Return to Digital Photography Articles
JPEGsnoop - JPEG File Decoding Utility
by Calvin Hass © 2009
JPEGsnoop is a free Windows application that examines and decodes the inner details of JPEG and MotionJPEG AVI files. It can also be used to analyze the source of an image to test its authenticity.
Overview
Latest Version: 1.4.2
Introduction
Every digital photo contains a wealth of hidden information -- JPEGsnoop was written to expose these details to those who are curious.
Not only can one determine the various settings that were used in the digital camera in taking the photo (EXIF metadata, IPTC), but one can also extract information that indicates the quality and nature of the JPEG image compression used by the camera in saving the file. Each digical cameras specifies a compression quality levels, many of them wildly different, leading to the fact that some cameras produce far better JPEG images than others.
What can I do?
Check out a few of the many possible uses for JPEGsnoop!
One of the latest features in JPEGsnoop is an internal database that compares an image against a large number of compression signatures. JPEGsnoop reports what digital camera or software was likely used to generate the image. This is extremely useful in determining whether or not a photo has been edited / tampered in any way. If the compression signature matches Photoshop, then you can be pretty sure that the photo is no longer an original! This type of analysis is sometimes referred to as Digital Image Ballistics / Forensics.
JPEGsnoop reports a huge amount of information, including: quantization table matrix (chrominance and luminance), chroma subsampling, estimates JPEG Quality setting, JPEG resolution settings, Huffman tables, EXIF metadata, Makernotes, RGB histograms, etc. Most of the JPEG JFIF markers are reported. In addition, you can enable a full huffman VLC decode, which will help those who are learning about JPEG compression and those who are writing a JPEG decoder.
Other potential uses: determine quality setting used in Photoshop Save As or Save for Web settings, increasing your scanner quality, locating recoverable images / videos, decoding AVI files, examining .THM files, JPEG EXIF thumbnails, extract embedded images in Adobe PDF documents, etc.
Trying to Undelete or Unformat your Photos?
If you're interested in trying to recover your deleted / corrupted photos, check out my new page on recovering deleted photos.
File Types Supported
JPEGsnoop will open and attempt to decode any file that contains an embedded JPEG image, such as:
- .JPG - JPEG Still Photo
- .THM - Thumbnail for RAW Photo / Movie Files
- .AVI* - AVI Movies
- .DNG - Digital Negative RAW Photo
- .CRW, .CR2, .NEF, .ORF, .PEF - RAW Photo
- .MOV* - QuickTime Movies, QTVR (Virtual Reality / 360 Panoramic)
- .PDF - Adobe PDF Documents
* Note that video file formats (such as .AVI and .MOV) are containers, which can include video streams encoded in one of a wide variety of codecs. JPEGsnoop can only interpret this video footage if the codec used is based on Motion JPEG (MJPG).
Download the Latest Version of JPEGsnoop!
Click to Download .ZIP |
Version: 1.4.2 Version History Released: 04/10/2010 Downloads: 114671 |
JPEGsnoop by Calvin HassHelp Support JPEGsnoop DevelopmentIf you have found JPEGsnoop useful and would like to support its continued development, consider making a small contribution. Donations will help encourage me to add new and interesting features. Found an interesting use for the tool? Let me know! |
Source Code: JPEGsnoop may become Open Source!
System RequirementsThis application has been designed and tested to run on Windows XP and Windows Vista, but it should also work for Windows 95/98/NT/2000. LINUX users: JPEGsnoop apparently works on LINUX under wine Mac users: JPEGsnoop works within CrossOver Mac Terms of UseJPEGsnoop is free for personal and commerial use. Commercial users are encouraged to leave me a brief message so that I can understand your needs and make future versions more useful. |
InstallationNo installation required. JPEGsnoop is fully portable. Simply unzip the download and run! Version HistoryFor information about features added in previous versions of JPEGsnoop, please check out the version history page. |
Awards and Recognition for JPEGsnoop
|
 
|
|
| Main Window |
|---|
|
| Channel Histograms |
|
| MCU Grid & Positioning |
Documentation
Please see the options page for information on how to use JPEGsnoop and other interesting uses for the tool
Recent Features
- XMP APP1 & ICC Header display
- GPS EXIF metadata display
- Full detailed Huffman VLC decoding output for those interested in writing a decoder or learning JPEG compression
- Automatic display of YCC DC block values (16-bit)
- MCU Grid overlay and automatic display of mouse MCU position and file offset in image display window.
- Test overlay function enhanced to allow quick apply and binary code readout.
- Image zoom level from 12.5% - 800%.
- Extract embedded JPEGs -- can be used to extract thumbnails, hidden JPEG files, as well as frames from Motion JPEG AVI files.
- Compression detection enhanced to detect rotated signatures, comment field.
- Full AVI file parsing (to identify MotionJPEG)
- DQT table searches in Executables (for "hackers")
- Detect edited images or identify original digital camera that took a photo!
- Integrated database of thousands of compression signatures (image fingerprint) for digital cameras and editing software
- File overlay test function
- Multi-channel preview: RGB, YCC, R/G/B, Y/Cb/Cr
- Pixel position lookup into file offset
- Examine Motion JPEG .AVI or .MOV (Quicktime) files (MJPG or MJPEG) and play through!
- Examine any file fragments that may contain a JPEG image
- YCC to RGB Color correction / clipping statistics reports
- Command-line execution
- Huffman variable-length code statistics
- Expansion of DHT (Huffman Table Expansion into bitstrings)
- Determine IJG JPEG Quality factor
Background Material
If you want to understand some of the technical details reported by JPEGsnoop, I suggest that you read through my articles on JPEG compression:
Suggestions
As this is a work in progress, I would be very interested in hearing from you, particularly for feature requests, suggestions, comments, bug reports, etc. If you currently use JPEGsnoop and find it useful, let me know!
Reader's Comments:
Please leave your comments or suggestions below!fantastic tool. I've been putting together my own hardware jpeg decoder implementation, and this has been invaluable. I couldn't have progressed so quickly without it.
In my testing of images from various sources I came across a type which I rendered incorrectly, but then noticed JPEGsnoop (v1.4.2) did the same, though others tools showed it as I'd expect.
I noticed that the SOF0 component IDs weren't 1,2 and 3 as might be expected but 0x52, 0x47 and 0x42. It was only when I noticed that these were the ASCII codes for RGB, that I turned off my colour transformation, and the imaged rendered correctly. Delving further, I noticed that there was an APP14 segment, and with some research found that for an ID "Adobe", the last byte (offset 13) is a transfom indicator (Tr). A value of 2 is for YCCK, a value of 1 is for YCbCr and 0 means "unknown", but if a 4 component image it is assumed to be CMYK and if a 3 component image is assumed to be RGB.
Anyway, I thought I'd highlight this in case you were unaware. If you want an example image, my own website has one at:
http://www.anita-simulators.org.uk/calc/calc_images/Anita8041_thumb.jpg
Of my own images like this, they all tend to be small and generated from older Adobe tools.
Hope this is of use. JPEGsnoop is still one of the most useful tools I've come across on the internet.
Simon
However I'm a bit puzzled. I have loads for photos taken recently from a cheap samsung digicam. However, funny enough, it seems to have a different signature every time! How come is it possible? I added more than 20 signatures for that cam already, and I recall it was in automatic mode, thus same picture size and same refinement I believe. Funny enough the program does work correctly with photos taken by a different digicam and three different mobiles :)
Well, i need to know why does the final image to be exported, show a resolution of only 320x320 pixels when i do a Ctrl +2, when my original image size was around say 1500x1300? The image appears small....Is there some settings which i need to keep ON?
I have used you software to recover some of my holiday photos, it works brilliantly thanks. I have also managed to use it to recover some avi clips however exporting each frame to JPEG manually then clicking the search forward is proving to be a rather timely process. I wondered if there was any scope to automate the process?
Thanks Matt
First let me say thanks for providing software that assists people in their needs without taking them to the bank. This country needs more people like you. In reading the blogs and or questions from some of your clientele, it is obvious your software is used by many professional photographers. For those of us that are not that well schooled in the forensic of a camera or pictures, do you have a cheat sheet? A cheat sheet would allow an individual the opportunity to use and understand what they are looking for or at when analyzing a picture. Also does the software tell you what has been altered in a picture? I want to thank you for providing such a neat tool for everyone to use at a price no one can complain about.
Thanks for your product and assistance
ERROR: SOS before valid DHT defined
can you explain it to me ? :)
Thanks
Thank you for making available this very useful program. I also like the detailed information you provide on your website on technical things like chroma subsampling and their values used in the various DSLRs.
My only complaint would be that the program runs on Windows so I cannot use it natively on my Mac. Have you considered doing a port to OS X, or ask someone to assist you in such? I don't know of a comparable tool that runs on OS X.
- Pieter.
I am in the process of releasing JPEGsnoop source code as open source, which should make it easy for anyone to port to Mac / OS X. As it currently stands, I believe people are already running JPEGsnoop on the Mac under wine emulation.
Thank you very much
Suggestion:
extracted information needs to be organised eg. tabs for different chunk of information.
A detailed tool tip for each option specially under tool menu.
option to add multiple files or embeded image explorer.
Some more improvement on toolbar.
P.S: sorry a longer suggestion does not mean that its not a great software.
These are great suggestions... The user interface is greatly in need to a refresh, and by opening the source code to the user community, I hope that others will skills in that area can implement these type of improvements. Thanks.
I was crazy looking for help to fix my friends sony camera pictures, they were cut and pasted from vista pc to USB drive, and they don't open,it shows the size of image and jpg extension, by opening with irfan view shows that header can't find, o yes these pictures were save on vista pc desktop window. Well I will give shot with jpegsnoop see what happened. I will update you with results.Thanks Brother.
I just can get the special one MCU's data when I choose the option in "Detailed Decode..."
How to set if I want to see all MCU's RGB component.
This is very good utility.
May i know how to calcuate Approx quality factor ?
the result is different from another utility that i am using. and I am not sure which one is correct! Thanks.
Here is the result i use jpegsnoop.
*** Marker: DQT (xFFDB) ***
Define a Quantization Table.
OFFSET: 0x00000014
Table length = 67
----
Precision=8 bits
Destination ID=0 (Luminance)
DQT, Row #0: 13 9 8 13 19 32 41 49
DQT, Row #1: 10 10 11 15 21 46 48 44
DQT, Row #2: 11 10 13 19 32 46 55 45
DQT, Row #3: 11 14 18 23 41 70 64 50
DQT, Row #4: 14 18 30 45 54 87 82 62
DQT, Row #5: 19 28 44 51 65 83 90 74
DQT, Row #6: 39 51 62 70 82 97 96 81
DQT, Row #7: 58 74 76 78 90 80 82 79
Approx quality factor = 59.94 (scaling=80.12 variance=1.14)
Basing on the proposed IJG quality formula, the reverse determination is based on an assumption that all values are scaled consistently which means that one can sum up all matrix entries. Once summed and a mean computed, if the mean value is <100 then:
qual = (200.0 - mean) / 2.0
otherwise
qual = 5000.0 / mean
I make JPEG transformation in Matlab, and the picture what i get, no good!!!!
I just get this in JPEGsnoop:
*** Marker: DHT (Define Huffman Table) (xFFC4) *** OFFSET: 0x00000054 Huffman table length = 41 ---- Destination ID = 0 Class = 0 (DC / Lossless Table) Codes of length 01 bits (001 total): 02 Codes of length 02 bits (001 total): 02 Codes of length 03 bits (000 total): ... Codes of length 16 bits (000 total): Total number of codes: 002 Expanded Form of Codes: Codes of length 01 bits: 0 = 02 (Total Len = 3) Codes of length 02 bits: 10 = 02 (Total Len = 4) ---- Destination ID = 0 Class = 1 (AC Table) Codes of length 01 bits (002 total): 00 04 Codes of length 02 bits (001 total): 01 Codes of length 03 bits (000 total): ... Codes of length 16 bits (000 total): Total number of codes: 003 Expanded Form of Codes: Codes of length 01 bits: 0 = 00 (EOB) (Total Len = 1) 1 = 04 (Total Len = 5) Codes of length 02 bits: 00 = 01 (Total Len = 3) *** Decoding SCAN Data *** OFFSET: 0x00000089 *** ERROR: Can't find huffman bitstring @ 0x00000089.5, table 0, value [0xf68fb540]what is the Error, in the picture?
So, in summary, your Huffman Tables were not written correctly and therefore the image will not decode properly. Hope that helps!
thanks for JPEGsnoop - it's a great utility!
A quick question about the GPS co-ordinates that are reported
on geotagged images - mine always show 0.000" (zero
seconds). Checking with other tools such as ExifTool shows
that the seconds are actually non-zero. Any suggestions?
David
For a very interesting introduction to many of these advanced image analysis techniques, have a look at the HackerFactor blog -- Dr. Neal Krawetz has done an excellent job of demonstrating what can be done with various objective analysis tools.
Is there a way to check files within a given folder to weed out files with an "x" ratio of compression? IE those files MOST compressed /least compressed I would like identified.
Is there a way to identify with jpegsnoop if the JPEG images are encoded in YCbCr or RGB?
Thanks
I have moved the files that would open back into My pictures and even backed them up onto discs. The photos that would not open in any of my formats - Ex. Adobe 3 Photoalbum example says Failure when trying to open - I have created a file for called photos that will not open.
I have thumbnails of these pictures in my Adobe 3 Photoalbum from when they were originally taken. The photos that will not open and my thubmnails match jpeg numbers but neither will open. I can view the picture that I took as a thumbnail but it won't open and I have tried to reconnect it to the matching jpeg number from the file folder called photos that won't open. nothing will work and these are really the pictures I wanted. Help - do you have any ideas. I have spent 3 weeks on this to the point my brain cells are throbbing.
Sorry to hear about your unfortunate mishap. Although you see the thumbnails in your photo organizer, the restored images do sound as though they have become corrupted (very common problem with most "recovery" programs) in the process.
Unfortunately, due to limited time constraints, I am no longer able to offer custom repair services.
However, I would like to release a tool that will allow you to recover your own photos. Stay tuned for updates. In the meantime, keep that backup CD handy.
thanks!
My problem's that I have/want to convert JPEGs without huffman tables to ones with (thousands of them; and nope, haven't got the RIFF header of the video ;-) So I basically just wanted to know how to add such a huffman table (see DHT) and think I've found it out now...
well, gonna try automated conversion tomorrow, here its 04:00 a.m. *yawn*
(beside your en-depth background information) a nice source for some info about the JPEG format is en.wikipedia.org ^^
Great software, but I have a few questions for you. I have a Canon Xti and mainly shoot RAW. I want to be able to prove that my RAW images are unedited, however, converting a RAW file to a jpeg file raises the red flag on your software and determines that it is edited. If I try to analyze the RAW file (.CR2), it prompts "File did not start with jpeg marker". When I click Tools-> Img Search Fwd, there does not appear to be an embedded jpeg file. Essentially I am wondering what I need to do in order to authenticate an image shot in RAW. Thanks.
Your Programm is very good!!! But ...
Ulead Photo Explorer 8.6 make Errors in files. At first I thought, that the Camera FX8100 Finepix Fuji might be the bad value.
So now: I like to find the readsons.
At first I verify the Files. and find the Error 0x93 is changed to 0x92.
"www.macami.de/bilder/DSCF9419.JPG"
Now I open Your Program, and Find the Error.
"www.macami.de/bilder/JPG%20fehler.jpg"
So now I like to find out, what does the Error in 0x001EFB05 will change. As you sea, it changes 3 MCU in color and the compleat file.
Also, I tought, the Boxes are 8x8 Bits and now I find MCU is 2 X 8x8. But therevor I have to learn more about decoding JPG.
Regards Sauermann
I should send to you a sample image, but I don't know your e-mail.
You have answered to my question, but that one was in this: yes, when we have got FF00 sequence we ignore 00 value. But I found in report (as specified in my previous message) that FF value has been ignored, and 00 value - hasn't.
Thank you
But I have a little trouble: I found a thing, that I cann't understand, in a report of your program, in this point:
[0x000002C0.1]: ZRL=[ 1] Val=[ 2] Coef=[39..40]
Data=[0x 6E FF 00 BE]
[0x000002C2.0]: ZRL=[ 9] Val=[ 2] Coef=[41..50]
Data=[0x 00 BE 96 BD]
(value 0x6E passed normally, but 0xFF wasn't processed)
Possibly that I'm wrong, of course. JPEGsnoop version: 1.3 and 1.4. I'm waiting for your answer. If you would mail me - I should send you a tested picture.
Thank you
If it doesn't look like this is what you are observing, then please email me your sample image. Thx.
I've seen it expressed in meters or millimeters, so wouldn't these be actual measurements? If I take a macro shot that is out of focus, I'm hoping that this measure tells me if I was outside the limits of focus.
It always seemed to me that 12bit would solve the main problem of 8bit JPEG: excessive quantisation error. Particularly when you allow for the mismatch between the sRGB and the YCC space which is also 8bit.
But, apart from DICOM, I can't find any source of 12bit JPEG.
As always it is "supported" by Imagemagick like JPEG-LS which also looks interesting, and EXR. But supported just means you have to recompile the program to add the feature. Not within my capabilities...
I wonder whether, the lack of support is because there is some good reason why 12bit JPEG won't work well with camera images.
Perhaps encoding all of the low level noise would degrade the visible image quality.
All I was looking for was a sensible format, where the files are not too much larger than the DNG that they are created from. After all, the DNG contains all of the information and noise of the image.
The theoretical advantage of JPEG-LS is that you can set the precision you want from the compression. But I haven't found a way of testing it.
Do you have any thoughts on this?
Thank you.
Can this software be use to check whether it has stenographic in the image, like the quantization table has been changed. Please advice
Is that the same thing as focal length?
Note that the encoding of the SubjectDistance parameter has evolved in newer cameras to become a proprietary measurement with unknown units -- hence it may not always be possible to relate this value to the real-world distance to your subject.
TY
I made this suggestion about a year ago, but it was just before you were leaving, so you didn't have time to look into it.
It's my pet topic of EXIF 2.2 camera JPEG sYCC colourspace.
Most software, and I expect JPEGsnoop, treat JPEGs as JFIF (from 1992) but camera JPEGs are EXIF 2.2 (from 2002) i.e. IEC 61966-2-1
EXIF 2.2 calls up the sYCC colourspace which conflicts with JFIF and the ICC specification. This is because sYCC specifies that RGB values are not clipped to 0 to 1, but the whole range is encoded unclipped during conversion from XYZ to rgb to r'g'b'to YCC.
A free version of the equations are in this document: http://www.color.org/sYCC.pdf
This gives a gamut about 50% larger than sRGB.
The problem is that, clipping is not a valid way of dealing with intentional out of range values, because it does not even maintain the correct hue.
It was JPEGsnoop that originally alerted me to what was happening.
I was wondering whether you would add decoding of camera JPEGs in accordance with EXIF 2.2 to JPEGsnoop?
This would need conversion from YCC to r'g'b' to rgb to XYZ without clipping intermediate values to 0 to 1. The whole process would probably be best done in the highest convenient precision, but rgb and XYZ are linear so they need at least 16bit.
It is not possible to use ICM for the conversion because the ICC specification requires RGB to be clipped on input.
If JPEGsnoop could save the XYZ image as 16bit TIFF then it would be useable in other colour managed tools.
Or it could display the gamut of the image on an xy chart, although I suspect that is significantly more work. But it would show users of JPEGsnoop that there is a significant issue with camera JPEGs.
The sample below is the most extreme that I have seen, partly because it contains fluorescent colours, but natural colours like leaves and flowers also produce out-of-range values.
It also shows up a bug in the latest version:
JPEGsnoop 1.3.0 gives 0 for RGB clipping in DC even though there are huge numbers for this photo:
http://www.steves-digicams.com/2007_reviews/c875/samples/100_0178.jpg
RGB histogram in DC (before clip): R component histo: [min= -38 max= 308 avg= 144.2] G component histo: [min= -25 max= 266 avg= 169.6] B component histo: [min= -107 max= 308 avg= 181.4] RGB clipping in DC: R component: [<0= 0] [>255= 0] G component: [<0= 0] [>255= 0] B component: [<0= 0] [>255= 0] RGB histogram in DC (after clip): R component histo: [min= 0 max= 255 avg= 144.1] G component histo: [min= 0 max= 255 avg= 169.6] B component histo: [min= 0 max= 255 avg= 181.6]You've raised an interesting issue. I will take a look at the spec and color conversion in greater detail and see what I can do. At this time, I do have a number of new features on my short-list, but if it seems practical, I'll bump this one up. I have not yet written a TIFF export feature, so I'd need to look into that first. Thanks for providing all of the references and example image.
Here is Jassy's post:
It seems JPEG Snoop also uses APP3 marker (for EXIF) essentially to decode correctly. It seems even if APP2 is absent, its ok, but if APP3 is not present, it gives error, saying "expected marker 0xFF at offset ---"
I don't believe I received a test image from Jassy so if you could email me one, that would be great.
How can I find the image resolution in terms of dpi when my image only reports 1700x2233 pixels and aspect ratio 1:1.
I can not find anywhere either original size or resolution information.
Thanks in advance.
This is tremendously useful. I'd really like to see a command-line version of this, especially one that runs under linux. I know the GUI runs under wine in linux, but a command-line based executable would really aid in batch processing. Thanks for the great utility!
Mike
I do have a similar problem to solve where a number of .mov files were corrupted by the digital camera that took them. I believe the frames should still be recoverable, since the preview is visible on the camera itself, but the videos do not play. Now I believe these are not MJPEGs but MPEGs. Do you know of any similar program that can extract frames from MPEGs?
Thanks,
Andrew
ffmpeg -y -i <filename.mpg> -vframes 1 -ss 00:00:10 -an -vcodec png -f rawvideo -s 320x240 x.png
The parameter after ss is the timestamp.
Many thanks for great tool which jpegsnoop really is! I use it for JPEG FPGA hardware compressor and it helps a lot in debugging and understanding JPEG standard.
I have one issue too: in detailed dump I can see DCT matrix for each 8x8 block. It seems to me that you show DC sample already after differential encoding. I think that at DCT stage DC component is still not-yet-differential, this happens after RLE.
Michal
You've just helped me get back pictures of my daughter that I thought were lost forever...
You are a Wizard, a King, and my Friend.
Thank you,
(I've seen web pages with jpeg compression at 100%.)
Maybe the good people at http://www.smushit.com/ could include it.
Thnx for this great tool
Westworld