Return to Digital Photography Articles
JPEGsnoop - JPEG File Decoding Utility
by Calvin Hass © 2012
JPEGsnoop is a free Windows application that examines and decodes the inner details of JPEG and MotionJPEG AVI files. It can also be used to analyze the source of an image to test its authenticity.
Overview
Latest Version: 1.6.1
Introduction
Every digital photo contains a wealth of hidden information -- JPEGsnoop was written to expose these details to those who are curious.
Not only can one determine the various settings that were used in the digital camera in taking the photo (EXIF metadata, IPTC), but one can also extract information that indicates the quality and nature of the JPEG image compression used by the camera in saving the file. Each digical cameras specifies a compression quality levels, many of them wildly different, leading to the fact that some cameras produce far better JPEG images than others.
What can I do?
Check out a few of the many possible uses for JPEGsnoop!
One of the latest features in JPEGsnoop is an internal database that compares an image against a large number of compression signatures. JPEGsnoop reports what digital camera or software was likely used to generate the image. This is extremely useful in determining whether or not a photo has been edited / tampered in any way. If the compression signature matches Photoshop, then you can be pretty sure that the photo is no longer an original! This type of analysis is sometimes referred to as Digital Image Ballistics / Forensics.
JPEGsnoop reports a huge amount of information, including: quantization table matrix (chrominance and luminance), chroma subsampling, estimates JPEG Quality setting, JPEG resolution settings, Huffman tables, EXIF metadata, Makernotes, RGB histograms, etc. Most of the JPEG JFIF markers are reported. In addition, you can enable a full huffman VLC decode, which will help those who are learning about JPEG compression and those who are writing a JPEG decoder.
Other potential uses: determine quality setting used in Photoshop Save As or Save for Web settings, increasing your scanner quality, locating recoverable images / videos, decoding AVI files, examining .THM files, JPEG EXIF thumbnails, extract embedded images in Adobe PDF documents, etc.
Trying to Undelete or Unformat your Photos?
If you're interested in trying to recover your deleted / corrupted photos, check out my new page on recovering deleted photos.
File Types Supported
JPEGsnoop will open and attempt to decode any file that contains an embedded JPEG image, such as:
- .JPG - JPEG Still Photo
- .THM - Thumbnail for RAW Photo / Movie Files
- .AVI* - AVI Movies
- .DNG - Digital Negative RAW Photo
- .CRW, .CR2, .NEF, .ORF, .PEF - RAW Photo
- .MOV* - QuickTime Movies, QTVR (Virtual Reality / 360 Panoramic)
- .PDF - Adobe PDF Documents
* Note that video file formats (such as .AVI and .MOV) are containers, which can include video streams encoded in one of a wide variety of codecs. JPEGsnoop can only interpret this video footage if the codec used is based on Motion JPEG (MJPG).
Download the Latest Version of JPEGsnoop!
Click to Download .ZIP |
Version: 1.6.1 Version History Released: 11/04/2012 Downloads: 304668 |
JPEGsnoop by Calvin HassHelp Support JPEGsnoop DevelopmentIf you have found JPEGsnoop useful and would like to support its continued development, consider making a small contribution. Donations will help encourage me to add new and interesting features. Found an interesting use for the tool? Let me know! |
Source Code: JPEGsnoop is now Open Source!
System RequirementsThis application has been designed and tested to run on Windows XP and Windows Vista, but it should also work for Windows 95/98/NT/2000. JPEGsnoop is fully portable, so it does not require any installation! LINUX users: JPEGsnoop apparently works on LINUX under wine Mac users: JPEGsnoop works within CrossOver Mac Terms of UseJPEGsnoop is free for personal and commerial use. Commercial users are encouraged to leave me a brief message so that I can understand your needs and make future versions more useful. |
InstallationNo installation required. JPEGsnoop is fully portable. Simply unzip the download and run! Version HistoryFor information about features added in previous versions of JPEGsnoop, please check out the version history page. Feature Requests / Bug ReportsPlease feel free to add your own feature requests or bug reports by submitting to the links on the JPEGsnoop Source page |
Awards and Recognition for JPEGsnoop
|
 
|
|
| Main Window |
|---|
|
| Channel Histograms |
|
| MCU Grid & Positioning |
Documentation
Please see the options page for information on how to use JPEGsnoop and other interesting uses for the tool
Recent Features
- Batch file processing
- XMP APP1 & ICC Header display
- GPS EXIF metadata display
- Full detailed Huffman VLC decoding output for those interested in writing a decoder or learning JPEG compression
- Automatic display of YCC DC block values (16-bit)
- MCU Grid overlay and automatic display of mouse MCU position and file offset in image display window.
- Test overlay function enhanced to allow quick apply and binary code readout.
- Image zoom level from 12.5% - 800%.
- Extract embedded JPEGs -- can be used to extract thumbnails, hidden JPEG files, as well as frames from Motion JPEG AVI files.
- Compression detection enhanced to detect rotated signatures, comment field.
- Full AVI file parsing (to identify MotionJPEG)
- DQT table searches in Executables (for "hackers")
- Detect edited images or identify original digital camera that took a photo!
- Integrated database of thousands of compression signatures (image fingerprint) for digital cameras and editing software
- File overlay test function
- Multi-channel preview: RGB, YCC, R/G/B, Y/Cb/Cr
- Pixel position lookup into file offset
- Examine Motion JPEG .AVI or .MOV (Quicktime) files (MJPG or MJPEG) and play through!
- Examine any file fragments that may contain a JPEG image
- YCC to RGB Color correction / clipping statistics reports
- Command-line execution
- Huffman variable-length code statistics
- Expansion of DHT (Huffman Table Expansion into bitstrings)
- Determine IJG JPEG Quality factor
Background Material
If you want to understand some of the technical details reported by JPEGsnoop, I suggest that you read through my articles on JPEG compression:
Suggestions
As this is a work in progress, I would be very interested in hearing from you, particularly for feature requests, suggestions, comments, bug reports, etc. If you currently use JPEGsnoop and find it useful, let me know!
Reader's Comments:
Please leave your comments or suggestions below!I never could get windows7 to open a jpeg with separate scan data sections for each image component (Alex posted an example image in a comment here from may 2011).
My solution was to used jpegtran, available for free nearly unrestricted use, to "optimize" the jpeg without re-encoding and in the process it combines the 3 scan data sections to 1 which makes windows happy.
Thanks again for the great site, i never would have looked for a lossless jpeg optimizer if I hadn't realized that such a thing was possible from reading over your site.
A bonus is the optimized images are combing back about 10% smaller in file size!
Was hoping you could tell me something about images with 3 scan data sections, each with one component of a 3 component image (one Y scan data section and another for each of CR and CB).
I have some images like that that the windows imaging components in windows 7 don't like (so cant open in image viewer, internet explorer, .net programs).
In my case if I isolate any of the 3 sections, (deleting the other 2 with a hex editor) that component will show fine ... but with the 3 together, or some combinations of 2, windows thinks the file is corrupt.
I appreciate that you can't help everyone fix their corrupt jpegs but any insights in the 3 scan images might help me out, thanks a lot
Please, let me know if you can send me these two functions and how much you will charge to do that.
Thank you for your help. Mauro Pacelli
I have recovered thousands of pictures from my hard drive and they are all not working, JPEGsnoop has saved my life but is there an option to export many JPEG's at one time? I can process the batch but just don't know how to export them all at once. Could you help please?
Thanks, Matt
How can I tell WHERE a photo was taken? I understood that the GPS in many cameras will give the location.
Thanks!
Thanks for this great tool!
I have a question about the EXIF decodng in JPEGSnoop. Specifically, I'm trying to figure out why it says the file in question has an "EXIF IFD2" IFD.
http://www.smalleranimals.com/isource/exifouttest.jpg (2K)
As far as I can tell, it doesn't. I've parsed it with our EXIF parser, ImgSource (http://www.smalleranimals.com/isource.htm) . And I've walked through the bytes manually. But I don't see why JPEGsnoop finding that IFD. I can see the data that it _thinks_ is the IFD, but I don't know how or why JPEGsnoop is getting there.
We use JPEGsnoop as a sanity check for our own EXIF processing as well as for JPEG structural analysis, so if there's a bug in our stuff, I'd like to know. And if there's a bug in JPEGsnoop, I assume you'd like to know.
Can you shine any light on this?
[JPEGsnoop output trimmed]
Start Offset: 0x00000000 *** Marker: SOI (xFFD8) *** OFFSET: 0x00000000 *** Marker: APP0 (xFFE0) *** OFFSET: 0x00000002 ... trim ... *** Marker: APP1 (xFFE1) *** OFFSET: 0x00000014 ... trim ... EXIF IFD0 @ Absolute 0x00000026 Dir Length = 0x0009 ... trim ... Offset to Next IFD = 0x000002C3 EXIF IFD1 @ Absolute 0x000002E1 Dir Length = 0x0006 ... trim ... Offset to Next IFD = 0x00000048 EXIF IFD2 @ Absolute 0x00000066 Dir Length = 0x0003 Offset to Next IFD = 0x00020131 EXIF SubIFD @ Absolute 0x000000F6 Dir Length = 0x001B ... trim ...I had a quick look (thanks to baby!) at the file and it appears that the "Offset to Next IFD" at the end of the IFD1 is non-zero (0x48). This is prompting us to advance on to parse another IFD (which auto-increments to IFD2). Is it possible that the "Offset to Next IFD" might be set incorrectly?
I also double-checked this with exiftool. It seems that the exiftool parser also reports that we start processing IFD2.
Hope that helps! Let me know if you want me to debug it further, Cal.
Are there some news regarding the open file dialog and long file names (see 2011-10-29)?
I can't test it, but I think you have to point FileDlg.m_ofn.lpstrFile to a larger buffer and set FileDlg.m_ofn.nMaxFile to the size of the buffer before FileDlg.DoModal() is executed. Or it's lpstrFileTitle and nMaxFileTitle. Should be something along that line.
See an old example here (though that's for selecting multiple files and was written in order to show a limitation in increasing the buffer size - which surely isn't there anymore):
http://support.microsoft.com/kb/179372/en-us
I think, when not setting the buffers, the default size for the whole path is MAX_PATH=260 characters (?), and apparently only 64 characters for the file name.
See also catching a CommDlgExtendedError when the buffer is too small (DoModal returns IDCANCEL).
Maybe all that is also dependent of compiler and/or operating system, don't know. (I have no Visual C++ here, so there's a lot of guessing involved, sorry.)
Thanks!
I'm tryin to write a sw that implements jpeg compression algorithm, but when i scan the file i written with jpegsnoop, it shows this errors:
*** ERROR: Can't find huffman bitstring @ 0x0009815C.6, table 0, value [0xff6267c0]
*** ERROR: Bad huffman code @ 0x0009815C.5
*** ERROR: Bad scan data in MCU(5,72): Lum DC CSS(0,0) @ Offset 0x0009815C.6
MCU located at pixel=(40,576)
*** ERROR: @ 0x00098171.1, num_coeffs>64 [70]
*** ERROR: Bad scan data in MCU(6,72): Lum DC CSS(0,0) @ Offset 0x00098173.5
MCU located at pixel=(48,576)
*** ERROR: Can't find huffman bitstring @ 0x000ED202.6, table 0, value [0xff0b73c0]
*** ERROR: Bad huffman code @ 0x000ED202.5
*** ERROR: Bad scan data in MCU(82,112): Lum DC CSS(0,0) @ Offset 0x000ED202.6
MCU located at pixel=(656,896)
image is http://imageshack.us/f/155/test25072012091052.jpg/
I can't understand where can be the problem, i try a handling decoding with other images with same errors and finding nothing wrong, i really hope you can help
thank you in advice.
Having a look at your sample file, it is very difficult to determine whether the decoding is occurring properly because the image content appears to be random. JPEGsnoop decoder indicates that the Luminance DC component bitstring did not match any of the huffman codes defined in the DHT tables.
I would suggest you run your decoder on a simpler test image first, and then use the Detailed Decode feature of JPEGsnoop to see if the huffman bitstring decoding is operating as expected or not.
Hope that helps and good luck!
The software suggests it was edited in Picasa.
I'm not really all that sure what I'm seeing though.
Can anyone confirm?
http://www.wptv.com/dpp/news/local_news/youreport/Copy_of_colorado-theater-shooting-victims-vigil-angel-woman-says-photo-shows-angel-over-vigil
I would like to suggest 2 features:
1. Error Level Analysis
2. Luminance gradient
seen on: http://www.hackerfactor.com/blog/index.php?/categories/14-Forensics
the scientific paper: http://blackhat.com/presentations/bh-dc-08/Krawetz/Whitepaper/bh-dc-08-krawetz-WP.pdf
These would make your program a complete tool for image forensics.
Can you pls clarify somthing. I ran JPEG snoop and I have been given 2 different dates and times... the first time and date is in EXIF IFD0 section, and the second time is in the EXIF Subifd section, can you please clarify what this means.
Thanks
We require jpeg decoder for windows based application. Actually we require this decoder for video security system software.
we require decoder function that will take Raw jpeg buffer and its size and it will give output buffer in YUV420 format, and its height , width, Y Stride and UV Stride.
if you provide this type of decoder for windows then send us a quotation of it as well demo sample.
waiting for your reply...
I think I've found a bug in JPEGsnoop, I've produced a JFIF file that has 3 different quantization tables (each component Y', Cb, Cr has its own).
*** Marker: SOF0 (Baseline DCT) (xFFC0) ***
OFFSET: 0x000000E3
Frame header length = 17
Precision = 8
Number of Lines = 216
Samples per Line = 256
Image Size = 256 x 216
Raw Image Orientation = Landscape
Number of Img components = 3
Component[1]: ID=0x01, Samp Fac=0x11 (Subsamp 1 x 1), Quant Tbl Sel=0x00 (Lum: Y)
Component[2]: ID=0x02, Samp Fac=0x11 (Subsamp 1 x 1), Quant Tbl Sel=0x01 (Chrom: Cb)
Component[3]: ID=0x03, Samp Fac=0x11 (Subsamp 1 x 1), Quant Tbl Sel=0x02 (Chrom: Cr)
The problem lies in the fact that apparently JPEGsnoop does not use the right quantization table when decoding the Cr component since the resulting picture has practically no resulting red when displayed in RGB (Cr when displayed alone is near medium gray), other decoders display the expected picture.
It can be retrieved here:
http://cryopng.free.fr/sam.jpg
Best regards
Thanks
If you aren't familiar with MxPEG files, they are a high quality compression scheme for motion JPEG recorded by Mobotix surveillance cameras. A single MxPEG file contains multiple JFIF records, each followed with incremental information for subsequent recorded image frames. The manufacturer provides good documentation and a SDK. They also provide an Active Show codec, but no useful tools to work with the files.
Please let me know if you might be interested.
Pete
Great software. I was wondering if you can tell me if JpegSnoop has the ability to determine if the EXIF data has been changed? Ie. if someone changes the dates using an exif editor will that be revealed in the jpegsnoop output. I ran a photo and it said that the "following IJG-based editors also match this signature:" then listed about 8 programs such as GIMP, IrfanView etc. Some of the programs can alter EXIF. The final assessment indicated that the Image was process/edited. Seeing as how the only program that shows up in the EXIF is Microsoft Windows Photo Gallery does this mean that it was processed or edited by that program or one of the 8 editors listed in the jpegsnoop. Microsoft Windows Photo Gallery does not allow for changing of certain EXIF fields such as date and times.
Thanks.
Jpegsnoop is great for certain applications. I am on the LA Superior Court Panel of Experts. Currently I am involved in the Defense of a man facing 27 years to life. The prosecution used Jpegsnoop to validate authenticity of an image. Do you have any comment on this?
Thanks,
Ron
I have been thinking that I can translate your version of JPEGsnoop 1.5.2 to Spanish. If you are agree with my idea, please send me your approval and I will start to it.
thanks for your great piece of software, it helped me a lot to understand how JPEG (de)compression works!
Minor comment: In the "Expanded Form of Codes" section you annotate the "00" code as EOB for both DC and AC which confused me at first, because strictly speaking "00" is not an EOB code when decoding a DC coefficient (it means that the DC coefficient is the same as the last one from the same component but does not necessarily imply that the 63 following AC coefficients are all 0).
Kind regards, Simon
One thing that would make JPEGsnoop even better: accepting long filenames. Is that possible?
On my system (Windows XP), JPEGSnoop loads filenames with up to 64 characters. I have to rename files with more than 64 characters if I want to load them (GUI) - and rename back afterwards. Strangely enough, on the commandline, the longer filenames are accepted by JPEGSnoop. But with the GUI, the filenames get truncated ("file not found"). Or am I the only one that has this (small) problem?
I recovered successfully some pics, using the "image search fwd", but the image recovered is 120k. The original image is 2.5Mb. Maybe I missed any option to get a bigger image recovered?
I used the "Full IDCT" Option
Thank you very much.
However, the file I am referring to IS a jpeg file, not a pdf. Any advice? Alternative options?
I just wanted you to know while using this tool i have encountered an image the tool fails to decode.
It is a Baseline Single Scan JPEG T81 Conformance Image. I have raised the same in the BUG list of Jpeg Snoop at source forge.
Nice tool BTW
-Ram
"this document may be damaged (the file may be truncated or incomplete). Continue?"
but they check ok in JPEGsnoop. Any ideas?
Keep up the great work.
[UPDATE 08/23/2011: Feature almost complete, just testing]
Q: since my picture is straight from a camera not in your DB, does your "tools->add camera to DB" uploads the signature to a server(shared to others immediately/stored for later validation)? or is it only local on my computer?
However, the reason I believe the image is still in spec is because it actually has three (3) scans (you will see three 0xFF 0xDA markers in the file) - one for each component. Your tool seems to only read one scan.
I don't know if you have come across this kind of format before, but I do believe that this is still an acceptable format.
If this is indeed in spec, then it would be cool if the tool supported this format.
Maybe I am wrong, however and this is not an accepted format - unfortunately I cannot change the way this particular hardware encoder works.
In any case, thanks again for the help. I've learned something new!
Alex.
First off, thank you for this great tool!
I'm using your tool to analyze a jpeg generated by a standard hardware encoder. The JPEG file opens properly in Irfanview and other applications. However, your tool reports many errors such as the one below:
Lum (Tbl #0), MCU=[23,0] *** ERROR: Can't find huffman bitstring @ 0x000005A6.4, table 0, value [0xff5a9d80] *** ERROR: Bad huffman code @ 0x000005A6.3 [0x000005A6.3]: ZRL=[ 0] Val=[ 0] Coef=[00= DC] Data=[0x 7F F5 A9 D8 = 0b (---1---- -------- -------- --------)] ERROR *** ERROR: Bad scan data in MCU(23,0): Lum DC CSS(0,1) @ Offset 0x000005A6.4 MCU located at pixel=(368,8)Also, the tool cannot display the image properly.
I have a hard time believing that the image is actually corrupt, as all other applications open it without any errors. Could it be that your application does not account for the particular output of this hardware encoder?
I'm trying to understand what is so peculiar about those JPEG files generated by my hardware encoder.
Here's the image the tool is having trouble with:
http://img39.imageshack.us/i/img0559l.jpg/
Thanks in advance!
Alex.
The issue appears to be that your JPEG file has defined 3 image components in the SOF (Start of Frame) but only 1 image component in the SOS (Start of Scan). This causes the decoder to interpret your image as grayscale (and eventually use the wrong tables) when in fact you have a YCbCr image.
Hope that helps!
I recently lost a hard drive that had some pictures on it that were not backed up. I managed to recover them from the SD card with a program, but the problem is there are a few that were damaged, some that dont even show an image, some that show the thumbnail but not the full size of it. I searched the net thick and thin and this was the only page that seemed to have any in site on repairing corrupt jpegs. If anyone out there can help me or explain how to repair them in jpegsnoop i will be forever grateful.
I have convert a video(avi format) to JPEG format (layer by layer) .
Then i try to scan using JPEGsnoop. The result is
"ASSESSMENT: Class 1 - Image is processed/edited"
Is my way right?
Thanks.
NOTE: Image repair requests are not accepted. Thanks for your understanding.