Return to Digital Photography Articles

JPEGsnoop - Options

This page details some of the main options you'll find in JPEGsnoop

Return to JPEGsnoop Main Page


JPEGsnoop is very easy to use... quite simply:

Steps to Process a File

  • Select the decoding options under Options->
  • Open your JPEG file with File->Open...
  • Save the output with File->Save Log... if desired

Alternately, you can drag-and-drop a JPEG file onto the JPEGsnoop icon or main window and have the report automatically generated. Opening a JPEG file will automatically start the decoding process and generation of the log file.

Decoding Options

There are several options you can enable in decoding the JPEG file. These display additional information about the JPEG file. If the Auto Reprocess option in the Configuration window is disabled, then any changes to the Options below will not be reflected in the log until either a new file is opened, or you manually File->Reprocess.

  • Hide unknown EXIF tags - This option will turn off decoding of EXIF tags that are not currently known in JPEGsnoop's database.
  • DHT Expand - Expands the JFIF Huffman code table into the actual list of variable-length binary strings that are searched during the decoding process. This is a much more human-readable form of the huffman code list.
  • Scan Segment - Decode Image - This option turns on the real decoding of the Scan data segment. In doing so, several checks are performed to ensure that all the variable length codes are valid and that there is no data corruption. It also performs the color conversion step from YCC to RGB and reports any color channel clipping.
  • Scan Segment - Histogram RGB - If Decode Image is enabled, the Histogram RGB option will show a histogram for the RGB components, in addition to the reporting of any YCC/RGB clipping. Note that this option slows down the color conversion process (and is off by default).
  • Scan Segment - Histogram Y - If Decode Image and Histogram RGB options are enabled, the Histogram Y option will show a histogram depicting the luminance (Y) DC component of the image. In addition, a full 2048-bin histogram dump is written to the log file. This dump shows the number of MCUs (8x8 pixel blocks) that exist in the (DC) image for each intensity level (-1024 to +1023). Counts are written in hexadecimal notation.
  • Scan Segment - Full IDCT - When this option is enabled, the scan decode process does a full IDCT (Inverse Discrete Cosine Transform) to generate the high-resolution image view. Both the DC and AC coefficients of each MCU is computed. This mode is computation-intensive and can be slow.
  • Scan Segment - No IDCT - When this option is enabled, the scan decode process does not do IDCT, and can produces a low-resolution image view. Only the DC coefficients of each MCU is computed. This mode is much faster than the IDCT mode but the result is low-res and less accurate. Default mode of operation.
  • Scan Segment - Scan Dump - Enabling this option dumps out the first 640 bytes of scan data (in the Start of Scan (SOS) segment) in hexadecimal, after byte stuffing has been handled.
  • Scan Segment - Detailed Decode... - Use this option to dump out detailed info about the Huffman VLC (variable-length codes) that make up the Scan bitstream. This is extremely useful for those who are trying to understand JPEG compression at a low level or build their own encoder/decoder. A dialog box will ask you for a starting MCU coordinates and MCU length. Prior to entering the dialog box, you can mouse-over or click in the area of the image that you want to start decode, and take note of the MCU X & Y coords. Enter these values into the dialog and then hit Reprocess or Open a new file to see the results. The detailed decode is included in the Start of Scan segment in the log.

    Note: The DC component shown in each DCT matrix is the DC contribution from the current block -- it does not represent the running DC total (ie. the inverse DPCM step).
  • Maker Notes - Decode the Maker Note section (manufacturer-specific data) if it is a make supported by JPEGsnoop. As some cameras store a lot of unknown data in this section, you may want to disable it to avoid clutter.
  • Configuration - Opens a window where you can set a number of additional options. Please see the Configuration Window section below.
  • Check for Updates - This will manually check the website for newer releases of JPEGsnoop.

Note that the image and histograms are only displayed if Decode Scan Image is enabled.

Tools Menu

  • Image Search Fwd - Searches in the most recently opened file from the current file position forwards, looking for the next potential embedded JPEG image. This command is searching for the SOI (Start of Image 0xFFD8) marker, and may encounter the occasional false positive.
  • Image Search Rev - Same as SOI Search Fwd, but in the reverse direction.
  • Lookup MCU Offset... - Enter a pixel coordinate, press Recalc and determine the file offset to the start of the MCU! This is extremely useful for locating sections of a corrupt JPEG. Note that offsets are provided in the format: 0x<byte position in hex> : <bit position> . In other words 0x0000C832:4 means that the MCU starts at file position 0xC832 (or 51250) bytes, at the 4th bit (from the most significant bit). The MCU positioning is also displayed automatically in the lower image window's status bar when the mouse moves across the image window.
  • File Overlay... - NOTE: This function will be described in greater detail in a later release, but it can be used a number of different ways, including the ability to fix corrupt JPEG files. Enter a file position offset, click Load Original (to see the current value) and then have the ability to overwrite these values with new hex values (no spaces between bytes). Click on the Enabled checkbox to have this overlay used for further decodes, or uncheck it to disable it. Specify the number of bytes to overwrite (up to 8).

  • Search Executable for DQT - Allows advanced users to identify compression quality tables within an executable or library. For more imformation, please see the section in the Interesting Uses page.
  • Export JPEG - Attempts to export the JPEG image that has been decoded at the current file offset (e.g. after Image Search or File Offset). This can be used to extract JPEG thumbnail images, extract AVI MJPEG frames, etc. The user will be presented with a dialog that asks whether or not the default MJPEG DHT tables should be inserted (for AVI frame export) and whether or not any user-defined file overlays will be used to generate the output.
  • Add Camera / SW to DB... - Add the compression signature of the image to the database! This shared database is used to determine what digital camera (or photo software) was used to create the image. The database is growing and will be constantly updated by other JPEGsnoop users. Please only add a camera compression signature to the database if you are reasonably sure that the image is direct from the camera (i.e. not processed or edited in any way) or processed from a known software program. When submitting the compression signature, absolutely no image content or EXIF data is recorded -- only the compression statistics and quality setting.
  • Manage Local DB If you want to clear out the user database (for example, if you have added incorrectly-described signatures), or simply remove a single entry, this option will bring up a dialog box that lets you delete one or more entries.

Note that you can hold down the control-key shortcuts (Ctrl-2 or Ctrl-1), which will step through a file at high speed. For MotionJPEG AVI files, this will play the video while decoding the tables and histogram!

View Menu

  • Image Chan - Select the channel to display in the image area. You can select full-color RGB or YCC in addition to the individual sub-channels: R/G/B or Y/Cb/Cr.
  • Image Zoom - Selects the zoom level in displaying the DC component image. At 12.5%, each 8x8 pixel block is represented by a single pixel. At 800%, each image pixel is represented by an 8x8 pixel region.
  • Overlays - MCU Grid - Toggles the display of the MCU grid. The grid marks the MCU boundaries in the image, according to the current chroma subsampling levels. Pressing Ctrl-G will toggle the display of the grid. Note that the grid is automatically hidden when the zoom level is less than 100%.

File Menu

  • Offset... - Allows you to specify a starting offset for the JPEG decoding process. In the dialog, the default is for entry in hexadecimal notation, but you can click on the decimal radio button to convert.
  • Reprocess - Reloads the last file and reprocesses the image with the current set of configured options. Note that this is not necessary if the Auto Reprocess option under Configuration is enabled.
  • Print - Standard printing support for the main report window.

Command Line Invocation

As requested by some users, command-line execution is supported. You can enable most options from the command line and generate the unlimited output file automatically. Example:

JPEGsnoop.exe -i c:\temp\20050203_1234.jpg -o c:\temp\20050203_1234_snoop.txt -nogui

The above will open up the JPEG file located at c:\temp\20050203_1234.jpg, write out to the log file c:\temp\20050203_1234_snoop.txt and do this without bringing up the GUI (application window).

Other options include:

  • -i fname - Opens JPEG file named fname for processing.
  • -o fname - Opens text file named fname for the generated output log file.
  • -nogui - Performs the command-line actions without leaving open the application window. If you don't specify this option, the command line options are still performed, but the application window will be left open.
  • -scan - Enables Scan Parse mode.
  • -scandump - Enables Scan Dump mode.
  • -histo_y - Enables Luminance Histogram Dump mode.
  • -dhtexp - Enables DHT Expand mode.


Reader's Comments:

Please leave your comments or suggestions below!
2014-11-05Curt Henderson
 Awesome Work, but I have a specific need for this software that currently isn't available in command line. We have an application that we use and cannot control, that wraps jpg files with some invalid marker, or adds some information at the beginning of the file (not really sure how to describe that). This makes them not readable in windows (or probably any OS photo viewer for that matter). This program is one we are trying to get away from but currently rely upon heavily. It knows how to later show us the images in it's proprietary form, but we just want to be able to view the files and use them on our own.

Your program will get me there, but not without getting the "File did not start with JPEG marker" error every time, in which case I have to manually use the "IMG Search Forward" option every time. This gets me to a point where I can export the image needed, and that's great. However, I need to be able to do this full auto from the command line. When I try your command line options on my files, they all choke on the "not a jpg marker" thing.

I have explored the command line options, and they do not include the ability to "force" the "Img search forward" option (like it apparently does in the batch processing feature), or the ability to output a resulting JPG to a location (only the log file). I can't use the batch processing option in case you are wondering for multiple reasons, the main one being we have literally thousands of these images all randomly stuck together in folders with GUID type names and new ones come in all the time. We only need to access some of these photos some of the time, so I want to process them on an individual basis as need to view/print them arises with an automated process from the command line that we can then integrate into our own application processes using PHP and other scripts where we essentially just need to hand the command a file location, and then we are staring at its image.

I'm sure this is a tall order and I'm not sure you'll want to do anything about or whatever, but at the top you do ask for suggestions, so I thought I'd take a shot in the dark.
Thanks for your time.
 Hi Curt! Thanks very much for sharing your particular scenario and a suggestion for new command-line functionality. I will take a look at my current implementation to see how much work would be involved in adding such a mode. No promises, but if its relatively straightforward I may be able to add it. Thanks!

This is superb program and a livesaver for me! I have almost 2000 photo's which are somewhat corrupt. I want to use the "extract all JPEGs" within a batch processing but it seems that this command line is not supported. Do you think it is possible to add this because it would save me a lot of time doing this automatically?
 Thanks for the suggestion... some others have requested it as well. I plan to keep it high on my list of next features to look into the next time I release an update. Thanks.
 Unfortunately, -nogui doesn't work as documented. It still shows up the window, the only difference is the program doesn't wait for kbd/mouse action. When using it in the for ... in (*.jpg) do ... (what is the cmd mode is intended to) you get flashing, unusable screen.
 Hi Alex -- you're right.. the "nogui" option should probably have been called an "auto" mode as it is not truly windowless. I think I should be able to rework the code to make it run truly gui-less, so I will add it to my list. Thanks for the suggestion.
 I tried using your software to figure out why I am finding corrupted jpeg files on my drive. I set up SyncToy to sync my Photos folder with my NAS device and noticed that after the sync runs some files get corrupted. They look corrupted on both ends but my gut tells me they get corrupted when they get written to my NAS and then another sync coppies the corrupted version back to my PC. When I tried opening some of them with they just won't open. There is no thumbnail preview. I found that the dimension property is missing. JPEGSnoop gives me NOTE: File did not start with JPEG marker. Consider using [Tools->Img Search Fwd] to locate embedded JPEG.
JPEGRepair tool gives me InvalidFile and fails to repair them so I'm a bit stuck here. I've got no previous versions of these files. I just want to confirm that they indeed get corrupted while copied to my NAS or on the NAS itself to decide what to do next.
 Hi Yarecki -- sorry to hear about the corruption... It is especially annoying to have a backup set get corrupted in the process :( If JPEGsnoop is not able to locate an image when you use "Img Search Fwd", then there is a good chance that recovery is unlikely. Another quick test is to try ZIPping the files and seeing if the size is much < 1MB. If the file size is extremely small after compression, then it is likely that the file content has been zero'd out completey.

Although it doesn't help now, it may be worth looking into other backup software that can retain multiple versions (ie. rollback capability) as it could help prevent these types of unfortunate scenarios.
2014-03-04Raghu TS

Is there an option to dump the DCT Matrix (before IDCT) for all the MCUs in the picture? I'm particularly interested in calculating the % of non-zero coefficients in the picture.

 Hi Raghu -- the tool is not directly set up to dump this particular stat, but you can probably extract some of the data you need by enabling the following options:
- Options -> Scan Segment -> Decode Image (enable)
- Options -> Scan Segment -> Detailed Decode...
- - Set # MCUs to a large enough number to cover many of the MCUs
- File -> Reprocess File

Unfortunately you'll find that the report becomes too large to get an accurate view of the entire image's DCT matrices.
 Hello there, I am really excited to use this tool. I have been looking for some kind of software that will read layers on documents and be able to detect alternations. These are digital docs, not handwritten that I need to examine. Do you know of any tools out there that can do this or does this have that feature somewhere?
2013-09-19Dick Day
 Greetings. I need the ability to extract a thumbnail from very hi-rez jpgs. Is this function available in command-line mode?

 Hi -- unfortunately this is not available from the command line. However, I would suggest you consider using the free utility "jhead" to do this instead:
jhead -st "thumb/&i" *jpg
 hy, I have a jpg with hidden content, as a thumbnail I see the whole picture, but when I use photo viewer or any , then the bottom half of the jpg is not displayed, only in thumbnail view. When this pic is in JPegsnoop , the only time Im able to see the whole pic is when I click on tools-image search forward, but this makes the jpg smaller, and I loose quality. Is it possible you can fix jpgsnoop with an upgrade so that I do not have to make it smaller to see the whole jpg ?
 The reason for this is probably that the original photo was cropped to only show the top half. What you see when you do the image search forward is the embedded JPEG thumbnail which is probably showing you a smaller version of the original image. When the file was cropped, the main image was cut, but the embedded thumbnail (based on the complete image) was left intact, leaving you with the differences you are observing. In general, you will not be able to recover the complete image (as represented by the embedded thumbnail).
 Calvin, yeah thanks for the reply and the offer. My first inclination though was geared toward ensuring I wasn't overlooking the poper operating and features of your software. I gather your taking a closer look-see at this JFIF header is something you've got to do outside of the parameters of JPEGsnoop?

..'reason I ask is that I've since been able to recover the .jpg files in question, which BTW numbered on the order of 20+.

But Calvin, if you're interested in investigating this, let me know, I'll forward you at least one of the files to examine. Also, note, I am not seeing your eMail address however I did disclose mine this time.
 It depends on which image dimension is reporting as 0x0... is it the EXIF ImageWidth/ImageHeight or the SOF0 marker Image Size? The EXIF dimensions don't actually affect the JPEG decoding, so they could be corrupted without other the image being otherwise corrupted. When you export from within JPEGsnoop, the metadata is largely left intact by design, so that's why you'd still end up with a 0x0 dimension. I'll take a look at your file to see what might be up.
 Cal, I've got a question, not a request per se, but I was hoping to recover some bunk .jpg's, they've somehow for some reason gotten adjusted down to 0 x 0 dimensions when in all actuallity the file information is still intact and your program opens them and views them w/o problem. However, when I go to EXPORT them the file that's generated is one that's saved w/ again, 0 x 0 dimensions. It's throwing me for a loop. I must be overlooking something. What do I need to do? BTW, excellent website, man!
 Hi -- sounds like the JFIF header got corrupted. If possible, send me a copy of the file you opened (prior to export) and I'll take a look.
 Hi Calvin,

I'm trying to recompile the source code with visual studio 2012 Ultimate Edition. However, I receive a couple of of problems about compatibility. In which environment did you compile Jpegsnoop 1.6.1 ? Operating system, x86 or x64, visual studio version?

I am trying to extract the exif data of thousands of files in batch processing. But, some files raise error message and I have to re-run the batch processing. I will suppress the message box in the source code.

Big Thanks
 Hi Erkam -- the solution should compile with VS 2003, but for VS 2012 there are a couple changes that need to me made. From what I recall, it involved: adding "Wininet.lib" to the Linker / Additional Dependencies, comment out Registry.h:operator+=, FolderDLg.h, insert "int" before CALLBACK in CallbackProc(). If there are error messages that pop up during batch operations, then it would probably be best to add an option to disable those. Let me know if that fixes your compile. I may update the sourceforge project to use VS2012 soon anyway.
 Hi, I'm using this to try to recover corrupt JPEGs and it is able to open the image when I select tools>img search forward. I have also selected scan segment>full idtc under options. When I export jpeg it creates an image and says data exists after OEF and the exported image is 48k, while the corrupt file is 2.4 mb. Is there a way to export the whole file? Thank you!
 this program is AMAZINGLY USEFUL, dwarfs usefulness of anything else i found so far for dealing with corrupt photos and i am a noob. e.g. stellar phoenix jpg repair wont generate thumbnails on jpgs that snoop will!

is it possible to run 'extract all jpgs' from a command line? i'd like to batch run that command on all 500 of my corrupt photos. thanks
 Glad to hear that JPEGsnoop was useful for you! At the moment I haven't added extract all JPEGs to the command line options, but I'll put this on the request list for upcoming releases. Thanks!
 I am trying to extract JPEG coefficients from a JPEG image so as to plot a histogram of "JPEG coefficients Vs Frequency of occurrence".
i expected to get some negative values for some of the coefficients but jpeg snoop gave me all positive integer values .

So when i plotted the histogram , i did not get the expected gaussian histogram shape. please help.

i need it for a class i teach :)
 Hi Thomas! When you say JPEG coefficients, I presume you mean the DC and AC DCT coefficients and not the quantization table coefficients? The quantization matrix (DQT) always has positive coefficients. JPEGsnoop can report the DC and AC coefficients for one or more MCUs in an image if you enable "Detailed Decode" under "Options -> Scan Segment...". Once you reprocess a file after enabling the detailed decode, you should see the "DCT Matrix" which includes both positive and negative coefficients. For example:
DCT Matrix=[ -825   -75     6    50   -49    24     0     0]
           [   12    52    -4   -36    40   -17     0     0]
           [    4    12     5    -7     0     0     0     0]
           [  -12    -5    -7    18   -15     0     0     0]
           [  -10    -7     0     0     0     0     0     0]
           [    0     0     0     0     0     0     0     0]
           [   15     0     0     0     0     0     0     0]
           [    0     0     0     0     0     0     0     0]
Hope that helps!
 I am desperate. I have followed the simple instructions on here yet every image I put into the program looks the exact same as it did before (literally with no changes). 3/4s of each picture is blocked out in grey.

I have over 200 images from a trip to Rio de Janeiro Brazil that I CANNOT lose. Someone please help?
 Hi Jenn -- sorry to hear that your images from the trip were corrupted. Please note that JPEGsnoop is, in general, not designed to fix corrupted images. The best bet would be to search online for a data recovery application that you can run on your memory card and see if it can recover the photos better.
 Hi Cal,

Firstly congrats on the baby; I hope that you're not having too many sleepless nights (I'm a dad of one ;)).

It's unfortunate (for me) that I've stumbled across this program after a major catastrophe with a CF card and my daughters birthday. I'm trying to repair the saved files (which of course are corrupted >( ). I have 2 questions for you: Firstly when JPEG snoop cycles through the files and comes up with a message e.g. Expected marker 0xFF, got 0xDB @ offset 0x0000D1B5, how do I interpret that location in a hex editor? And could you explain it for someone who is a complete newbie to this side of photography and understands the basics (very basics) of programming.

The second question is if the beta version still requires a novice tester would you be willing to let me loose on a copy of it?

Thanks in advance
 I love this tool and want to help beta test as well.

Greetings from Vienna/Austria.
PS: A baby? Grats :)
 Thanks... baby has been lots of fun! I've sent an email to you with a link.
 I would also like to beta test v1.5.3 beta.
 Email sent to you.
 I would love to work with 1.5.3 beta. Is it available?

 For sure.. I have sent you an email. Enjoy!

I'm looking for version 1.5.3 you mentioned below, which supports the option to extract all embedded images and rename sequentially, but on your website I find only 1.5.2. Where can I find this version?

Thanks for this great software!
 Hi there Ben! 1.5.3 is available for beta testing if you would like to send me your email address. Just had a newborn baby a couple weeks back so things got a bit delayed! :)
2011-11-02amadou gatta ba
I want to know how to detect if a picture has been retouched.
thank you
 In your responce to Antun:
"Perhaps the option would extract all embedded images and rename sequentially"

Yes !! Please implement this. I will personally pay pal you $20 for this addition.

I specifically wish to extract all frames of a corrupted mjpeg video file from a recovered image of a corrupted SD card. It works one by one but would take me forever to extract all frames of my video.

Note: please ensure the names are 8 digits or more ie. 00000001.jpg

Thanks and keep up the awesome work !!
 I can see how that might be useful, especially in the case of corrupt MJPEG AVI files. I'll take a look to see what I can do.

[UPDATE 08/25/2011: This feature has been added to release 1.5.3 of JPEGsnoop!]
How does one indentify the date the photo was taken; where does it appear in the meta data? Thanks.
 There are often a few places, but in general look for entries named: DateTime
 I've noticed that if my photo has a watermark, when it's viewed as a thumbnail, the watermark is not visible.

Could you point me in the right direction as to how this works?
 The reason you are observing this difference is that some photo editors (ie. the one that you used to create the watermark) don't regenerate the thumbnail. So what you are left with is the original thumbnail (created from the original image), along with the edited primary image. There are many free utilities available on the web that will let you regenerate thumbnails.
 hi calvin

i m doing a project on steganalysis of jpeg images using huffman bit code length statitistics. For all the diff. same resolutionstego images i m getting same huffman table. i hv used the LSB steganography algo. Please help me in analyzing HBCL statistics....
 Hi there,

I have four corrupt photos, and the lower 3/4 of each picture is solid grey.

When I load them up in JPEGSnoop, the pictures are still 3/4 grey until I run 'Tools > Image Search FWD', then the whole image is displayed but is massively reduced in size.

Is there any way of preventing this downsizing of my image? I am VERY impressed that JPEGSnoop has managed to recover the missing sections of my images, but I would be even more impressed if I could keep them at their correct size.

Is this possible? Any advice would be greatly appreciated.

 When you press image search forward, JPEGsnoop is showing you is the embedded JPEG thumbnail. When images get corrupted, the probability is higher that it may only affect the scan data segment (which is your main, full-sized image). Since the embedded JPEG thumbnail is in a different place within the file, it survived unscathed. Therefore, it is not possible to extract a larger version of the image you see in Image Search Forward (as that is only a reduced resolution thumbnail).
 JPEGsnoop is absolutely fantastic. It the most efficient recovery tool I've used so far. The only thing I really miss is to be able to process a folder, instead of going through all the pictures one by one. In my case for example an entire dvd has been corrupted, with hundreds of pictures. So it would be great to have this possibility. Thank you so much for your great work!

I'd like to use JPEGsnoop in batch mode for WinXp sp3 like here:
for %%f in (*.jpg) do jpegsnoop.exe -i %f -o %f.log -nogui -scan

with additional batch option for Image Search Fwd.
 Sounds like a reasonable idea, however one challenge with making this a batch operation is that there could be multiple images found in such a search. Perhaps the option would extract all embedded images and rename sequentially. I'll put it on the request list to consider for the future. thanks!
 by the way...
ur website is very useful for developing softwares working with images.thx a lot...
 hi again

i think i finally solved the subsampling stage. i duplicate the values in pixel 0,0 to the 2x2 area vertically and horizontally. i read in your articles in jpeg huffman coding on the DCT to RGB section. you said that there is a gain of DCT transform. how do i know the gain of dct transform? is this information provided by jpegsnoop?

i am doing a project to decode JPEG files. i did all correct untill the quantization stage. i compare the values i get with the values decoded by jpegsnoop. but i dont know about the idct stage, coz jpegsnoop doesnt show the results of the idct stage.

i realized that before doing the idct stage, i need to do something about the chroma subsampling involving the Cb and Cr blocks. how do you make the 8x8 block of Cb and Cr into 16x16??
 Hi there -- Have a look at the article I wrote up detailing the chroma subsampling process. Good luck!
 Hi! Great Tool! This is the first time, that I can see, which data are stored in a jpg!

A question: Can I delete some data from the jpg like all "Photoshop" tags?

Thank you for this great tool!
 There are many programs available on the web that will perform EXIF removal/cleaning that should do what you're after.
 Hi Calvin!

I really enjoy your site and insight. I was wondering if you could program a software that detects broken JPEGs in a multiple folders (recursive) much like this Japanese program I found from 90s: - The company making this software (Mity Software) quit and this is the only download link I was able to uncover.

You basically give this software a folder to start with and it runs through every single image in that folder and its subfolders and creates a neat sortable report on which images are missing EOF markers or have any other problems.

I work with hundreds of thousands of photos at an agency and that kind of a software can really come in handy for us and I'm sure others dealing with as many photos as we do. Sadly the Japanese software JPEG Checker is extremely old (and I don't know Japanese) so I go through it through intuition for the most part.

Please let me know if you would be interested in overtaking such a project.
 Hey there Jon -- Writing such a program wouldn't be much of a stretch from what is currently done in JPEGsnoop (as a batch / command-line operation). I am currently considering releasing JPEGsnoop source code to the Open Source community, so perhaps this could be added as a feature-request.

I work with an organization of volunteers that handle cheating reports for a first person shooter game. I have to say your software is incredible and has been extremely helpful to us, however our administrators and the staff that use the software do not have the skills to take full advantage of the software.

We use JPEGSnoop to check for images altered after they where generated by either the FPS game itself or a popular in game screen shot software like xfire or fraps.

We have looked at creating special db entries for screen shots taken directly from those sources and I would like to know if you have any plans to create a db of commonly used editing software publicly available or any suggestions on how precisely identify the source of an image that is already processed.

 Great website and program, thanks
I have several jjpeg's I am checking out, would you know of a way to be sure all the pictures came from the same pc, they all are the same size and have the same compression signature, are there other things I can check.
 No, there's almost no way of ascertaining the computer used to store / generate the image files. The only way that one could is if the image editor used to create the files happened to save unique identifying information within the metadata, which is unlikely.
 Hi Calvin,
Thanks for great website. I enjoyed a lot. Your trips were amazing and your photos are really interesting too. Lucky you!
I've searched so much in JPEG. I think you know it completely.
I've read a lot about header, and I know it as well, but I can't find any things about MCU. JPEGsnoop has a tool named "Lookup MCU offset". It determines the file offset to the start of the MCU. It is a great job, but I didn't know how to determine the start of each MCU programmatically? (I got that is possible.) I don't know what is separator data between MSUs, which My program have to recognize it.
I also have another question. For example if first MCU started at (n)th byte, and the second one started at (n+X)th byte. How could I have RGB data for 8*8 pixels from X byte data in this MCU? I want to get pixels data from MCU like GetPixel() method in Bitmap class.
Everybody says (like you) MCUs are independent, but when I write header and then add all MCUs in a new file, there is no problem, but if I write header and skip from first MCU, then add the others in a new file, my new file doesn't have correct color around first MCU. It means that second MCU depends first MCU.
What is language of JPEGsnoop?
Would you please help me. I'm really confused.
 Thanks Zari! Unfortunately, there is no easy way to determine the offset of a random MCU within a JPEG coded bitstream. The Lookup MCU offset function in JPEGsnoop is dependent upon information generated from a previous decode of the huffman bitstrings. In most cases, you'll need to write the majority of the JPEG decoder logic in order to locate a specific MCU within a file. For your second question, you'll find that the MCU's are not byte-aligned. That is, they can be a variable number of bits, so it's not possible to treat them as groupings of bytes.
 (JPEGSnoop 1.41 on Windows XP SP3 32b)
JPEGsnoop is really a MUST HAVE software to understand jpeg quality of JPEG pictures, "Bravo". One suggestion: could JPEGsnoop remember it's window size / position and size of the bottom part at start-up?
 Thanks Marco! That sounds like a good suggestion. I'll put it on my list.
 I'm experiencing the same issue as Puedo in WinXP SP3. The text appears as a blocky ultra-low res font, making it practically unreadable...
JPEGsnoop terminal font blocky

Courrier New is installed, and works fine in other programs. In fact, I'm using it in the text editor that I copy and paste the results into. I tried the installer you linked to, but it didn't fix the issue, even with a reboot.

I did discover the source of the problem though, or at least why the Terminal font isn't being displayed properly. See the third paragraph in the font's Wikipedia article...

My 'Language for non-Unicode programs' setting in Regional and Language Options isn't set to English, which results in the Terminal font not displaying correctly in JPEGsnoop. When I set it to US English and reboot, the output appears as it should, though that's not exactly an ideal solution. It doesn't really explain why it's attempting to load Terminal in the first place either.

Aside from that, it's a great utility. : ) I'd only suggest displaying the most relevant info, like detected compression levels and whether the file has been edited, in a summary view that can be taken in at a glance. The detailed log view is great to have, though I'm guessing the vast majority of people using this program would rather not have to wade through all that information most of the time. Nice work though, and I look forward to future updates!
 Hi there Cryo -- Thanks so much for providing me an example image and a hint at where the problem lies. I have not done much testing on foreign language systems, so I will need to dig into this to understand the issues better. After my holidays, I will take a look and send you a beta version to test out when I've got it. Thanks!

PS: I moved the link to your screenshot to my local server so that you don't have to maintain it further.
 Hey Calvin,

Great tool!! I am investigating a project that involves Lossless JPEG (SOF3) and I was wondering if you had any plans to support it in the near future?

Again, great tool!!!
 Thanks Don! Although I have lossless JPEG on my to-do list, I don't anticipate adding it for quite a while since the demand appears to be low compared to other features.

Is there any way to choose font in the main window? somehow my pic has ugly, blocky, unreadable terminal font, and i cannot read what they say. i can read it if i copy paste the text to some other software.

Or if you could point me how to fix this problem of my computer, that is even better...
 Hi Puedo -- The main window uses the "Courier New" font and is not currently adjustable. I believe this should be available in all versions of Windows (3.1 and newer), but somehow it appears your system does not have it. You can redownload Courier New at:
Hope that works for you.

I have 350 photos that were corrupted when I pulled the memory card out of the built-in card reader on my PC. I learned my lesson the hard way! I erased the card and wrote over it. But I was able to recover 2 of the 350 photos. So, I am using Hex Workshop to compare one of the corrupted jpegs to its exact recovered jpeg. There were 11 instances where the data was different. Each instance there were 4 bytes that were incorrect. They were copied from the previous 4 bytes and all located at different XxXXXXXXFC through XxXXXXXXFF locations.

for example:

at location 0x001DD3F8 though 0x001DD3FF on the corrupt jpeg
F9 59 19 87 F9 59 19 87

same location on the exact recovered jpeg
F9 59 19 87 28 DB B0 FC

Using your jpegsnoop i am able to find about half of these copied/corrupt instances. Is there a way to scan the jpeg data to find all of these corrupt 4 byte copied instances? Then, if I can isolate all instances, how do I determine the correct new data to input.

Sorry, if my lingo is a little off. I know nothing about this...I just like a good time consuming challenge!

I can send you a the corrupt and recovered image I am speaking of. FYI all 350 corrupted photos were taken from a static tripod. I was doing a time lapse photo shoot of a retail space that I was building out.

 Hi there Steve --
The type of occurrence you're observing in the data is typical of a "buffer underrun" event (the transfer process ran out of data and so it replicated the previous 32-bit data word). JPEGsnoop may identify some of these, but only if they have triggered a decoding error (which is not guaranteed). In some cases, you may be able to correct this type of situation by deleting those 4-byte sections, but that is not generally the case. Trying to determine the data to replace is a very difficult process!
 Hey Calvin,

I have the problem with greyed out portions on MANY photos I transferred to a USB Hard Drive. I understand that some may be recovered by copying header data from a nearby photo but I'm unsure exactly how I can use your program to identify the start and finish of a header, AND exactly how much of a header to overwrite.

Any help would be appreciated.

Thank you so much!
 Important note: repairing corrupted headers in JPEG files only works for a small fraction of damaged files, but in some cases it may be all that is required.

An upcoming version of JPEGsnoop will automate this process, so the tedious steps below will not be required!

The answer to the first part of your question is easy: open a "good" image in JPEGsnoop, taken with the same digital camera, in the same "orientation" (ie. portrait versus landscape), and then scroll down to the line:
*** Marker: SOS (Start of Scan) (xFFDA) ***
  OFFSET: 0x000042D5
The above indicates that the header ends at 0x42D4 and the main scan data section starts at 0x42D5 (generally). This implies that we may be able to reuse the portion of the file from 0x0000 to 0x42D4 (inclusive) as the replacement header for a file whose header has been damaged.

Now, for the more difficult part, we'd like to figure out what to replace in the damaged file. Unfortunately, damaged files can come in an infinite variety, with key markers missing, so there is no simple way to determine what has been damaged and what remains valid. Similarly, it is not always easy to locate the end of the header to replace.

However, to keep things very simple, let's take the scenario where only a small amount of the damaged file's header has been corrupted. In this case, JPEGsnoop should be able to parse most of the header (of the damaged file) and report the position of it's Start of Scan (SOS) marker.

In this example, I might see the following reported by JPEGsnoop (in the damaged file):
*** Marker: SOS (Start of Scan) (xFFDA) ***
  OFFSET: 0x00004F29
Using a backup of the damaged file, open it up in a hex editor of your choice. With the above information, I know that I will have to replace the file contents from 0x0000-0x4F28 of the damaged file with the section 0x0000-0x4D24 of the good file. After saving, reopen the file in JPEGsnoop and see if the file can be processed.

As mentioned earlier, this type of "repair" is very basic and can only address a very small fraction of damaged files, but in some cases it is sufficient. I plan to add a more advanced form of header repair in upcoming releases of JPEGsnoop, so stay tuned.
 Attempting to use the software for the first time on a .pdf document. JPEGsnoop states 'File did not start with JPEG marker. Consider using [Tools->Img Search Fwd] to locate embedded JPEG.'

The Img Search Fwd states the file was not found, but i have it on my desktop. I dragged it into the JPEGsnoop window and when I try to open folder from JPEGsnoop it cannot be located either.

What could be the problem? Is there any way someone could TeamViewer with me and help me work the application?
 JPEGsnoop only extracts JPEG images from PDF files, so it sounds like the embedded images are of a different type (eg. PNG, bitmap, etc.)
 Great software. :)

I just can't export the file, so I can view it in other programs. Any tips?
 Hi there Chris --

If it doesn't view well in other programs, then it is likely that there was some type of corruption or error in the file. An upcoming version of JPEGsnoop adds in TIFF export which will enable you to open the resulting file in other software as well.
 Well I tried this software and it works great but with one caveat... the picture it exports is tiny. 512x320. Is this deliberate or do I have it set up wrong?
 The program will export whatever JPEG image it finds at the current position within the file. Most intact JPEG files will decode from offset 0 to give you the full-res image. It sounds like you may have either performed a "search forward/reverse" and actually extracted the embedded thumbnail or else the file was corrupt and only the thumbnail remained. Try using the search forward / reverse function a couple times on the file to see if any other JPEG image data is present in the file.
 Can the software be used in a batch mode to process a series of JPEG files and indicate those that have corruption?
 Hi Linda -- While the program doesn't currently support batch operation, you can perform some limited batch capability by using the command-line interface and using a MS-DOS batch script to call it. For example:

for %%f in (*.jpg) do jpegsnoop.exe -i %f -o %f.log -nogui -scan

The above should search through all JPG files in a directory, run JPEGsnoop on them and save the report with a ".log" extension, but using the command-line interface is not ideal. I may provide true batch capability in the future which would be a lot more flexible and useful for your needs.
 Hi. is JPEGsnoop recognized by Mobile Forensics as a valid tool for its function, is there some web reference?
If no, is there an alternative tool for jpeg file analyze directly on phone mobile and that Mobile forensics consider valid?
Thank for support.
 To my knowledge the tool is not recognized by MF -- as I outlined in my discussions on what conclusions can be drawn, I have pointed out the challenges facing this particular technique. As I'm not familiar with mobile analysis, I'm not able to provide specific software recommendations.
it is possible discovering by metadata if data creation of image file has been modified after photo has been done with a mobile phone?
 By metadata alone, usually no. Metadata is very easy to modify and there is very little outside of the metadata that you can use to identify a mismatch.

have some wierd jpeg with few missing markers (from storage thumbs.db some odd version of it) aparently there are 4 channels in this files:
original :
*** Marker: SOS (Start of Scan) (xFFDA) ***
OFFSET: 0x00000018
ERROR: SOS before valid DHT defined

now I've manually rebuilt header+DHT+quant
*** Marker: SOS (Start of Scan) (xFFDA) ***
OFFSET: 0x000001D1
Scan header length = 14
Number of img components = 4
Component[1]: selector=0x52, table=0x00
Component[2]: selector=0x47, table=0x00
Component[3]: selector=0x42, table=0x00
Component[4]: selector=0x41, table=0x00
Spectral selection = 0 .. 63
Successive approximation = 0x00

NOTE: Scan parsing doesn't support CMYK files yet.

any chance we get support for 4 channel or any tips how to do it since my image looks very wierd when loaded via .NET 2.0 into Image object. and I am becomming clueless since image channels are wrong, think format inside this JPEG file is ABGR and I need RGB or some other wierd conversion is needed.

any chance to swap channels in file prior to parsing?
some small example would be nice

big thanks

 Hi -- as you've probably noticed, 4-channel JPEGs are not well supported by most utilities, JPEGsnoop included. Most of the time JPEG images with 4 components are presumed to be CMYK, but as you say it's possible that one could be representing an alpha channel plus some variant of RGB.

In your case, the SOS component identifiers seem to imply RGBA.

I'll add 4-channel decode to my to-do list. I don't imagine it would be that hard to do, but in all honesty I rarely ever run into these examples. The challenge would be to extend the decoder while still maintaining the decoder's memory footprint for 3-channel images. I'll revisit the code and give it some thought. thx.
2009-01-11Jeff Henson
 I have some corrupt pictures that I have used jpegsnoop for and it opens the pictures. However, both the color and image are not correct. Either just a small line at the top of the picture is generated and the rest is grey or the image appears like it is a negative and shows the image twice in the picture. Any ideas on how to recover them?
 That is generally indicative of a corruption within the compressed bitstream. Recovery from this point is a manual process that cannot be automated directly by JPEGsnoop. At this time due to personal time constraints I am not able to offer the individual image repairs. Thanks.


Leave a comment or suggestion for this page:

(Never Shown - Optional)

NOTE: Image repair requests are not accepted. Thanks for your understanding.