Return to Digital Photography Articles
JPEGsnoop - JPEG File Decoding Utility
by Calvin Hass © 2009
JPEGsnoop is a free Windows application that examines and decodes the inner details of JPEG and MotionJPEG AVI files. It can also be used to analyze the source of an image to test its authenticity.
Overview
Latest Version: 1.4.1
Introduction
Every digital photo contains a wealth of hidden information -- JPEGsnoop was written to expose these details to those who are curious.
Not only can one determine the various settings that were used in the digital camera in taking the photo (EXIF metadata, IPTC), but one can also extract information that indicates the quality and nature of the JPEG image compression used by the camera in saving the file. Each digical cameras specifies a compression quality levels, many of them wildly different, leading to the fact that some cameras produce far better JPEG images than others.
What can I do?
Check out a few of the many possible uses for JPEGsnoop!
One of the latest features in JPEGsnoop is an internal database that compares an image against a large number of compression signatures. JPEGsnoop reports what digital camera or software was likely used to generate the image. This is extremely useful in determining whether or not a photo has been edited / tampered in any way. If the compression signature matches Photoshop, then you can be pretty sure that the photo is no longer an original! This type of analysis is sometimes referred to as Digital Image Ballistics / Forensics.
JPEGsnoop reports a huge amount of information, including: quantization table matrix (chrominance and luminance), chroma subsampling, estimates JPEG Quality setting, JPEG resolution settings, Huffman tables, EXIF metadata, Makernotes, RGB histograms, etc. Most of the JPEG JFIF markers are reported. In addition, you can enable a full huffman VLC decode, which will help those who are learning about JPEG compression and those who are writing a JPEG decoder.
Other potential uses: determine quality setting used in Photoshop Save As or Save for Web settings, increasing your scanner quality, locating recoverable images / videos, decoding AVI files, examining .THM files, JPEG EXIF thumbnails, extract embedded images in Adobe PDF documents, etc.
Trying to Undelete or Unformat your Photos?
If you're interested in trying to recover your deleted photos, check out my new page on recovering deleted photos.
File Types Supported
JPEGsnoop will open and attempt to decode any file that contains an embedded JPEG image, such as:
- .JPG - JPEG Still Photo
- .THM - Thumbnail for RAW Photo / Movie Files
- .AVI* - AVI Movies
- .DNG - Digital Negative RAW Photo
- .CRW, .CR2, .NEF, .ORF, .PEF - RAW Photo
- .MOV* - QuickTime Movies, QTVR (Virtual Reality / 360 Panoramic)
- .PDF - Adobe PDF Documents
* Note that video file formats (such as .AVI and .MOV) are containers, which can include video streams encoded in one of a wide variety of codecs. JPEGsnoop can only interpret this video footage if the codec used is based on Motion JPEG (MJPG).
Download the Latest Version of JPEGsnoop!
Click to Download .ZIP |
Version: 1.4.1 Version History Released: 05/28/2009 Downloads: 87311 |
JPEGsnoop by Calvin HassHelp Support JPEGsnoop DevelopmentIf you have found JPEGsnoop useful and would like to support its continued development, consider making a small contribution. Donations will help encourage me to add new and interesting features. Found an interesting use for the tool? Let me know! |
System RequirementsThis application has been designed and tested to run on Windows XP and Windows Vista, but it should also work for Windows 95/98/NT/2000. LINUX users: JPEGsnoop apparently works on LINUX under wine Mac users: JPEGsnoop works within CrossOver Mac Terms of UseJPEGsnoop is free for personal and commerial use. Commercial users are encouraged to leave me a brief message so that I can understand your needs and make future versions more useful. |
InstallationNo installation required. JPEGsnoop is fully portable. Simply unzip the download and run! Version HistoryFor information about features added in previous versions of JPEGsnoop, please check out the version history page. |
Awards and Recognition for JPEGsnoop
|
 
|
|
| Main Window |
|---|
|
| Channel Histograms |
|
| MCU Grid & Positioning |
Documentation
Please see the options page for information on how to use JPEGsnoop and other interesting uses for the tool
Recent Features
- XMP APP1 & ICC Header display
- GPS EXIF metadata display
- Full detailed Huffman VLC decoding output for those interested in writing a decoder or learning JPEG compression
- Automatic display of YCC DC block values (16-bit)
- MCU Grid overlay and automatic display of mouse MCU position and file offset in image display window.
- Test overlay function enhanced to allow quick apply and binary code readout.
- Image zoom level from 12.5% - 800%.
- Extract embedded JPEGs -- can be used to extract thumbnails, hidden JPEG files, as well as frames from Motion JPEG AVI files.
- Compression detection enhanced to detect rotated signatures, comment field.
- Full AVI file parsing (to identify MotionJPEG)
- DQT table searches in Executables (for "hackers")
- Detect edited images or identify original digital camera that took a photo!
- Integrated database of thousands of compression signatures (image fingerprint) for digital cameras and editing software
- File overlay test function
- Multi-channel preview: RGB, YCC, R/G/B, Y/Cb/Cr
- Pixel position lookup into file offset
- Examine Motion JPEG .AVI or .MOV (Quicktime) files (MJPG or MJPEG) and play through!
- Examine any file fragments that may contain a JPEG image
- YCC to RGB Color correction / clipping statistics reports
- Command-line execution
- Huffman variable-length code statistics
- Expansion of DHT (Huffman Table Expansion into bitstrings)
- Determine IJG JPEG Quality factor
Background Material
If you want to understand some of the technical details reported by JPEGsnoop, I suggest that you read through my articles on JPEG compression:
Suggestions
As this is a work in progress, I would be very interested in hearing from you, particularly for feature requests, suggestions, comments, bug reports, etc. If you currently use JPEGsnoop and find it useful, let me know!
Reader's Comments:
Please leave your comments or suggestions below!I was crazy looking for help to fix my friends sony camera pictures, they were cut and pasted from vista pc to USB drive, and they don't open,it shows the size of image and jpg extension, by opening with irfan view shows that header can't find, o yes these pictures were save on vista pc desktop window. Well I will give shot with jpegsnoop see what happened. I will update you with results.Thanks Brother.
I just can get the special one MCU's data when I choose the option in "Detailed Decode..."
How to set if I want to see all MCU's RGB component.
This is very good utility.
May i know how to calcuate Approx quality factor ?
the result is different from another utility that i am using. and I am not sure which one is correct! Thanks.
Here is the result i use jpegsnoop.
*** Marker: DQT (xFFDB) ***
Define a Quantization Table.
OFFSET: 0x00000014
Table length = 67
----
Precision=8 bits
Destination ID=0 (Luminance)
DQT, Row #0: 13 9 8 13 19 32 41 49
DQT, Row #1: 10 10 11 15 21 46 48 44
DQT, Row #2: 11 10 13 19 32 46 55 45
DQT, Row #3: 11 14 18 23 41 70 64 50
DQT, Row #4: 14 18 30 45 54 87 82 62
DQT, Row #5: 19 28 44 51 65 83 90 74
DQT, Row #6: 39 51 62 70 82 97 96 81
DQT, Row #7: 58 74 76 78 90 80 82 79
Approx quality factor = 59.94 (scaling=80.12 variance=1.14)
Basing on the proposed IJG quality formula, the reverse determination is based on an assumption that all values are scaled consistently which means that one can sum up all matrix entries. Once summed and a mean computed, if the mean value is <100 then:
qual = (200.0 - mean) / 2.0
otherwise
qual = 5000.0 / mean
I make JPEG transformation in Matlab, and the picture what i get, no good!!!!
I just get this in JPEGsnoop:
*** Marker: DHT (Define Huffman Table) (xFFC4) *** OFFSET: 0x00000054 Huffman table length = 41 ---- Destination ID = 0 Class = 0 (DC / Lossless Table) Codes of length 01 bits (001 total): 02 Codes of length 02 bits (001 total): 02 Codes of length 03 bits (000 total): ... Codes of length 16 bits (000 total): Total number of codes: 002 Expanded Form of Codes: Codes of length 01 bits: 0 = 02 (Total Len = 3) Codes of length 02 bits: 10 = 02 (Total Len = 4) ---- Destination ID = 0 Class = 1 (AC Table) Codes of length 01 bits (002 total): 00 04 Codes of length 02 bits (001 total): 01 Codes of length 03 bits (000 total): ... Codes of length 16 bits (000 total): Total number of codes: 003 Expanded Form of Codes: Codes of length 01 bits: 0 = 00 (EOB) (Total Len = 1) 1 = 04 (Total Len = 5) Codes of length 02 bits: 00 = 01 (Total Len = 3) *** Decoding SCAN Data *** OFFSET: 0x00000089 *** ERROR: Can't find huffman bitstring @ 0x00000089.5, table 0, value [0xf68fb540]what is the Error, in the picture?
So, in summary, your Huffman Tables were not written correctly and therefore the image will not decode properly. Hope that helps!
thanks for JPEGsnoop - it's a great utility!
A quick question about the GPS co-ordinates that are reported
on geotagged images - mine always show 0.000" (zero
seconds). Checking with other tools such as ExifTool shows
that the seconds are actually non-zero. Any suggestions?
David
For a very interesting introduction to many of these advanced image analysis techniques, have a look at the HackerFactor blog -- Dr. Neal Krawetz has done an excellent job of demonstrating what can be done with various objective analysis tools.
Is there a way to check files within a given folder to weed out files with an "x" ratio of compression? IE those files MOST compressed /least compressed I would like identified.
Is there a way to identify with jpegsnoop if the JPEG images are encoded in YCbCr or RGB?
Thanks
I have moved the files that would open back into My pictures and even backed them up onto discs. The photos that would not open in any of my formats - Ex. Adobe 3 Photoalbum example says Failure when trying to open - I have created a file for called photos that will not open.
I have thumbnails of these pictures in my Adobe 3 Photoalbum from when they were originally taken. The photos that will not open and my thubmnails match jpeg numbers but neither will open. I can view the picture that I took as a thumbnail but it won't open and I have tried to reconnect it to the matching jpeg number from the file folder called photos that won't open. nothing will work and these are really the pictures I wanted. Help - do you have any ideas. I have spent 3 weeks on this to the point my brain cells are throbbing.
Sorry to hear about your unfortunate mishap. Although you see the thumbnails in your photo organizer, the restored images do sound as though they have become corrupted (very common problem with most "recovery" programs) in the process.
Unfortunately, due to limited time constraints, I am no longer able to offer custom repair services.
However, I would like to release a tool that will allow you to recover your own photos. Stay tuned for updates. In the meantime, keep that backup CD handy.
thanks!
My problem's that I have/want to convert JPEGs without huffman tables to ones with (thousands of them; and nope, haven't got the RIFF header of the video ;-) So I basically just wanted to know how to add such a huffman table (see DHT) and think I've found it out now...
well, gonna try automated conversion tomorrow, here its 04:00 a.m. *yawn*
(beside your en-depth background information) a nice source for some info about the JPEG format is en.wikipedia.org ^^
Great software, but I have a few questions for you. I have a Canon Xti and mainly shoot RAW. I want to be able to prove that my RAW images are unedited, however, converting a RAW file to a jpeg file raises the red flag on your software and determines that it is edited. If I try to analyze the RAW file (.CR2), it prompts "File did not start with jpeg marker". When I click Tools-> Img Search Fwd, there does not appear to be an embedded jpeg file. Essentially I am wondering what I need to do in order to authenticate an image shot in RAW. Thanks.
Your Programm is very good!!! But ...
Ulead Photo Explorer 8.6 make Errors in files. At first I thought, that the Camera FX8100 Finepix Fuji might be the bad value.
So now: I like to find the readsons.
At first I verify the Files. and find the Error 0x93 is changed to 0x92.
"www.macami.de/bilder/DSCF9419.JPG"
Now I open Your Program, and Find the Error.
"www.macami.de/bilder/JPG%20fehler.jpg"
So now I like to find out, what does the Error in 0x001EFB05 will change. As you sea, it changes 3 MCU in color and the compleat file.
Also, I tought, the Boxes are 8x8 Bits and now I find MCU is 2 X 8x8. But therevor I have to learn more about decoding JPG.
Regards Sauermann
I should send to you a sample image, but I don't know your e-mail.
You have answered to my question, but that one was in this: yes, when we have got FF00 sequence we ignore 00 value. But I found in report (as specified in my previous message) that FF value has been ignored, and 00 value - hasn't.
Thank you
But I have a little trouble: I found a thing, that I cann't understand, in a report of your program, in this point:
[0x000002C0.1]: ZRL=[ 1] Val=[ 2] Coef=[39..40]
Data=[0x 6E FF 00 BE]
[0x000002C2.0]: ZRL=[ 9] Val=[ 2] Coef=[41..50]
Data=[0x 00 BE 96 BD]
(value 0x6E passed normally, but 0xFF wasn't processed)
Possibly that I'm wrong, of course. JPEGsnoop version: 1.3 and 1.4. I'm waiting for your answer. If you would mail me - I should send you a tested picture.
Thank you
If it doesn't look like this is what you are observing, then please email me your sample image. Thx.
I've seen it expressed in meters or millimeters, so wouldn't these be actual measurements? If I take a macro shot that is out of focus, I'm hoping that this measure tells me if I was outside the limits of focus.
It always seemed to me that 12bit would solve the main problem of 8bit JPEG: excessive quantisation error. Particularly when you allow for the mismatch between the sRGB and the YCC space which is also 8bit.
But, apart from DICOM, I can't find any source of 12bit JPEG.
As always it is "supported" by Imagemagick like JPEG-LS which also looks interesting, and EXR. But supported just means you have to recompile the program to add the feature. Not within my capabilities...
I wonder whether, the lack of support is because there is some good reason why 12bit JPEG won't work well with camera images.
Perhaps encoding all of the low level noise would degrade the visible image quality.
All I was looking for was a sensible format, where the files are not too much larger than the DNG that they are created from. After all, the DNG contains all of the information and noise of the image.
The theoretical advantage of JPEG-LS is that you can set the precision you want from the compression. But I haven't found a way of testing it.
Do you have any thoughts on this?
Thank you.
Can this software be use to check whether it has stenographic in the image, like the quantization table has been changed. Please advice
Is that the same thing as focal length?
Note that the encoding of the SubjectDistance parameter has evolved in newer cameras to become a proprietary measurement with unknown units -- hence it may not always be possible to relate this value to the real-world distance to your subject.
TY
I made this suggestion about a year ago, but it was just before you were leaving, so you didn't have time to look into it.
It's my pet topic of EXIF 2.2 camera JPEG sYCC colourspace.
Most software, and I expect JPEGsnoop, treat JPEGs as JFIF (from 1992) but camera JPEGs are EXIF 2.2 (from 2002) i.e. IEC 61966-2-1
EXIF 2.2 calls up the sYCC colourspace which conflicts with JFIF and the ICC specification. This is because sYCC specifies that RGB values are not clipped to 0 to 1, but the whole range is encoded unclipped during conversion from XYZ to rgb to r'g'b'to YCC.
A free version of the equations are in this document: http://www.color.org/sYCC.pdf
This gives a gamut about 50% larger than sRGB.
The problem is that, clipping is not a valid way of dealing with intentional out of range values, because it does not even maintain the correct hue.
It was JPEGsnoop that originally alerted me to what was happening.
I was wondering whether you would add decoding of camera JPEGs in accordance with EXIF 2.2 to JPEGsnoop?
This would need conversion from YCC to r'g'b' to rgb to XYZ without clipping intermediate values to 0 to 1. The whole process would probably be best done in the highest convenient precision, but rgb and XYZ are linear so they need at least 16bit.
It is not possible to use ICM for the conversion because the ICC specification requires RGB to be clipped on input.
If JPEGsnoop could save the XYZ image as 16bit TIFF then it would be useable in other colour managed tools.
Or it could display the gamut of the image on an xy chart, although I suspect that is significantly more work. But it would show users of JPEGsnoop that there is a significant issue with camera JPEGs.
The sample below is the most extreme that I have seen, partly because it contains fluorescent colours, but natural colours like leaves and flowers also produce out-of-range values.
It also shows up a bug in the latest version:
JPEGsnoop 1.3.0 gives 0 for RGB clipping in DC even though there are huge numbers for this photo:
http://www.steves-digicams.com/2007_reviews/c875/samples/100_0178.jpg
RGB histogram in DC (before clip): R component histo: [min= -38 max= 308 avg= 144.2] G component histo: [min= -25 max= 266 avg= 169.6] B component histo: [min= -107 max= 308 avg= 181.4] RGB clipping in DC: R component: [<0= 0] [>255= 0] G component: [<0= 0] [>255= 0] B component: [<0= 0] [>255= 0] RGB histogram in DC (after clip): R component histo: [min= 0 max= 255 avg= 144.1] G component histo: [min= 0 max= 255 avg= 169.6] B component histo: [min= 0 max= 255 avg= 181.6]You've raised an interesting issue. I will take a look at the spec and color conversion in greater detail and see what I can do. At this time, I do have a number of new features on my short-list, but if it seems practical, I'll bump this one up. I have not yet written a TIFF export feature, so I'd need to look into that first. Thanks for providing all of the references and example image.
Here is Jassy's post:
It seems JPEG Snoop also uses APP3 marker (for EXIF) essentially to decode correctly. It seems even if APP2 is absent, its ok, but if APP3 is not present, it gives error, saying "expected marker 0xFF at offset ---"
I don't believe I received a test image from Jassy so if you could email me one, that would be great.
How can I find the image resolution in terms of dpi when my image only reports 1700x2233 pixels and aspect ratio 1:1.
I can not find anywhere either original size or resolution information.
Thanks in advance.
This is tremendously useful. I'd really like to see a command-line version of this, especially one that runs under linux. I know the GUI runs under wine in linux, but a command-line based executable would really aid in batch processing. Thanks for the great utility!
Mike
I do have a similar problem to solve where a number of .mov files were corrupted by the digital camera that took them. I believe the frames should still be recoverable, since the preview is visible on the camera itself, but the videos do not play. Now I believe these are not MJPEGs but MPEGs. Do you know of any similar program that can extract frames from MPEGs?
Thanks,
Andrew
ffmpeg -y -i <filename.mpg> -vframes 1 -ss 00:00:10 -an -vcodec png -f rawvideo -s 320x240 x.png
The parameter after ss is the timestamp.
Many thanks for great tool which jpegsnoop really is! I use it for JPEG FPGA hardware compressor and it helps a lot in debugging and understanding JPEG standard.
I have one issue too: in detailed dump I can see DCT matrix for each 8x8 block. It seems to me that you show DC sample already after differential encoding. I think that at DCT stage DC component is still not-yet-differential, this happens after RLE.
Michal
You've just helped me get back pictures of my daughter that I thought were lost forever...
You are a Wizard, a King, and my Friend.
Thank you,
(I've seen web pages with jpeg compression at 100%.)
Maybe the good people at http://www.smushit.com/ could include it.
Thnx for this great tool
Westworld
I like your tool. But, as far as I know, many photo-editing softwares and cameras use similar/same quantization tables. So, how using the quantization table is possible to say if the photo was edited? Maybe, the camera has a same quantization table like some photo-editing software..??
Linda
Thanks for the reply, in the meantime I tried some more and solved my problem - you were absolutely right, the problem is in the sub-sampling.
The JPEGs converted on the Sandisk device have the following component information:
whereas the ones I've been producing have either
or
for luminance.
I can fix this using cjpeg -sample 2x1:
...and this works! According to the cjpeg docs this option adds more time and size for little difference in quality. The Sandisk device also starts counting at 0 not 1 which seems to be outside the JPEG standard, but regardless of that I can now do a bulk convert. I don't know why all the options are reported as subsamp 1x1 but I guess the difference is in the sampling factor.
Thanks for your help and for a great program.
Most digicams will use "2x1" chroma subsampling by default, as the human eye is less attentive to detail in the color channels (chrominance) versus changes in intensity (luminance). Therefore, most digicams will effectively cut the color "resolution" in half prior to compression. It appears that the Sandisk Photo Album slideshow had optimized their decoder to support only the most common subsampling ratio.
I have same situation with Denisse, Could you please give the deep describe in step2 (for replace the JFIF header - how to extract from the good header and how to replace in the currupt header) May i need the hex editior to do this process
Thank you
Thanks for a really useful program. I have a Sandisk photo album which displays images on a TV, either by scrolling through them manually or displaying them automatically as a slideshow. The slideshow mode is highly dependent on the image format: you have to convert images one by one on the device to set it up. In slideshow mode it simply skips over images not stored in its chosen format, although in manual mode it displays all pictures OK.
It takes a very long to convert each image manually on the device so I'm trying to do bulk conversion on a PC. I've inspected the JPEGs that the device produces and the differences from my normal JPEGs (produced by GIMP or Paintshop Pro) are:
- no APP0 (JFIF) marker at the start, although it seems to work OK if I add one
- only one DQT and DHT marker per file with respectively 2 and 4 tables in them: my normal JPEGs have multiple DQT and DHT markers each with a single table
- the SOF0 comes before the DHT: my normal JPEGs have it after
- the details of the Img sub-sampling components are different
I'm assuming the device is checking something in the JPEG headers to decide whether or not it is going to include it in its slideshow any ideas what it might be doing? Trial and error is taking me too long!Many thanks for any help.
Besides the chroma subsampling, I don't think the other points of difference you list above are likely to be real limitations of the Sandisk photo album's slideshow JPEG decoder. Without seeing some examples of the before & after conversion process, it would be hard for me to determine the exact limitation and therefore deduce the method by which we can pre-convert for faster display.
If you can send me an example photo (before conversion) and result after conversion, I'll see if I can help solve this for you.
Thanks,
Cal.
Ur tool is help me a lot to understand the image files.. Thanks for sharing to everyone.
Right now, i try to develop a jpg file which should be scalable (width/Height) as well as rotation based on the User input...
My question, is it possible to do this operation in JPEG ITU standard header or i have to implement by averaging the datas, any special algorithm is there ????..
Please give me details about how to do this operation (scalable & Rotation)
Regards,
pearl
Iam not an image profesional, i'm a developer, i need help if there are relevant values... the log is very specific.
Thanks for help!
I have downloaded your tool but don't know how to use it and have to fix my photos urgently...
Could you help me or show the way to use it efficiently please..
Thank you
Unfortunately, some older digicams and cellphones will currently report "likely edited" because of the lack of makernotes and/or presence of EXIF software field info.
I have plans to completely rewrite the image assessment algorithm to handle the various scenarios a bit better. Thanks for pointing this out and stay tuned for an update.
-Raja
I have provided some command line options documented here. Hopefully that helps you do what you need.