Return to Digital Photography Articles

JPEGsnoop 1.8.0 - JPEG File Decoding Utility

by Calvin Hass © 2017

JPEGsnoop is a free Windows application that examines and decodes the inner details of JPEG, MotionJPEG AVI and Photoshop files. It can also be used to analyze the source of an image to test its authenticity.

JPEGsnoop Program Icon


Latest Version: 1.8.0


Every digital photo contains a wealth of hidden information -- JPEGsnoop was written to expose these details to those who are curious.

Not only can one determine the various settings that were used in the digital camera in taking the photo (EXIF metadata, IPTC), but one can also extract information that indicates the quality and nature of the JPEG image compression used by the camera in saving the file. Each digical cameras specifies a compression quality levels, many of them wildly different, leading to the fact that some cameras produce far better JPEG images than others.

What can I do?

Check out a few of the many possible uses for JPEGsnoop!

One of the latest features in JPEGsnoop is an internal database that compares an image against a large number of compression signatures. JPEGsnoop reports what digital camera or software was likely used to generate the image. This is extremely useful in determining whether or not a photo has been edited / tampered in any way. If the compression signature matches Photoshop, then you can be pretty sure that the photo is no longer an original! This type of analysis is sometimes referred to as Digital Image Ballistics / Forensics.

JPEGsnoop reports a huge amount of information, including: quantization table matrix (chrominance and luminance), chroma subsampling, estimates JPEG Quality setting, JPEG resolution settings, Huffman tables, EXIF metadata, Makernotes, RGB histograms, etc. Most of the JPEG JFIF markers are reported. In addition, you can enable a full huffman VLC decode, which will help those who are learning about JPEG compression and those who are writing a JPEG decoder.

JPEGsnoop can now also parse and decode Photoshop files!

Other potential uses: determine quality setting used in Photoshop Save As or Save for Web settings, increasing your scanner quality, locating recoverable images / videos, decoding AVI files, examining .THM files, JPEG EXIF thumbnails, extract embedded images in Adobe PDF documents, etc.

Trying to Undelete or Unformat your Photos?

If you're interested in trying to recover your deleted / corrupted photos, check out my new page on recovering deleted photos.

File Types Supported

JPEGsnoop will open and attempt to decode any file that contains an embedded JPEG image, such as:

  • .JPG - JPEG Still Photo
  • .THM - Thumbnail for RAW Photo / Movie Files
  • .AVI* - AVI Movies
  • .DNG - Digital Negative RAW Photo
  • .PSD - Adobe Photoshop files
  • .CRW, .CR2, .NEF, .ORF, .PEF - RAW Photo
  • .MOV* - QuickTime Movies, QTVR (Virtual Reality / 360 Panoramic)
  • .PDF - Adobe PDF Documents

* Note that video file formats (such as .AVI and .MOV) are containers, which can include video streams encoded in one of a wide variety of codecs. JPEGsnoop can only interpret this video footage if the codec used is based on Motion JPEG (MJPG).

Download the Latest Version of JPEGsnoop!

Click to Download .ZIP
Version: 1.8.0
Version History

Released: 06/26/2017
Downloads: 569580

JPEGsnoop by Calvin Hass

Help Support JPEGsnoop Development

If you have found JPEGsnoop useful and would like to support its continued development, consider making a small contribution. Donations will help encourage me to add new and interesting features. Found an interesting use for the tool? Let me know!

Source Code: JPEGsnoop is now Open Source on GitHub!

System Requirements

This application has been designed and tested to run on Windows XP / Vista / 8 / 10. As of version v1.7, Windows XP SP1 is a minimum requirement. JPEGsnoop is fully portable, so it does not require any installation!

LINUX users: JPEGsnoop apparently works on LINUX under wine

Mac users: JPEGsnoop works within CrossOver Mac

Terms of Use

JPEGsnoop is free for personal and commerial use. Commercial users are encouraged to leave me a brief private message so that I can understand your needs and make future versions more useful.


No installation required. JPEGsnoop is very portable. Simply unzip the download and run!

Version History

For information about features added in previous versions of JPEGsnoop, please check out the version history page.

Feature Requests / Bug Reports

Please feel free to add your own feature requests or bug reports by submitting to the links on the JPEGsnoop Source page

Awards and Recognition for JPEGsnoop

  • Magazine - Chip Pick - June 2017 Magazine - Program of the Month - April 2009
  • CNET Download - Outstanding Editor's Rating - August 2011
  • PC Magazine - Utility Guide 2009 - July 2009
  • Win Magazine - May 2009
  • Computer Bild Magazine - Issue 10/2009

Main Window
Channel Histograms
MCU Grid & Positioning


Please see the options page for information on how to use JPEGsnoop and other interesting uses for the tool

Recent Features

  • Photoshop PSD decoding
  • Batch file processing
  • XMP APP1 & ICC Header display
  • IPTC and Photoshop IRB / 8BIM parsing
  • GPS EXIF metadata display
  • Full detailed Huffman VLC decoding output for those interested in writing a decoder or learning JPEG compression
  • Automatic display of YCC DC block values (16-bit)
  • MCU Grid overlay and automatic display of mouse MCU position and file offset in image display window.
  • Test overlay function enhanced to allow quick apply and binary code readout.
  • Image zoom level from 12.5% - 800%.
  • Extract embedded JPEGs -- can be used to extract thumbnails, hidden JPEG files, as well as frames from Motion JPEG AVI files.
  • Compression detection enhanced to detect rotated signatures, comment field.
  • Full AVI file parsing (to identify MotionJPEG)
  • DQT table searches in Executables (for "hackers")
  • Detect edited images or identify original digital camera that took a photo!
  • Integrated database of thousands of compression signatures (image fingerprint) for digital cameras and editing software
  • File overlay test function
  • Multi-channel preview: RGB, YCC, R/G/B, Y/Cb/Cr
  • Pixel position lookup into file offset
  • Examine Motion JPEG .AVI or .MOV (Quicktime) files (MJPG or MJPEG) and play through!
  • Examine any file fragments that may contain a JPEG image
  • YCC to RGB Color correction / clipping statistics reports
  • Command-line execution
  • Huffman variable-length code statistics
  • Expansion of DHT (Huffman Table Expansion into bitstrings)
  • Determine IJG JPEG Quality factor

Background Material

If you want to understand some of the technical details reported by JPEGsnoop, I suggest that you read through my articles on JPEG compression:


As this is a work in progress, I would be very interested in hearing from you, particularly for feature requests, suggestions, comments, bug reports, etc. If you currently use JPEGsnoop and find it useful, let me know!


Reader's Comments:

Please leave your comments or suggestions below!
2019-07-10Chris Chong

I have transferred from JPG files from IPhone to PC. it cant be opened on my PC, seems like these files are corrupted. Can JPEGsnoop resolve this issue?

Thank you

Is there an option to feed the tool a file + pixel coordinates and get the MCU + byte address from the commend line?


Great tool!
I would have only one quick question:
What happens to the pictures that are being uploaded for verification? Are these being stored anywhere or shared with a third party?

Many thanks in advance!
 Hi Mark -- glad it has been useful!

Bottom line: no images are ever saved or stored anywhere!

When you run JPEGsnoop to analyze a photo, nothing is ever stored, transmitted or shared. If you select "Add Camera/SW to DB" then only the dimensions, software fields and compression characteristics are saved into the database (basically what is presented in the dialog box). These fields are stored locally on your computer, or optionally sent to the ImpulseAdventure database (if enabled) to support inclusion in a future JPEGsnoop signatures database. As the source code is posted on GitHub, anyone can verify that no image is ever sent or saved anywhere. Hope that helps!
2018-12-29zhicheng yi
 as I know, the tool is good at analyzing the image from DC, how to deal with the ones from all kinds of phone? will you have the solution to solove the analyse from the phone? thanks your attention in advance.
 Hi -- Thanks!

While JPEGsnoop was originally intended to analyze photos from digital cameras, it can of course also be used on photos from phones as well. I think you must be referring to the “signature” detection that is reported at the end of the analysis report. If so, then that database of cameras will not always be updated with the latest cameras and phones (I plan to make this community-driven in the future). You can analyze the images from your phone and save these signatures into your local database so that you can then compare against them later with other files.
 I tried to look MCU decoding and found a error in log on RSTm markers. Your program tries to decode it as DC coefficient. I think it's just in log view.

Will snoop able to figure out and point if any data is changed in an image. For e.g. a scanned image is sent to a bank having details of customer account and some numbers has been modified. Will snoop able to point out pixel changes and distort of character alignments etc. Your suggestions will be of immense help.

Thanks in advance.
 Dear Calvin,

Thanks a lot for putting up this website and your tool!

I'm struggling however to understand how to use it to fix corrupted jpgs like this one:

I've tried to export all JPEGs but it just ends up re-exporting the same corrupted files - am I missing something?

I've had many photos getting corrupted on my hard drive... If I can understand how to repair one, I hope I can repair at least a few :)

All the best,
 Dear Calvin,

thanks for JPEGSnoop. I am struggling with a particular problem.

We have a defective JPEG encoder, sited in an inaccessible position (we literally cannot go there). Yet, we have to use its images.
The encoder's bug is that, occasionally, it does not perform its zerostuffing after 0xFF correctly, omitting the zero and dropping the next payload byte.

So, when the pre-stuffing stream is FF VW XY, the correct output of the zerostuffer should be FF 00 VW XY, but the actual output is FF XY.

A naive repair attempt replaces every FF XY with FF 00 00 XY. This sort of works, but shifts the image luminance from the fault spot on.

JPEGSnoop's previewer, however, succeeds in displaying the bad file correctly. I have trawled through the source code, yet I cannot discern how exactly it manages this. Could you please explain, with an example?

Sample files here (simulated):

This would mean a lot to me.

Kind regards,

 Thanks for reaching out to me on this... please check your email for my recommendations.
 Seems that JPEGsnoop can add only 1 custom signature into local DB... When I try to add more, it didn't write into local DB file
 Hi. I'm not sure I have encountered that issue before. I will send you an email so we can examine your configuration and figure out what might be happening. Thanks.

first of all, u r doing a great job, thanks. now my question:

i'm building a win 10 FE based on the neweset Win 10 ver 1803. when starting jpegsnoop 1.8.0 i get an error "Error setting up splitter frames!" i know from other programs that mostly there is a missing dll or something like that (other programs told me which dll is missing, mostly some vcruntime stuff or similar), can u tell me on which dll's jpegsnoop depends?
 Hi - thanks for pointing this out... I will see if I can reproduce it in my local testing and post a followup. If you can post a followup comment with your email included (it won't be displayed/published), I can send you an email to help resolve it for you directly.
 great app thanks
Please feature to open and exract ithmb files
 Thanks for the suggestion -- I'll take a look at the format and see what may be involved. For followup discussion, I may file a Feature Request on the JPEGsnoop GitHub issues page.
 KISS principle FTW!

I had a couple of JPEG files which got corrupted (unreplacable family pictures of course). First I tried the famous "Stellar Phoenix Stellar Repair" which ran for over ten hours to accomplish almost nothing, but then someone recommended JPEGsnoop on StackExchange. A batch file scan and a couple of minutes later I had readable JPEGs with (presumably) all of their metadata.

I have no idea what they did, but it was no simple file scan. Sorry Stellar Phoneix, your money goes somewhere else ;)
 Thanks for the update, Erik -- very glad to hear that JPEGsnoop managed to recover your files!
 hi Calvin,
if you want to know how to extract jpeg from Canon CR3, please follow this link:

Kind regards
 Thank you Laurent!
 I have two images and I am trying to determine when they were taken. Do you by chance have any undocumented / unpublished method of retrieving this? I would be willing to give you some $$

Just trying to diffuse some legal drama for one of my clients.
 Unfortunately, there is rarely any additional time-based information within a file other than the metadata that JPEGsnoop is able to extract. Keep in mind that time-based metadata can be subject to modification with the right tools (I say this because you mention legal interest). It is also possible that extracted time/date metadata could be incorrect due to the camera's owner not having set it correctly within the camera in the first place (the daylight savings / timezone settings are often wrong if the camera is not "web-enabled").

For certain newer cameras, an integrated GPS may also record a date/time value. If present, it is likely to be more reliable than other fields: the GPSTimeStamp. If you see this in the JPEGsnoop output, there is a reasonable chance that the time is accurate since it is derived from satellite references. Note, however that the timestamp refers to the positioning fix, so it could be lagging depending on the conditions.
2017-08-18CYBER DAVID
 i love the software the way it works.

if i may ask, i ve a jpeg document which some important part of the paper is been covered with another small paper before scanning, how do i remove the paper covered in the important part. please i need response, thanks.
 Calvin, is JPEGsnoop meant for the computer illiterate?
 Hi Bonnie - the tool is an advanced image analysis program so unfortunately much of the output won't make a lot of sense to everyone :) . That said, most people will still be able to recognize certain details from their photos such as the camera model, the GPS coordinates and a number of the camera settings.
 Since I couldn't find anything about portability in the change log (I haven't yet tested the latest version) I would like to suggest (for the last time) a portable mode, for example- start parameter JPEGsnoop.exe --portable which forces JPEGsnoop to save settings not in registry but in program folder.

 Thanks for the recommendation -- this is a good idea. I am thinking that I might provide two means of signaling JPEGsnoop to run in a true portable mode: a command-line option or the existence of a Settings subfolder. I would like to see if I can include this functionality in the next release. thx.
 I have noticed that many images that have been processed by various software programs register with the TREO 680 cam and a blackberry cam, are these indicators of an unknown software program? Also I have noticed saving an image through a program such as photoscape will result in 4 camera matches, including those made by CASIO. I am assuming CASIO also makes software that may share signatures to certain camereas?
 It is quite possible that the Palm and Blackberry image encoders happen to use the same JPEG encoding settings as found in common software encoders (such as those based on the IJG library). Since the IJG compression library is open source (and that itself is based on a "suggested" compression table in the published standard) it is not surprising to see the same values used by other implementations.
 Hello Calvin!

Thank you for this terrific software! It was helpful in many ways. I have a question for you, hopefully you will have an answer! With my French partners we are in the process of developing a soft that, amongst many other things, will use the YCbCrSubSampling as written in the metadata for authentication purposes. I have thoroughly dissected metadata with an EXIFTool script and a .csv output file for my hundreds of thousands image samples and didn't manage to find discrepancies in the YCbCr Subsampling process for a given camera. In other words, it appears that there's only one possible chroma subsampling for one camera model. Is that right according to you and your experience? Thank you for your reply
 Hi Tonio!

It is not too surprising that you have found the subsampling factor to be consistent across your database of digicam images. We know that cameras tend to provide multiple quality settings, but these often just impact the quantization table that is selected (in some cases the quantization table is defined as a function of some quality factor for cameras with variable quantization). Changing the subsampling factor is a more involved process for the encoder (the encoder hardware may have optimized the compression to favor a specific factor).

However, it is not guaranteed that the subsampling factor is the same for all images from a digicam. It is up to the camera's encoder whether subsampling is used, so it is conceivable that for very low or very high quality settings a camera may choose to change from 4:4:2 (2x1) to 4:4:4 (1x1). I have noted this behavior in Adobe Photoshop's software JPEG encoder, for example. Note that I have not gone through my database of images to see if I have observed discrepancies in the subsampling ratio for a given digicam model.

In summary, a change in subsampling ratio can probably indicate a high probability of non-authentication, but may not be authoritative.
 We have a DAT file from a DVR. DVR puts mjpeg fıles into a single DAT file. I tried to export jpegs but failed. Is it possible to help me?
 Hi -- I don't have a DVR DAT file to test with, but it is quite likely that the DAT file format is actually a container for either MPEG2 or MPEG4 video, not MJPEG. Can you confirm that it is indeed MJPEG? JPEGsnoop can extract most MJPEG frames, but not MPEG2/4.
 Thanks for the great software! Got it while on a trip to Australia because my Nikon D70 started showing errors on its compact flash card. I transferred all of the files to my computer over a USB interface and a number (about 30) are unreadable. Your software indicates the same error in all, a problem:Destination ID = 1 Class = 8 (AC Table) ERROR: Invalid DHT Class (8). Aborting DHT Load. I used a Hex editor to fix that table (changed an 81 to a 11) and your software indicates the table is then OK but the image decoding fails. The odd thing is that all of the bad images fail the same way, the EXIF data is OK in all cases. Rather than random errors the problem seems systematic. Any thoughts? Sadly I had to reformat the card to continue to take pictures and since then the camera has been generating valid files.
FYI I do lots of coding for fun (C# in Visual Studio) on home automation projects and develop lasers for a living, if you have any questions on those subjects.
Peter Moulton
 Hi Peter -- sorry to hear that your travel images were corrupted. It is not common to see the exact same failure mode across multiple images. Just a guess, but I wonder if perhaps the corruption occurred at the same offset in each file (eg. 8KB which is a file cluster boundary for 8GB cards, for example). If the memory card had various clusters corrupted or mis-mapped in the directory and each photo shared much of the same header, it is possible that the files could exhibit the same error (eg. DHT table error).

If you did want to explore this further, perhaps you could send me an example of two failed images and one valid image so that I could take a look.

Thanks for the offer on sharing some of your expertise -- much appreciated! :)
 THANKS A LOT! I don't have a way to donate but plz feel free to contact me at [email hidden]. thanks again. It worked perfectly with corrupted .NEF files from a Nikon d3200
 Great Cesar! Glad to hear that JPEGsnoop has been helpful :)
 In the position marker data, what are the block values?
 I think you are referring to the "Position Marked" when you click on a portion of the decoded image. The line you see is reporting the MCU and Block coordinates in the image (the image is divided into 8x8 pixel blocks and usually 16x8 pixel MCUs). It also shows you the DC component (the "average" brightness and color) for the MCU. A more handy way to get at this information is to look at the bottom-right corner of the JPEGsnoop window while you move your mouse over the image. Let me know if you have any other questions!
 Hi, Calvin
May be you know free program for extracting information about HSV parameters from JPEG images?

Thank you
 Hi Sergey -- I believe you can use the free GIMP graphics utility to decompose an image into the HSV channels.
 It would be really nice to have in batch mode an option to summarize corrupted files.

Thank you for your great software!
 This is a good suggestion, Mike... next time I open up the codebase I'll see if it's feasible to include a count or list of the files with decode errors.
 Hello Calvin.
Thank you so much for your hard work on your program!
I have a 4GmicroSD that is at full capacity that became corrupted. I ran it through a recovery program and was able to retrieve some of my childs infant photos, which were unfortunately corrupted (i thought all was lost). But low and behold because I found your wonderful program JSnoop I was able to extract thumbnails from over 80 corrupted jpg's!! --Thank you soo much!!

I have a question to ask you if I may...
When running my sdCard through the recovery program only about 1/4 of the pictures on the card were recovered. When I check the memory card details it is still at full capacity with no free space. So my question would be: Where did the rest of the photos go & how might I retrieve them uncorrupted?
Your insight is greatly appreciated.
 Hi Nonie -- it seems likely that the memory card's directory has become corrupted. Most important -- do not attempt to use this memory card for anything other than recovery! The reason I say this is that there is still a reasonable chance of recovering more photos.

JPEGsnoop will attempt to locate the embedded thumbnails from the files that it can see on the drive; it's great to hear that the thumbnail extraction was useful.

As for why the card appears full but without any files on it, this is because the directory (called FAT32) has been corrupted. The photos have been fragmented across the card (like cutting a picture into a jigsaw puzzle). The directory is like an answer key for the puzzle as it tells the computer where to find all of the pieces for each photo on the drive. With a bad directory, the computer can't locate the images but knows that it doesn't have room for any more puzzle pieces.

There is still a reasonable chance that you can find an advanced recovery program that will locate more of your photos (uncorrupted). Search for a recovery program that supports "file fragmentation". Good luck!
2016-09-27Lawrence Oyaniyi

My name is Lawrence Oyaniyi, a Master student from the Federal University of Technology, Akure, Nigeria. My area of research is photo forensic, I greatly appreciate your software JPEGsnoop.

I wish to request for your assistance in developing a similar software for my thesis.

Thank you

 Hi Lawrence -- Sure, I can try to give you some ideas to get started... just send me an email. Thx, Cal.
 Hi Calvin,
The ZTE Axom Elite phone has the feature of choosing focus and depth of field after the shot is done. Apparently this is based on distance information obtained from the dual camera. This distance information (basically a 3D map) is apparently packed into the jpg file. Do you have any information how this is done and can JPEGsnoop reveal 3D maps from those files? It would be cool to have this 3D map and then play around with the picture in another way than done by ZTE's phone software.
 Interesting... I tried searching for some original images from the ZTE Axon Elite to analyze, but I'm not sure if the samples I saw had the additional metadata enabled. I wasn't able to locate any obvious depth metadata other than a sizeable MakerNote field (which I don't have information for decoding). It seems that there are a number of ways in which manufacturers are encoding depth info: embedding a second low-res image, a PNG-like depth map, dual pixel RAW, separate XMP files on the memory card, etc. In the cases where a second image is embedded, the depth map generation is presumably left to post-processing, which would be beyond the scope of JPEGsnoop :)
 Very fascinating Q&A! After reading all of the posts and your willingness to provide your knowledge to help with solutions for most dilemma's, I've confirmed what the concensus has suggested. That being, you're humility in which you choose to conduct yourself is only outweighed by the intelligence you possess in the field(s) in which you've chosen to apply your abilities. Some may read that and think that I have displayed a profound technique of nose browning. Although there may be some truth behind that assumption, the personal buttering of compliments, to be honest, may have been my attempt for a respectful coercion of some of that forementioned intellect. Despite my intent, it shouldn't diminish the validity of anything that was stated.

Moving right along.......

I first heard your name in the comment section of an article from a site that I won't give a plug, but its name has direct correlation to a 15 min. car insurance mascot and it's preferred mealtime appeFLYser. Basically, the gentleman, who's name escapes me at the moment but he created the Foto Forensics program. He was very politely correcting the writer of his errors/omissions in the article and threw in a touch of copyright education as well. He mentioned you and how genuinely personable you are in his comments which has led me here. This is such a long winded, random jumbled pile of thoughts turned to words for my question, so my apologies.

My question is a simple one but i was hoping if you had the time, you could give a more detailed answser than would seem to warrant such. I have no experience, knowledge of or basically any real understanding on any aspect of your expertise. Reading the q&a, I was actually awakened to how ignorant I was, regarding, being so unaware of how much technical data goes into this field. Allllllll that said, I have a stronger desire than I can express, to hopefully get to a comparable intellectual level as yourself in understanding the workings of your trade. So my question to you is, Where should I start? Books to read, classes to take, people to follow (in a non creepy way), programs to be helpful or any input at all would be amazing and sincerely appreciated. I may not be the best looking gal in the brothel (metaphorically speaking in regards to intelligence and gender) but you'd be hard pressed to find another, who's willing to take on the workload to satisfy the proverbial client, which is my brain.
 Thanks Erik for the kind words! I'm a firm believer in learning by taking things apart and trying to figure out how they work :) ... though this is not necessarily a good or expedient way to learn! I'm not sure which domain specifically you are interested in, so perhaps you can send me a private message and I'll try to point you towards some references that might be useful. Good luck!
2016-07-22Michael B
 Hi! I am learning so much from your Site. I am wondering if you'd like to see a batch action I have created (with help from Exif Tag Remover programmer (uses ExifTool)). It catches corrupts, wipes Exif data (if selected), is multi-threaded, sorts large, small and non-jpeg, coverts TO jpg, sorts gif-single-frame and gif-multi-frame, retitles extensions (reads headers) correctly, sizes down the oversized (selectable weight/ dimensions), and leaves you a log (not the brown type).
 Sure, that would be great to share it. Thanks!
 Is it possible to use this software to remove all meta related data from images and or pdf's?
 Hi Ian - no, this tool doesn't attempt to modify/strip the metadata from images. For that, I recommend you use exiftool for that. You can run the following command to remove all metadata from a JPEG file called "input.jpg":

exiftool -all= input.jpg
 Ok.. I figured out this one again. I really should try harder before I post here next time :)

So at least in libjpeg (not sure if it's the intention of ITU T.81's standard, but we knew libjpeg is the de facto standard in implementation), the LSBs are extracted from the original integer, not the binaries after DC magnitude coding.

For example, the 1st number is -272. It's "original" integer should be 0xfffffef0, or ‭11111111111111111111111011110000‬ (keep in mind it's two's component), NOT 011101111. So we can clearly see the last bit is 0, not 1.

If we right shift it by 1 bit (‭1111111111111111111111101111000, or -136) and then apply DC magnitude coding, it will still become 0111 0111, so both way work for *first* scan (I think it can be proved mathematically). But you can see here, for the 2nd scan, there is difference (0 vs. 1).

Essentially, if the original value is odd, LSB in scan 2 should be 1 and if it's even, LSB in scan 2 should be 0.

And it's actually based on absolute number of DC value instead of the difference, which can be observed from libjpeg's code. It can be easily tested too if you create multiple (more than 1) LSB scans. In my example, the Cr-DC of MCU2 is +74, or 135 in abs. since MCU1's is 61). In "original" binary integer they are 0x0000004A (0...0 0100 1010) and 0x00000087 ‭(0...0 1000 0111)‬ respectively. I created 4 scans.

The dump of scan #2-4 are

3f (0011 1111)
0f (0000 1111)
27 (0010 0111)

So we can see here for 6th column it's 111, not 010.
 Great info, Benjamin! Thanks very much for sharing your analysis!
 Hi Calvin,

Sorry to bother you again.

Recently I am playing with successive scan decoding, but it doesn't work as what I expect.

I created a file with following scan file
(The test files I was using can be downloaded from )

0,1,2: 0-0, 0, 1 ;
0,1,2: 0-0, 1, 0;
0: 1-63, 0, 0 ;
1: 1-63, 0, 0 ;
2: 1-63, 0, 0 ;

Which means I just leave the last bit of all DCs for 2nd scan.

6 DC coefficients are (extracted from a baseline equivalent):
MCU1 (Y-DC/Cb-DC/Cr-DC):
-272 (011101111) / -16 (01111) / 61 (111101)
MCU2 (Y-DC/Cb-DC/Cr-DC):
76 (1001100) / -26 (00101) / 74 (1001010)

So I got the dump from the 1st scan, which is
9d cf 79 30 b4 bf (1001 1101 1100 1111 0111 1001 0011 0000 1011 0100 1011 1111)
With the help of two DHT:


Expanded Form of Codes:
Codes of length 01 bits:
0 = 06 (Total Len = 7)
Codes of length 02 bits:
10 = 08 (Total Len = 10)


Expanded Form of Codes:
Codes of length 01 bits:
0 = 04 (Total Len = 5)
Codes of length 02 bits:
10 = 05 (Total Len = 7)
Codes of length 03 bits:
110 = 06 (Total Len = 9)

it can be easily decoded as
01110111, 0111, 11110, 100110, 0010, 100101
Which are exactly the bits of these 6 DC values excluding the LSB (least significant bit).

BUT thing are getting weird in the 2nd scan.

The dump of 2nd scan is just one byte, 27 (0010 0111).

According to ITU T.81 G.1.2.1 and a quick look of function "encode_mcu_DC_refine" in libjpeg (I am no developer so don't quote me on this), I am pretty sure it's supposed to just sent the last bit(s) consecutively, without any modification (which means no category header, no Huffman encoding) but here you can see, the bits' number is right (6) but the values don't look right..

What we are missing should be 1,1,1,0,1,0; but here it's 001001 (+ two filling ones).

Did I miss something here?
 It's me again.

Just want to let you know, shortly after I sent the last message, I decided to investigate progressive JPEG by myself because I realize the potential of JPEGSnoop even it doesn't support decoding of progressive JPEG yet. It turns out, the data in each scan is arranged ordered by MCU 1st, then by array index (zigzag): just like sequential JPEG, but just with only selected range of lndex.

Below is my way to test, would also like to share here.

I created an simple B&W image which was 16x8 (2 MCUs) with striped patterns. Firstly I created a baseline JPEG to easily get the DCT matrix from JPEGsnoop.

For 1st MCU, only 5 coefficients are left: (after quantization) DC=-1, AC1=-46 AC6=-36, .. etc.

For 2nd MCU, similar but slightly different coefficients are left: DC=0, AC2=-37, AC9=-36, .. etc.

Then, I built a custom scan table which will do spectral selection on 0, 1-6 and 7-63 and I created another JPEG file from the same source BMP file with same q (thus same quantization tables) via `cjpeg -q 80 -sample 1x1 -scans scan.txt test.bmp > test_p.jpg` in libjpeg-turbo.

I got the dump of 2nd scan from JPEGSnoop, which is
51 cd cd 1f (0101 0001 1100 1101 1100 1101 0001 1111)

and DHT:

  Expanded Form of Codes:
    Codes of length 02 bits:
      00 = 00 (EOB)                      (Total Len =  2)
      01 = 06                            (Total Len =  8)
      10 = 16                            (Total Len =  8)
    Codes of length 03 bits:
      110 = 46                           (Total Len =  9)

Now we can manually decode the Huffman encodings:

0106 (0 run + 6 bits)
11046(4 runs + 6 bits)
1016(1 run + 6 bits)
00 EOB
11111 filling 1s

So, we can clearly see here, the order is MCU1's AC1->MCU1's AC6->MCU2's AC2, i.e. ordered by MCU firstly, then inside MCU, still same zigzag.

I didn't test Successive approximation yet, but I am pretty sure that should be the same: it will always put coefficients from the same MCU together first in every scan, no matter how many coefficients left (in this case, only 6) in that scan.

Which also means, what Wikipedia claims is wrong ( , read from "This encoding mode is called baseline sequential encoding" paragraph).. unless he is using 64 scans for each coefficients, which is impossible.
 Fantastic!! This is excellent work in determining the scan ordering. I did take a quick look through ITU-T.81 and the definition of the sequencing wasn't particularly clear to me. Your results are quite definitive, though! I examined libjpeg briefly to see what was done there. In decode_mcu_AC_first() within jdhuff.c, it looks like the HUFF_DECODE is called on the spectral selection coefficients of a given MCU's scan consecutively.
 Hi Calvin,

I cannot find a more better topic to leave this message, so please forgive me if it's not appropriate.

I knew progressive JPEG is not your focus currently, but there is one small question about JPEG compression that has been bothered me for a long time and I think you may knew the answer considering you're an expert in this field. I looked into every single web source I can find, including JPEG standard by ITU, all of them are vague about this part.

When we're encoding the AC DCT coefficients in a sequential JPEG, it would be encoded in MCU by MCU order and in each MCU, they're arranged in zig-zag order (1 to 63), that is very clear from what I learnt in your brilliant article

We know progressive JPEG would separate different coefficients in different scans (I am talking about Spectral selection. Let's omit Successive approximation at the moment). Let's say there are 3 scans, 0 (DC), 1-5, 6-63 (and let's also omitting 3 components and interleaving thing). My question is, when encoding AC parts, for example, the 2nd scan for AC1-AC5, will the coefficient be ordered in MCU first or in index first?

If MCU 1st: A1 A2 A3 A4 A5 B1 B2 B3...
If Index 1st: A1 B1 A2 B2 A3 B3...

It matters because we can see here it will definitely affect the efficiency of RLE encoding.

Multiple sources *imply* it's index first, but I have not yet find a definite answer about that.

 Hello, this is the software user, I want to know whether you consider release version of the ios software?
 Hi -- sorry, the software is only written for Windows at the moment. However, the source code has been posted, so it is possible that someone may be able to port it if desired.
 As a follow-up to Reziac's comment, I'm able to run version 1.75 without any issues on Windows XP x64. Many thanks for the program as well as the detailed JPEG documentation on the site!
 Glad to hear it!
2015-12-12Asen Anastassov
 Hello there,

Your JPEGsnoop is a very useful tool. I would like to ask- would it be possible that you release a portable version of your program which doesn't write to registry and saves all its data and settings inside its program folder?

Best regards,

 Thanks for the suggestion, Asen... yes, I think it would be a good idea to make it truly portable. It is "almost portable" right now, but moving some of the settings to a separate file in the executable directory would be good. I'd prefer not to have to manage a separate executable, so I'll take a look at what my options are and keep this feature request on the list. Thanks!
 Thanks. v1.61 does run on XP64, so you may be right about Visual Studio -- tho it seems really strange that the newer version compiles something that barfs on 64bit!

It's crashed a couple times (that's unusual) but I'm glad to have it even halfway working on the "new" machine!

If you need future versions tested on XP64, let me know. I can break anything! :)
 Ok -- so that should help me narrow it down if I get around to tackling this one :) Thanks Reziac!
 I've been using the latest version to dump AVIs to JPGs. Works great.

Except that it refuses to run at all on my WinXP64 machine! no matter how I set program compatibility, Windows whines "JPEGsnoop is not a valid Win32 application." I thought it was 64-bit compatible??
 Sorry that there seem to be troubles your execution on WinXP 64bit. I'm not sure what might be triggering that error message -- I have tested v1.7.5 successfully with Windows XP Home 32-bit, but haven't had access to XP 64-bit to test with. I suspect it might be an issue with Visual Studio 2012. If so, you might find that v1.6.1 works better on WinXP64 (as that was the last version I compiled with VS 2010).
 Is there also any version for OSX ?
Thanks, Carsten
 Hi Carsten --
At this time I don't have a version of JPEGsnoop targeted to other OSes. However, the latest version of the source (v1.7.5) has been rewritten so that it should be much easier for someone to port the core of it to LINUX or other OS. I have heard in the past that CrossOver Mac enabled JPEGsnoop to run under Mac.

If anyone is interested in porting JPEGsnoop to LINUX or other OS, please let me know and I'll try to help in any way I can.
Good news about new functions, I will try it now !

Can we have updated source on sourceforge ? And can you contact me for a commercial use, please ?

Thanks, a lot !
Best regards
 Contact info sent
2015-11-26dot tilde dot
 what license do you distribute your beautiful software under?

 Hi there -- I had originally released the software under the GPL license, but if you have questions about your use-case, let me know. Thanks!
 Hi Calvin, I'm on windows 10 and I can't see the image preview - only the text portion. Is there a way to turn image preview on, or is it something else?

 You can enable / disable the image preview with the following setting:
Options -> Scan Segment -> Decode Image
Then select File -> Reprocess File
 Thanks so much for your great tool and help!
 Great to hear it!
 Love this tool... I have used it many times for corrupt images and getting images from the .thumbdata3 file from android phones. Is it possible to use Jpegsnoop on larger files? I have a 12gb file full of thumbnails but looks as though I have hit the size limit.

ERROR: File too large for this version of JPEGsnoop. [Size=0x30002E5AF]

Double thanks for a great program!
 Glad to hear it has been useful!

Probably the easiest solution is to use a free file splitter utility (eg. ) to create smaller segments (eg. 2GB) and then feed those into JPEGsnoop in batch mode. JPEGsnoop only works on files up to 4GB.

Is there some way I can determine why most of my photos are being exported with a 1440x1080 resolution vs the 4608x3456 they should be? If we can get this fixed I would appreciate it and will increase my donation.

 What you have likely extracted is a large preview that was embedded within the original file. The original image (4608x3456) may have been corrupted and not directly recoverable. So, regrettably, you might not be able to extract a larger version of the image. That said, it is quite fortunate that you have access to such a large preview image!
2015-08-22John Anderson
 Hi Calvin,

Many thanks for a most useful analytical tool. I'm happy to make a donation to further development. How much do you suggest?

I have one question about JPEGsnoop. I tested the software with an image captured using a friend's Apple iPod. EXIF metadata confirms this. However, the compression signature is for a Konica Minolta camera.. Is it probable that both the iPod and the Minolta both use the same compression algorithm?

Look forward to hearing from you.
 Thanks for the kind feedback, John! Any help is always appreciated :) But I am also more than happy just hearing that the tool has been helpful for others.

What you have noted with the compression signature is exactly as you figured... for the particular image content and camera settings, both used the same compression table.

It is quite common to see a given table appear in multiple camera manufacturers... it could be that they reuse the same hardware image encoder or use the same library / reference tables. The notion of the compression signature being a "fingerprint" is a bit of a misnomer in that regard since there is considerable reuse.

If you don't see the Apple iPod in the list of matching signatures, then it would be best to add it (the result would be that you'll see both cameras listed as possible matches).

Hope that helps,
I have few photos which are corrupted and cannot be previewed.
the corrupted photos are almost with the same size like the good ones but i cant open the or see the preview.
i have trided to decode or fix with some software but i was not able to.
can you please explain how can i try to cut the header from a good photo and paste it on the other or help me with other solution?
thank you !


Leave a comment or suggestion for this page:

(Never Shown - Optional)

NOTE: Image repair requests are not accepted. Thanks for your understanding.