Return to Digital Photography Articles
JPEGsnoop - JPEG File Decoding Utility
by Calvin Hass © 2010
JPEGsnoop is a free Windows application that examines and decodes the inner details of JPEG and MotionJPEG AVI files. It can also be used to analyze the source of an image to test its authenticity.
Overview
Latest Version: 1.5.2
Introduction
Every digital photo contains a wealth of hidden information -- JPEGsnoop was written to expose these details to those who are curious.
Not only can one determine the various settings that were used in the digital camera in taking the photo (EXIF metadata, IPTC), but one can also extract information that indicates the quality and nature of the JPEG image compression used by the camera in saving the file. Each digical cameras specifies a compression quality levels, many of them wildly different, leading to the fact that some cameras produce far better JPEG images than others.
What can I do?
Check out a few of the many possible uses for JPEGsnoop!
One of the latest features in JPEGsnoop is an internal database that compares an image against a large number of compression signatures. JPEGsnoop reports what digital camera or software was likely used to generate the image. This is extremely useful in determining whether or not a photo has been edited / tampered in any way. If the compression signature matches Photoshop, then you can be pretty sure that the photo is no longer an original! This type of analysis is sometimes referred to as Digital Image Ballistics / Forensics.
JPEGsnoop reports a huge amount of information, including: quantization table matrix (chrominance and luminance), chroma subsampling, estimates JPEG Quality setting, JPEG resolution settings, Huffman tables, EXIF metadata, Makernotes, RGB histograms, etc. Most of the JPEG JFIF markers are reported. In addition, you can enable a full huffman VLC decode, which will help those who are learning about JPEG compression and those who are writing a JPEG decoder.
Other potential uses: determine quality setting used in Photoshop Save As or Save for Web settings, increasing your scanner quality, locating recoverable images / videos, decoding AVI files, examining .THM files, JPEG EXIF thumbnails, extract embedded images in Adobe PDF documents, etc.
Trying to Undelete or Unformat your Photos?
If you're interested in trying to recover your deleted / corrupted photos, check out my new page on recovering deleted photos.
File Types Supported
JPEGsnoop will open and attempt to decode any file that contains an embedded JPEG image, such as:
- .JPG - JPEG Still Photo
- .THM - Thumbnail for RAW Photo / Movie Files
- .AVI* - AVI Movies
- .DNG - Digital Negative RAW Photo
- .CRW, .CR2, .NEF, .ORF, .PEF - RAW Photo
- .MOV* - QuickTime Movies, QTVR (Virtual Reality / 360 Panoramic)
- .PDF - Adobe PDF Documents
* Note that video file formats (such as .AVI and .MOV) are containers, which can include video streams encoded in one of a wide variety of codecs. JPEGsnoop can only interpret this video footage if the codec used is based on Motion JPEG (MJPG).
Download the Latest Version of JPEGsnoop!
Click to Download .ZIP |
Version: 1.5.2 Version History Released: 02/20/2011 Downloads: 217195 |
JPEGsnoop by Calvin HassHelp Support JPEGsnoop DevelopmentIf you have found JPEGsnoop useful and would like to support its continued development, consider making a small contribution. Donations will help encourage me to add new and interesting features. Found an interesting use for the tool? Let me know! |
Source Code: JPEGsnoop is now Open Source!
System RequirementsThis application has been designed and tested to run on Windows XP and Windows Vista, but it should also work for Windows 95/98/NT/2000. JPEGsnoop is fully portable, so it does not require any installation! LINUX users: JPEGsnoop apparently works on LINUX under wine Mac users: JPEGsnoop works within CrossOver Mac Terms of UseJPEGsnoop is free for personal and commerial use. Commercial users are encouraged to leave me a brief message so that I can understand your needs and make future versions more useful. |
InstallationNo installation required. JPEGsnoop is fully portable. Simply unzip the download and run! Version HistoryFor information about features added in previous versions of JPEGsnoop, please check out the version history page. Feature Requests / Bug ReportsPlease feel free to add your own feature requests or bug reports by submitting to the links on the JPEGsnoop Source page |
Awards and Recognition for JPEGsnoop
|
 
|
|
| Main Window |
|---|
|
| Channel Histograms |
|
| MCU Grid & Positioning |
Documentation
Please see the options page for information on how to use JPEGsnoop and other interesting uses for the tool
Recent Features
- Batch file processing
- XMP APP1 & ICC Header display
- GPS EXIF metadata display
- Full detailed Huffman VLC decoding output for those interested in writing a decoder or learning JPEG compression
- Automatic display of YCC DC block values (16-bit)
- MCU Grid overlay and automatic display of mouse MCU position and file offset in image display window.
- Test overlay function enhanced to allow quick apply and binary code readout.
- Image zoom level from 12.5% - 800%.
- Extract embedded JPEGs -- can be used to extract thumbnails, hidden JPEG files, as well as frames from Motion JPEG AVI files.
- Compression detection enhanced to detect rotated signatures, comment field.
- Full AVI file parsing (to identify MotionJPEG)
- DQT table searches in Executables (for "hackers")
- Detect edited images or identify original digital camera that took a photo!
- Integrated database of thousands of compression signatures (image fingerprint) for digital cameras and editing software
- File overlay test function
- Multi-channel preview: RGB, YCC, R/G/B, Y/Cb/Cr
- Pixel position lookup into file offset
- Examine Motion JPEG .AVI or .MOV (Quicktime) files (MJPG or MJPEG) and play through!
- Examine any file fragments that may contain a JPEG image
- YCC to RGB Color correction / clipping statistics reports
- Command-line execution
- Huffman variable-length code statistics
- Expansion of DHT (Huffman Table Expansion into bitstrings)
- Determine IJG JPEG Quality factor
Background Material
If you want to understand some of the technical details reported by JPEGsnoop, I suggest that you read through my articles on JPEG compression:
Suggestions
As this is a work in progress, I would be very interested in hearing from you, particularly for feature requests, suggestions, comments, bug reports, etc. If you currently use JPEGsnoop and find it useful, let me know!
Reader's Comments:
Please leave your comments or suggestions below!Jpegsnoop is great for certain applications. I am on the LA Superior Court Panel of Experts. Currently I am involved in the Defense of a man facing 27 years to life. The prosecution used Jpegsnoop to validate authenticity of an image. Do you have any comment on this?
Thanks,
Ron
I have been thinking that I can translate your version of JPEGsnoop 1.5.2 to Spanish. If you are agree with my idea, please send me your approval and I will start to it.
thanks for your great piece of software, it helped me a lot to understand how JPEG (de)compression works!
Minor comment: In the "Expanded Form of Codes" section you annotate the "00" code as EOB for both DC and AC which confused me at first, because strictly speaking "00" is not an EOB code when decoding a DC coefficient (it means that the DC coefficient is the same as the last one from the same component but does not necessarily imply that the 63 following AC coefficients are all 0).
Kind regards, Simon
One thing that would make JPEGsnoop even better: accepting long filenames. Is that possible?
On my system (Windows XP), JPEGSnoop loads filenames with up to 64 characters. I have to rename files with more than 64 characters if I want to load them (GUI) - and rename back afterwards. Strangely enough, on the commandline, the longer filenames are accepted by JPEGSnoop. But with the GUI, the filenames get truncated ("file not found"). Or am I the only one that has this (small) problem?
I recovered successfully some pics, using the "image search fwd", but the image recovered is 120k. The original image is 2.5Mb. Maybe I missed any option to get a bigger image recovered?
I used the "Full IDCT" Option
Thank you very much.
However, the file I am referring to IS a jpeg file, not a pdf. Any advice? Alternative options?
I just wanted you to know while using this tool i have encountered an image the tool fails to decode.
It is a Baseline Single Scan JPEG T81 Conformance Image. I have raised the same in the BUG list of Jpeg Snoop at source forge.
Nice tool BTW
-Ram
"this document may be damaged (the file may be truncated or incomplete). Continue?"
but they check ok in JPEGsnoop. Any ideas?
Keep up the great work.
[UPDATE 08/23/2011: Feature almost complete, just testing]
Q: since my picture is straight from a camera not in your DB, does your "tools->add camera to DB" uploads the signature to a server(shared to others immediately/stored for later validation)? or is it only local on my computer?
However, the reason I believe the image is still in spec is because it actually has three (3) scans (you will see three 0xFF 0xDA markers in the file) - one for each component. Your tool seems to only read one scan.
I don't know if you have come across this kind of format before, but I do believe that this is still an acceptable format.
If this is indeed in spec, then it would be cool if the tool supported this format.
Maybe I am wrong, however and this is not an accepted format - unfortunately I cannot change the way this particular hardware encoder works.
In any case, thanks again for the help. I've learned something new!
Alex.
First off, thank you for this great tool!
I'm using your tool to analyze a jpeg generated by a standard hardware encoder. The JPEG file opens properly in Irfanview and other applications. However, your tool reports many errors such as the one below:
Lum (Tbl #0), MCU=[23,0] *** ERROR: Can't find huffman bitstring @ 0x000005A6.4, table 0, value [0xff5a9d80] *** ERROR: Bad huffman code @ 0x000005A6.3 [0x000005A6.3]: ZRL=[ 0] Val=[ 0] Coef=[00= DC] Data=[0x 7F F5 A9 D8 = 0b (---1---- -------- -------- --------)] ERROR *** ERROR: Bad scan data in MCU(23,0): Lum DC CSS(0,1) @ Offset 0x000005A6.4 MCU located at pixel=(368,8)Also, the tool cannot display the image properly.
I have a hard time believing that the image is actually corrupt, as all other applications open it without any errors. Could it be that your application does not account for the particular output of this hardware encoder?
I'm trying to understand what is so peculiar about those JPEG files generated by my hardware encoder.
Here's the image the tool is having trouble with:
http://img39.imageshack.us/i/img0559l.jpg/
Thanks in advance!
Alex.
The issue appears to be that your JPEG file has defined 3 image components in the SOF (Start of Frame) but only 1 image component in the SOS (Start of Scan). This causes the decoder to interpret your image as grayscale (and eventually use the wrong tables) when in fact you have a YCbCr image.
Hope that helps!
I recently lost a hard drive that had some pictures on it that were not backed up. I managed to recover them from the SD card with a program, but the problem is there are a few that were damaged, some that dont even show an image, some that show the thumbnail but not the full size of it. I searched the net thick and thin and this was the only page that seemed to have any in site on repairing corrupt jpegs. If anyone out there can help me or explain how to repair them in jpegsnoop i will be forever grateful.
I have convert a video(avi format) to JPEG format (layer by layer) .
Then i try to scan using JPEGsnoop. The result is
"ASSESSMENT: Class 1 - Image is processed/edited"
Is my way right?
Thanks.
First off, Thank you for providing a very informative tutorial.
I have 2 questions.
In chroma sub sampling cases (say 422), in single scan sequential interleaved encoding, in 1 MCU, planes are ordered as YYCbCr. During decoding, I noticed each Y uses the same Cb and Cr.
1 . But is it not more appropriate to replicate Cb and Cr columns to generate an array of size [Y:Y] and reconstruct the image?
2 . Is it mandatory to encode all the time Y, Cb and then Cr. I did not find anything in the specification which talks about plane order. So is it allowed to encode the planes in Cb, Y and then Cr series?
While the JPEG standard does not define the channel usage directly, the JFIF standard (which is what most people refer to when describing "JPEG" images) dictates the YCbCr color space (per CCIR 601) and hence the channel order. As for the chrominance channel replication, I'm not sure I follow your question -- perhaps you can clarify it for me? thx.
Thanks
When using your great tool, I can detect 2 changes in the jpg files and the second one seems to come from Adobe. Do you know something about such an issue, particulary from Photoshop or Bridge that I sometime use ?
Thank you in advance.
LaurentX
Here are the 2 detected modifications with my comment between ():
*** Marker: APP1 (xFFE1) *** OFFSET: 0x00000014 length = 11520 (originaly = 7588) Identifier = [Exif] Identifier TIFF = 0x[4D4D002A 00000008] Endian = Motorola (big) TAG Mark x002A = 0x002A *** Marker: APP1 (xFFE1) *** (did not exist in the original file) OFFSET: 0x00002D16 length = 2503 Identifier = [http://ns.adobe.com/xap/1.0/] XMP = |< ?xpacket begin='' id='W5M0MpCehiHzreSzNTczkc9d'?> |< x:xmpmeta xmlns:x="adobe:ns:meta/"> < rdf:RDF xmlns:rdf="http://www.w3.org/...Altering odd sampling factor for Monochrome.
but I cant open my JPEG file with other applications such as microsoft paint so there's probably something wrong with my program. I'm wondering if anyone can help me with this problem.
Lon
I was working on streaming MJPEG video elementary stream over RTP.
The rules for the this are governed by an RFC - RFC 2435. For packetising the MJPEG video to be compatible with the standard, most of the common JPEG headers are removed from the frame and headers specific to those defined by the RFC are added.
I have found the combined usage of JPEG Snoop and Hex editor have been very effective in helping me implement this feature.
I wanted to know if it is possible to insert some user defined data in the bitstream, data which i would not want the decoder to decode. Such type of data are commonly called USER DATA(in case of ES standards for codecs like H264 and MPEG2).
thanks
EXIF IFD0 @ Absolute 0x00000026 Dir Length = 0x000D [ImageDescription ] = "SONY DSC " [Make ] = "SONY " [Model ] = "DSLR-A100" --- (trim) --- [ExifOffset ] = @ 0x018E [GPSOffset ] = @ 0x0434 Offset to Next IFD = 0x000004C6 EXIF GPSIFD @ Absolute 0x00000452 Dir Length = 0x0007 [GPSVersionID ] = 0.0.2.2 [GPSLatitudeRef ] = "S" [GPSLatitude ] = 33 deg 56' 0.000" [GPSLongitudeRef ] = "E" [GPSLongitude ] = 19 deg 9' 0.000" [GPSAltitudeRef ] = Above Sea Level [GPSTimeStamp ] = 0/1The above was decoded from a sample image available on Wikipedia. You'll see that the location is reported as latitude, longitude and even altitude, which makes it easy to locate!
thank you
I would like to ask if there is an explanation why when we use the tool: Image Search Fwd, it correct the corrupted images, but the result images are in the thumbnail sizes, not full size?
Many thanks in advance.
RGB histogram in DC (before clip): R component histo: [min= 0 max= 184 avg= 117.9] G component histo: [min= 0 max= 255 avg= 180.3] B component histo: [min= 0 max= 279 avg= 176.3] RGB clipping in DC: R component: [<0= 0] [>255= 0] G component: [<0= 0] [>255= 0] B component: [<0= 0] [>255= 0] RGB histogram in DC (after clip): R component histo: [min= 0 max= 184 avg= 117.9] G component histo: [min= 0 max= 255 avg= 180.3] B component histo: [min= 0 max= 255 avg= 175.4]{oh, and JPEG Snoop is awesome! It's a great complement to Pennebaker & Mitchell's book}Also check out this image this image which has horrible YCC DC overflow errors, reported at http://stackoverflow.com/questions/3937885/cross-browser-incompatibilities-in-decoding-jpeg-files/5035591#5035591
I've noticed a LOT of images have minor clipping in RGB and a good number (including thirteen13.jpg) have luma clipping. I intend to add some prints to the iDCT code to see how the math actually works out to make that happen, but it's quite surprising. Images from the IJG encoder don't seem to overflow in the Y'CbCr space, but bright Pixelmator images do.
Thanks for your work on JPEGSnoop and your writing at impulseadventure. I never would have understood how the Huffman tables work without your writeup. Also, thanks for open sourcing JPEGSnoop. I plan to port it for Mac OS X, first as a command-line tool with gnu make (not an Xcode project) so it can build for Unix too.
I might make a generic UI interface for file picking and option selection in and histogram and display out. What do you think?
Regards, Morgan
Porting JPEGsnoop to LINUX and/or Mac would be fantastic as there are a large number of people who have been asking for it. Let me know if you (or anyone else interested in helping with a port) need any pointers.
Thanks!
For the last year or so, myself and several of my staff have been using your tool to identify screenshots from a video game to effectively catch and incriminate hackers. We were fortunate enough to have a game that outputted its screenshots into a folder in which the user can retrieve, upload and send to us with ease. The game engine creates a unique signature allowing us to tell what is and what is not a genuine image being sent into us. We pride ourselves with our accuracy of reports and your tool allows us to keep the edited images out.
We would love to take this to the next step but I would really like to talk to you in a more private atmosphere. I have included my email in this comment, if you would be so kind to respond back via email it would be greatly appreciated.
Thank you for your time and your fantastic tool!
Josh
When printing "DCT Matrix =[...], DC coefficient of each matrix is shown as (Diff), and should both (Diff + DC) preceding matrix.
Thanks again!
Firstly, great job with JPEGsnoop, it was able to access a lot of information in some pictures that I wasn't able to before. It is really a nifty program, and even was able to correctly name my camera, although it didn't fully recognize it.
However, I do have one issue. I have several hundred pictures that I am combing through, as it seems the end half of a memory card has been saving bad pictures. I was wondering if there was some way to mass-batch these pictures into automatically loading, scanning forward for the JPEG marker, and then exporting them as a new, corrected JPEG file, either with JPEGsnoop or another program? I'm trying to save the time of going through each one, but so far I haven't found a program that can do it all at once. Any help would be appreciated!
I encountered a problem trying to open a jpg file that was in a directory that had a European font.
I went to the Microsoft web page to download Windows 7 themes, which include jpg files:
http://windows.microsoft.com/en-GB/windows/downloads/personalize/themes
I download the theme "Czech Spring", and installed it.
The jpg files were copied to a directory on my PC: C:UsersMyUserNameAppDataLocalMicrosoftWindowsThemesCeské jarDesktopBackground
Note: "Ceské jar" has a "u-shaped" punctuation over the "C".
JPEGsnoop couldn't open the file, and instead displayed an error message:
"C:UsersMyUserNameAppDataLocalMicrosoftWindowsThemesCeské jarDesktopBackgroundcz-olwp22.jpg contains an invalid path."
Photoshop CS5 can open the file.
When I moved the file to another directory, JPEGsnoop could open it.
Also when I changed the directory name by deleting the strange "C", JPEGsnoop was able to open the file.
I'm not sure if this is a bug in JPEGsnoop, but it does present a minor difficulty for users.
I have some corrupted images and I've found I can manually recover many of them by using this command. However it would take quite a while to manually go through all of them. In fact sometimes there are multiple images (or parts of images) in one file. It would be really useful if the batch process could search the entire file for all possible images to extract.
Thanks for the great app.
I tried to open a jpg-file and got this error:
"not enough Marker MCU Map memory for current image size"
The image is 7516x5476px. It was scanned by some agency and i need to extract the compression level - which will be gone when resizing it with e.g. IrfanView.
What should I do?
Best,
Matz
I have a question. Apologies if this is the wrong place to ask.
Is it possible to know the size of the jpeg file from the headers itself (without using the file system metadata)?
Thanks
Hopefully I have solved the problem of source code being lost for good :)
You should be able to locate the SVN Source Code repository at the link given on JPEGsnoop source, but I have now also added a link there to the web-based source browser which avoids the need to set up an SVN client.
I want to download jpegsnoop but I'm having trouble, when I click on "Click to download zip". After a long delay it just opens up a page of character codes.
I've had someone else at a different location/pc and they get the same result.
Thank you.
I have a question:
is there a way to figure out the file size of the jpeg image from the metadata, without relying on file system information from the OS?
Thanks.
Creates directory...
C:Documents and SettingsOwnerApplication DataJPEGsnoop
Creates several registry entries under...
HKEY_CURRENT_USERSoftwareImpulseAdventure
Is there a way that setting could be stored in an INI file in the app directory??
Thanks.
Allow me to describe what brought me to look at this product, maybe someone suggest what I should do next.
I have a webcam that takes a picture every hour 365 days a year, I want to string them together into a mini film.
Unfortunately the variety in light levels makes for an unpleasant epileptic experience.
I though I would look for program that would help me sort the photos according to luminescence/contrast to help me select a sequence.
I am currently surmising that if I could output some key facts about the histogram for each jpg to a file then I could sort out the rest in Excel or something.
Given a luminescence estimate for each file I could easily update one of the xtended property fields such as title which means I could sort the thumbnails in Windows Explorer.
Does the batch mode of this program get be close to doing this?
What do you think?
NOTE: Image repair requests are not accepted. Thanks for your understanding.