1111 0111 1001 0011 0000 1011 0100 1011 1111)
With the help of two DHT:


Expanded Form of Codes:
Codes of length 01 bits:
0 = 06 (Total Len = 7)
Codes of length 02 bits:
10 = 08 (Total Len = 10)


Expanded Form of Codes:
Codes of length 01 bits:
0 = 04 (Total Len = 5)
Codes of length 02 bits:
10 = 05 (Total Len = 7)
Codes of length 03 bits:
110 = 06 (Total Len = 9)

it can be easily decoded as
01110111, 0111, 11110, 100110, 0010, 100101
Which are exactly the bits of these 6 DC values excluding the LSB (least significant bit).

BUT thing are getting weird in the 2nd scan.

The dump of 2nd scan is just one byte, 27 (0010 0111).

According to ITU T.81 G.1.2.1 and a quick look of function "encode_mcu_DC_refine" in libjpeg (I am no developer so don't quote me on this), I am pretty sure it's supposed to just sent the last bit(s) consecutively, without any modification (which means no category header, no Huffman encoding) but here you can see, the bits' number is right (6) but the values don't look right..

What we are missing should be 1,1,1,0,1,0; but here it's 001001 (+ two filling ones).

Did I miss something here?
 It's me again.

Just want to let you know, shortly after I sent the last message, I decided to investigate progressive JPEG by myself because I realize the potential of JPEGSnoop even it doesn't support decoding of progressive JPEG yet. It turns out, the data in each scan is arranged ordered by MCU 1st, then by array index (zigzag): just like sequential JPEG, but just with only selected range of lndex.

Below is my way to test, would also like to share here.

I created an simple B&W image which was 16x8 (2 MCUs) with striped patterns. Firstly I created a baseline JPEG to easily get the DCT matrix from JPEGsnoop.

For 1st MCU, only 5 coefficients are left: (after quantization) DC=-1, AC1=-46 AC6=-36, .. etc.

For 2nd MCU, similar but slightly different coefficients are left: DC=0, AC2=-37, AC9=-36, .. etc.

Then, I built a custom scan table which will do spectral selection on 0, 1-6 and 7-63 and I created another JPEG file from the same source BMP file with same q (thus same quantization tables) via `cjpeg -q 80 -sample 1x1 -scans scan.txt test.bmp > test_p.jpg` in libjpeg-turbo.

I got the dump of 2nd scan from JPEGSnoop, which is
51 cd cd 1f (0101 0001 1100 1101 1100 1101 0001 1111)

and DHT:

  Expanded Form of Codes:
    Codes of length 02 bits:
      00 = 00 (EOB)                      (Total Len =  2)
      01 = 06                            (Total Len =  8)
      10 = 16                            (Total Len =  8)
    Codes of length 03 bits:
      110 = 46                           (Total Len =  9)

Now we can manually decode the Huffman encodings:

0106 (0 run + 6 bits)
11046(4 runs + 6 bits)
1016(1 run + 6 bits)
00 EOB
11111 filling 1s

So, we can clearly see here, the order is MCU1's AC1->MCU1's AC6->MCU2's AC2, i.e. ordered by MCU firstly, then inside MCU, still same zigzag.

I didn't test Successive approximation yet, but I am pretty sure that should be the same: it will always put coefficients from the same MCU together first in every scan, no matter how many coefficients left (in this case, only 6) in that scan.

Which also means, what Wikipedia claims is wrong ( , read from "This encoding mode is called baseline sequential encoding" paragraph).. unless he is using 64 scans for each coefficients, which is impossible.
 Fantastic!! This is excellent work in determining the scan ordering. I did take a quick look through ITU-T.81 and the definition of the sequencing wasn't particularly clear to me. Your results are quite definitive, though! I examined libjpeg briefly to see what was done there. In decode_mcu_AC_first() within jdhuff.c, it looks like the HUFF_DECODE is called on the spectral selection coefficients of a given MCU's scan consecutively.
 Hi Calvin,

I cannot find a more better topic to leave this message, so please forgive me if it's not appropriate.

I knew progressive JPEG is not your focus currently, but there is one small question about JPEG compression that has been bothered me for a long time and I think you may knew the answer considering you're an expert in this field. I looked into every single web source I can find, including JPEG standard by ITU, all of them are vague about this part.

When we're encoding the AC DCT coefficients in a sequential JPEG, it would be encoded in MCU by MCU order and in each MCU, they're arranged in zig-zag order (1 to 63), that is very clear from what I learnt in your brilliant article

We know progressive JPEG would separate different coefficients in different scans (I am talking about Spectral selection. Let's omit Successive approximation at the moment). Let's say there are 3 scans, 0 (DC), 1-5, 6-63 (and let's also omitting 3 components and interleaving thing). My question is, when encoding AC parts, for example, the 2nd scan for AC1-AC5, will the coefficient be ordered in MCU first or in index first?

If MCU 1st: A1 A2 A3 A4 A5 B1 B2 B3...
If Index 1st: A1 B1 A2 B2 A3 B3...

It matters because we can see here it will definitely affect the efficiency of RLE encoding.

Multiple sources *imply* it's index first, but I have not yet find a definite answer about that.

 Hello, this is the software user, I want to know whether you consider release version of the ios software?
 Hi -- sorry, the software is only written for Windows at the moment. However, the source code has been posted, so it is possible that someone may be able to port it if desired.
 As a follow-up to Reziac's comment, I'm able to run version 1.75 without any issues on Windows XP x64. Many thanks for the program as well as the detailed JPEG documentation on the site!
 Glad to hear it!
2015-12-12Asen Anastassov
 Hello there,

Your JPEGsnoop is a very useful tool. I would like to ask- would it be possible that you release a portable version of your program which doesn't write to registry and saves all its data and settings inside its program folder?

Best regards,

 Thanks for the suggestion, Asen... yes, I think it would be a good idea to make it truly portable. It is "almost portable" right now, but moving some of the settings to a separate file in the executable directory would be good. I'd prefer not to have to manage a separate executable, so I'll take a look at what my options are and keep this feature request on the list. Thanks!
 Thanks. v1.61 does run on XP64, so you may be right about Visual Studio -- tho it seems really strange that the newer version compiles something that barfs on 64bit!

It's crashed a couple times (that's unusual) but I'm glad to have it even halfway working on the "new" machine!

If you need future versions tested on XP64, let me know. I can break anything! :)
 Ok -- so that should help me narrow it down if I get around to tackling this one :) Thanks Reziac!
 I've been using the latest version to dump AVIs to JPGs. Works great.

Except that it refuses to run at all on my WinXP64 machine! no matter how I set program compatibility, Windows whines "JPEGsnoop is not a valid Win32 application." I thought it was 64-bit compatible??
 Sorry that there seem to be troubles your execution on WinXP 64bit. I'm not sure what might be triggering that error message -- I have tested v1.7.5 successfully with Windows XP Home 32-bit, but haven't had access to XP 64-bit to test with. I suspect it might be an issue with Visual Studio 2012. If so, you might find that v1.6.1 works better on WinXP64 (as that was the last version I compiled with VS 2010).
 Is there also any version for OSX ?
Thanks, Carsten
 Hi Carsten --
At this time I don't have a version of JPEGsnoop targeted to other OSes. However, the latest version of the source (v1.7.5) has been rewritten so that it should be much easier for someone to port the core of it to LINUX or other OS. I have heard in the past that CrossOver Mac enabled JPEGsnoop to run under Mac.

If anyone is interested in porting JPEGsnoop to LINUX or other OS, please let me know and I'll try to help in any way I can.
Good news about new functions, I will try it now !

Can we have updated source on sourceforge ? And can you contact me for a commercial use, please ?

Thanks, a lot !
Best regards
 Contact info sent
2015-11-26dot tilde dot
 what license do you distribute your beautiful software under?

 Hi there -- I had originally released the software under the GPL license, but if you have questions about your use-case, let me know. Thanks!
 Hi Calvin, I'm on windows 10 and I can't see the image preview - only the text portion. Is there a way to turn image preview on, or is it something else?

 You can enable / disable the image preview with the following setting:
Options -> Scan Segment -> Decode Image
Then select File -> Reprocess File
 Thanks so much for your great tool and help!
 Great to hear it!
 Love this tool... I have used it many times for corrupt images and getting images from the .thumbdata3 file from android phones. Is it possible to use Jpegsnoop on larger files? I have a 12gb file full of thumbnails but looks as though I have hit the size limit.

ERROR: File too large for this version of JPEGsnoop. [Size=0x30002E5AF]

Double thanks for a great program!
 Glad to hear it has been useful!

Probably the easiest solution is to use a free file splitter utility (eg. ) to create smaller segments (eg. 2GB) and then feed those into JPEGsnoop in batch mode. JPEGsnoop only works on files up to 4GB.

Is there some way I can determine why most of my photos are being exported with a 1440x1080 resolution vs the 4608x3456 they should be? If we can get this fixed I would appreciate it and will increase my donation.

 What you have likely extracted is a large preview that was embedded within the original file. The original image (4608x3456) may have been corrupted and not directly recoverable. So, regrettably, you might not be able to extract a larger version of the image. That said, it is quite fortunate that you have access to such a large preview image!
2015-08-22John Anderson
 Hi Calvin,

Many thanks for a most useful analytical tool. I'm happy to make a donation to further development. How much do you suggest?

I have one question about JPEGsnoop. I tested the software with an image captured using a friend's Apple iPod. EXIF metadata confirms this. However, the compression signature is for a Konica Minolta camera.. Is it probable that both the iPod and the Minolta both use the same compression algorithm?

Look forward to hearing from you.
 Thanks for the kind feedback, John! Any help is always appreciated :) But I am also more than happy just hearing that the tool has been helpful for others.

What you have noted with the compression signature is exactly as you figured... for the particular image content and camera settings, both used the same compression table.

It is quite common to see a given table appear in multiple camera manufacturers... it could be that they reuse the same hardware image encoder or use the same library / reference tables. The notion of the compression signature being a "fingerprint" is a bit of a misnomer in that regard since there is considerable reuse.

If you don't see the Apple iPod in the list of matching signatures, then it would be best to add it (the result would be that you'll see both cameras listed as possible matches).

Hope that helps,
I have few photos which are corrupted and cannot be previewed.
the corrupted photos are almost with the same size like the good ones but i cant open the or see the preview.
i have trided to decode or fix with some software but i was not able to.
can you please explain how can i try to cut the header from a good photo and paste it on the other or help me with other solution?
thank you !

I'm trying to detect if a PDF has been photoshopped.
I have a base PDF to compare it to.

What parameters should I be looking at?
 Are you trying to determine if a PDF file has been modified? Or if an image within a PDF has been altered (ie. "photoshopped")?

In this particular situation, could you clarify what you meant by the "base PDF" -- is it another PDF that should be identical to the second PDF (but you didn't notice any differences?) Sorry if I misunderstood the question.

If the PDF file was edited according to "spec", then it may leave some traces of edits (in a ModDate or generation numbers in the objects), but this isn't guaranteed.

If you are wondering about whether an embedded JPEG within a PDF file has been altered (since originally captured), then you can use the image search function in JPEGsnoop to find the image and then process it as normally (ie. compare compression signatures, etc.).

i would test the version 1.7.4

add parameter to save the file when use
through cmd

also some pictures not ext_all through nogui only when i open it normally
 Hi there ebrahim! I have a given you a link to beta test version 1.7.5. It has a number of new features, in addition to a rewritten command-line interface that should operate better.

PNG files don't work with this tool right?
 Hi David -- at this time, JPEGsnoop doesn't analyze PNG files but I could potentially add such a feature if there were enough interest.
 I couldn't view on my PC an image saved with Photoshop CS6 Mac. With some hex-editing I could manually extract only 2 previews from this file (one in PNG, the other in JPG) but they were low-res. So I opened my image with JPEGSnooper, then I used "Tools -> Image search fwd", finally I did a "Tools -> Export JPEG -> Extract All JPEGs" and voilà, I had 3 images: one of them was the hi-res JPEG. THANK YOU!!!!!!!!!!!
 Excellent! Glad to hear it!
 I downloaded version 1.7.3 and appears during startup crash - Win XP SP3 CPU support SSE - I suspect that it is a CPU with SSE2 instructions - last acting in my version is 1.6.1
 Hi Peter -- Thanks for letting me know about it. I will followup via email to help resolve it if I can.
 Just came by to confirm URL so I can point someone here :)

I have a microscope-camera gadget called an "EyeClops" (I think it came from Toys R Us) that's not in your ID database -- do you want an image to check out?
 Hey thanks Rez! Sure, if you can email me a copy that would be great.
I am having a hard time understanding all the codes. If I sent you a photo would you be able to decipher? All I want to know is if the photo is an original? And possibly the region it was taken.
Thank you.

I am trying to use your program to recover some corrupted jpeg. Everytime I try to open the jpeg i get this error "The Parameter is in correct"

can you please help. Thank you
 Hi Mike -- if you can contact me again and provide your email address I could take a look at the file to determine what might be happening. Thanks!
 Thanks!! I used the search forward option and it finds the largest JPG now however it always stops part way through the process and only displays partial. I can get the full thumb and full smaller JPG (only 55 KB) but process always stops suddenly when I search forward to the hi res JPG. Any thoughts or setting suggestions?

A couple sample images I am trying to recover can be found on my dropbox link at

Great program! Just need to figure out how to get it to fully recover the hi-res versions.

Thanks in advance

Curious why when I export as JPEG it outputs a much smaller version of what the original image was. The original images are about 8MB in size while the output of snoop is only about 50 KB??

The reason for that is that most JPEG images (from a digicam) contain several versions of the same image. Generally you'll find a full-resolution image, a small thumbnail and sometimes a large thumbnail/preview. What you have encountered is probably a case where JPEGsnoop found the small thumbnail first (and extracted that). If you press "Search Forward" you might find that it could locate one of the larger images, thereby enabling you to extract that as well.
 Hi Chris --

Were the 3 files you posted from the output of a recovery program or were they direct from your hard drive / memory card? These files all exhibit a case of the file being a merge of multiple photos.

Long story short, the original images have been "spliced" causing only a small amount of data to be extracted. More advanced techniques are needed to get at the remainder of the data (dealing with fragmentation). But even then. you would not be able to fully recover the hi-res version -- your original images do not exist within these files.

More detail: JPEGsnoop's image decode only starts when it finds a proper header. When you perform "Search Forward", JPEGsnoop will seek the next valid JPEG header. In doing so, it is skipping over a very large amount of data that is in the file. This extra data is actually the remainder of another image data from your drive/card. It is possible to see this additional image data if one messes around with the headers.

Let's say that the original image was 8.6MB in size. In example "_SCN0336.JPG" we actually skip almost 7MB before we find the start of a valid image. That only leaves us with 1.6MB of image data before we get cut off. If we try to extract the image, we are only left with a small fraction of the original file. The extra 7MB is coming from a completely different hi-res file that happened to be on the card/drive.
 Curious why when I export as JPEG it outputs a much smaller version of what the original image was. The original images are about 8MB in size while the output of snoop is only about 50 KB??
 The reason for that is that most JPEG images (from a digicam) contain several versions of the same image. Generally you'll find a full-resolution image, a small thumbnail and sometimes a large thumbnail/preview. What you have encountered is probably a case where JPEGsnoop found the small thumbnail first (and extracted that). If you press "Search Forward" you might find that it could locate one of the larger images, thereby enabling you to extract that as well.
 Please see as the 'list of cameras detected by the software? If I go to Tools / Manage local DB the list is empty.
The DB is C:\Users\alfredo\AppData\Roaming\JPEGsnoop\JPEGsnoop_db.dat dimension 1 KByte.
 The list of cameras detected does not appear in the "user / local database". It is internal to the tool. What appears in the local DB are only the signatures that the user has captured.
 I have an SD card with some RAW images (.CR2) and JPEG's that show the correct size but won't open (invalid image). Hex editor shows all zeros in these files. JPEGsnoop says "File did not start with JPEG marker" and [Tools->Img Search Fwd] did not find anything.

Is there ANY way to recover these files?
 Unfortunately, if the file content (as viewed in a hex editor) shows all zeros then there is no way to recover the image from the file itself. The best bet is to attempt a recovery from the source media (eg. hard drive or memory card) with a more sophisticated recovery program that is able to look beyond the "logical directory structure".
 Greetings. I need to determine if the date/time value in the exif metadata of an iPhone picture has Ben modified. I understand that it's a simple value to change, eg importing pics into iPhoto then gives user option to adjust the date/time a picture was captured. I'd like to be able to tell if this field has been edited before file dissemination. Is this something your program is capable of?
Thank you in advance.
 Generally, one cannot determine that an EXIF field has been edited since there is no redundancy or checksums to confirm that the current field content (such as date/time) matches what it was at the time the image was first created. However, some cameras (and phones such as iPhone) store date/time info in several places within the JPEG image metadata. Some software programs may alter one or more fields but not all. Therefore, if you examine all date/time related fields within the metadata, there is a chance that you may find one that maintains its original setting.

For example, in an iPhone 5 JPEG image, one often finds date/time info in the following sections reported by JPEGsnoop:

  • EXIF IFD0: DateTime
  • EXIF SubIFD: DateTimeOriginal
  • EXIF SubIFD: DateTimeDigitized
  • APP1 XMP: MicrosoftPhoto:DateAcquired

In addition, some recent iPhones (typically iOS 7 or later) include Apple MakerNotes fields that (after decoding) may show further date/time info. The advantage of checking MakerNotes is that it is often harder for software to alter these fields -- instead they tend to remove them all if anything is modified. As a result, if you find a date/time in the MakerNote field, there is a reasonable chance that it is reflective of the actual date/time of capture.
 hello .. i have few images that we modified, changed and resized from the original and then emailed to me .. Is there a way i can convert these manipulated images back to the original using your software or any other method .. so far no success .. is it possible .. will appreciate your help ..
thanks ..
 Sorry, but it is highly unlikely that you could retrieve an original version of an image once it has been edited/resaved. In most cases the new file only contains the new version of the image.
 Hi There. Thanks for your reply. I have managed to get the program to export jpeg's. I had to use the EOI boxes otherwise It said ERROR. But when I click the repaired jpes's I am still getting "drawing failed" Do you have any idea what to do now??
 When you export an image, there is no guarantee that the resulting image will be valid (or readable with Windows). In many cases the file will still be corrupted. For some digital cameras, there is a second embedded (large) thumbnail which may also be worth extracting. Press Ctrl+2 for "Image Search Forward" and then try the export again.
 Hi There.
I might be stupid but I am having a problem with this program.
I click on file, It says, Open Image. which I click on. I go to my damaged pictures and click on one. I can then see a small thumbnail of the picture (no bigger than a stamp) Then open tools and click on Export jpeg. Send to my desktop. But then on my desktop there is no picture?? I have tried sending the pics to various locations with the same results. I have also tried different pictures all with the same result.
Please tell me where I am going wrong or what I am doing wrong.
Many Thanks.
 Once you click on Tools->Export JPEG... and press OK, you should see the log window say *** Exporting JPEG ***.

Below that, it should give you the full path to your file after Exporting to:. Do you see this path? Copying this full path into a windows explorer window, it should find and load the image for you.

I just wanna ask if you know a software that can restore cropped photos
Into its original form that has been put into collage?
What I mean is, knowing and extracting and getting it to its original form.
I have sent a collage pics to a friend, all pics used were all cropped
and to my surprised she identified the people I'm with from that cropped
image in the collage. She said she restored it using the embedded details
in every picture.
I'm wondering how she do that.

Help pls.

Please find posters about the Canon Raw (CR2) file format

Laurent Clévy
 Excellent! Thank you very much Laurent for this wonderfully detailed summary. I will take a look to see how much work it might be to introduce additional decoding for JPEGsnoop.
I wonder if jpeg-snoop is able to detect which jpeg image is corrupted. I have got about 10.000 jpegs and I cannot see each of them with my eyes... I'd like to have a list of what damaged, if any. Is it possible?
 Hi Adler - With the current version of JPEGsnoop, it may be possible to use the Batch Process feature to work through the 10,000 files and generate the associated log files. You could then use a free utility to search for ERROR in the *.log files. In future versions of JPEGsnoop I may add a feature (if there's enough interest) that compiles a summary report of all the results of the Batch Processing task, which could be a good way to achieve what you're after.
 Tried to post this in SourceForge... but couldn't figure out how to submit a new bug report. The new version always seems to say "files larger than 2GB not supported in this version of JPEGsnoop" even if the files are smaller than 2GB. (Have one that's 1.85GB and gives that error).
 Thanks JL! Yes, you're right. Unfortunately I had missed testing the recent version with multi-GB files and see now that the file size threshold was set too low.

I have now extended JPEGsnoop v1.7.2 to support files up to 4GB in size! I am just completing testing and will release it shortly. Thanks for your patience.
 This is funny -- I'd just got done telling someone on a forum about JPEGsnoop, and literally 5 seconds later, here in my mailbox is your notice of an update. Good karma or what? :)
 Could you please update sourceforge project? It is stuck at v. 1.5.2
 Definitely! I have just completed significant rewrites of the source code (for v1.7.x) and have updated the repository now.
 Hi Calvin

The following image

gives following error with JPEGsnoop 1.7.0:

ERROR: SetDhtTables(comp=4, TblDC = 0 TblAC = 0) out of indexed range

It worked faultlessly with JPEGsnoop 1.6.1.

Thank you!
 Hi Guido!

Thanks for providing the example file. The handling of table indices with CMYK files has been fixed in version v1.7.1, along with many other corrections. Version v1.7.1 will be posted very shortly.
2014-09-09Crash with 444 image
 The following image crashed JPEGSnoop in the latest iteration.
 Thanks for the example file to test.
This issue has been fixed in JPEGsnoop version v1.7.1
 I have about 430 JPEG wedding images that looked fine when I took them with my Nikon and can be copied off the micro SD card - the file sizes even seem correct, but only the first few are viewable and have any extended data. The last good one seems to have a corruption (plain brown on the bottom half of the image) and all of them after that are not viewable. Using your program, it looks like it's missing the SOI and cannot even find the SOS marker - could it still be recoverable? When I used CardRecovery software it didn't find any of the corrupt images except that first one, and saved it as a 54Gb file - making me think that a bad sector killed the EOF data and all of the images are combined in there somehow.
 Sorry to hear about the corruption. If you are lucky, you might find that the recovery file does indeed contain a number of intact images. Typically recovery programs will generate these massive files if the file system directory gets damaged. Although many images may still be fully intact, others will be corrupted because of file system fragmentation.

I would recommend that you split the 54GB file into 1GB chunks (keep the original) and then use JPEGsnoop with the "Image Search Forward" command to see if any images can be extracted.

There are many free utilities that will split large files. A quick search of google for "windows utility split file free" shows a few.

Good luck!
2014-06-15Puji Winasti
 thank for your page,


Leave a comment or suggestion for this page:

(Never Shown - Optional)

NOTE: Image repair requests are not accepted. Thanks for your understanding.