Return to Digital Photography Articles
JPEGsnoop - Options
This page details some of the main options you'll find in JPEGsnoop
Return to JPEGsnoop Main Page
Documentation
JPEGsnoop is very easy to use... quite simply:
Steps to Process a File
- Select the decoding options under Options->
- Open your JPEG file with File->Open...
- Save the output with File->Save Log... if desired
Alternately, you can drag-and-drop a JPEG file onto the JPEGsnoop icon or main window and have the report automatically generated. Opening a JPEG file will automatically start the decoding process and generation of the log file.

Decoding Options
There are several options you can enable in decoding the JPEG file. These display additional information about the JPEG file. If the Auto Reprocess option in the Configuration window is disabled, then any changes to the Options below will not be reflected in the log until either a new file is opened, or you manually File->Reprocess.
- Hide unknown EXIF tags - This option will turn off decoding of EXIF tags that are not currently known in JPEGsnoop's database.
- DHT Expand - Expands the JFIF Huffman code table into the actual list of variable-length binary strings that are searched during the decoding process. This is a much more human-readable form of the huffman code list.
- Scan Segment - Decode Image - This option turns on the real decoding of the Scan data segment. In doing so, several checks are performed to ensure that all the variable length codes are valid and that there is no data corruption. It also performs the color conversion step from YCC to RGB and reports any color channel clipping.
- Scan Segment - Histogram RGB - If Decode Image is enabled, the Histogram RGB option will show a histogram for the RGB components, in addition to the reporting of any YCC/RGB clipping. Note that this option slows down the color conversion process (and is off by default).
- Scan Segment - Histogram Y - If Decode Image and Histogram RGB options are enabled, the Histogram Y option will show a histogram depicting the luminance (Y) DC component of the image. In addition, a full 2048-bin histogram dump is written to the log file. This dump shows the number of MCUs (8x8 pixel blocks) that exist in the (DC) image for each intensity level (-1024 to +1023). Counts are written in hexadecimal notation.
- Scan Segment - Full IDCT - When this option is enabled, the scan decode process does a full IDCT (Inverse Discrete Cosine Transform) to generate the high-resolution image view. Both the DC and AC coefficients of each MCU is computed. This mode is computation-intensive and can be slow.
- Scan Segment - No IDCT - When this option is enabled, the scan decode process does not do IDCT, and can produces a low-resolution image view. Only the DC coefficients of each MCU is computed. This mode is much faster than the IDCT mode but the result is low-res and less accurate. Default mode of operation.
- Scan Segment - Scan Dump - Enabling this option dumps out the first 640 bytes of scan data (in the Start of Scan (SOS) segment) in hexadecimal, after byte stuffing has been handled.
- Scan Segment - Detailed Decode... - Use this option to dump out detailed info about the Huffman VLC (variable-length codes) that make up the Scan bitstream. This is extremely useful for those who are trying to understand JPEG compression at a low level or build their own encoder/decoder. A dialog box will ask you for a starting MCU coordinates and MCU length. Prior to entering the dialog box, you can mouse-over or click in the area of the image that you want to start decode, and take note of the MCU X & Y coords. Enter these values into the dialog and then hit Reprocess or Open a new file to see the results. The detailed decode is included in the Start of Scan segment in the log.
Note: The DC component shown in each DCT matrix is the DC contribution from the current block -- it does not represent the running DC total (ie. the inverse DPCM step). - Maker Notes - Decode the Maker Note section (manufacturer-specific data) if it is a make supported by JPEGsnoop. As some cameras store a lot of unknown data in this section, you may want to disable it to avoid clutter.
- Configuration - Opens a window where you can set a number of additional options. Please see the Configuration Window section below.
- Check for Updates - This will manually check the ImpulseAdventure.com website for newer releases of JPEGsnoop.
Note that the image and histograms are only displayed if Decode Scan Image is enabled.
Tools Menu

- Image Search Fwd - Searches in the most recently opened file from the current file position forwards, looking for the next potential embedded JPEG image. This command is searching for the SOI (Start of Image 0xFFD8) marker, and may encounter the occasional false positive.
- Image Search Rev - Same as SOI Search Fwd, but in the reverse direction.
- Lookup MCU Offset... - Enter a pixel coordinate, press Recalc and determine the file offset to the start of the MCU! This is extremely useful for locating sections of a corrupt JPEG. Note that offsets are provided in the format: 0x<byte position in hex> : <bit position> . In other words 0x0000C832:4 means that the MCU starts at file position 0xC832 (or 51250) bytes, at the 4th bit (from the most significant bit). The MCU positioning is also displayed automatically in the lower image window's status bar when the mouse moves across the image window.
- File Overlay... - NOTE: This function will be described in greater detail in a later release, but it can be used a number of different ways, including the ability to fix corrupt JPEG files. Enter a file position offset, click Load Original (to see the current value) and then have the ability to overwrite these values with new hex values (no spaces between bytes). Click on the Enabled checkbox to have this overlay used for further decodes, or uncheck it to disable it. Specify the number of bytes to overwrite (up to 8).
- Search Executable for DQT - Allows advanced users to identify compression quality tables within an executable or library. For more imformation, please see the section in the Interesting Uses page.
- Export JPEG - Attempts to export the JPEG image that has been decoded at the current file offset (e.g. after Image Search or File Offset). This can be used to extract JPEG thumbnail images, extract AVI MJPEG frames, etc. The user will be presented with a dialog that asks whether or not the default MJPEG DHT tables should be inserted (for AVI frame export) and whether or not any user-defined file overlays will be used to generate the output.
- Add Camera / SW to DB... - Add the compression signature of the image to the database! This shared database is used to determine what digital camera (or photo software) was used to create the image. The database is growing and will be constantly updated by other JPEGsnoop users. Please only add a camera compression signature to the database if you are reasonably sure that the image is direct from the camera (i.e. not processed or edited in any way) or processed from a known software program. When submitting the compression signature, absolutely no image content or EXIF data is recorded -- only the compression statistics and quality setting.
- Manage Local DB If you want to clear out the user database (for example, if you have added incorrectly-described signatures), or simply remove a single entry, this option will bring up a dialog box that lets you delete one or more entries.
Note that you can hold down the control-key shortcuts (Ctrl-2 or Ctrl-1), which will step through a file at high speed. For MotionJPEG AVI files, this will play the video while decoding the tables and histogram!
View Menu
- Image Chan - Select the channel to display in the image area. You can select full-color RGB or YCC in addition to the individual sub-channels: R/G/B or Y/Cb/Cr.
- Image Zoom - Selects the zoom level in displaying the DC component image. At 12.5%, each 8x8 pixel block is represented by a single pixel. At 800%, each image pixel is represented by an 8x8 pixel region.
- Overlays - MCU Grid - Toggles the display of the MCU grid. The grid marks the MCU boundaries in the image, according to the current chroma subsampling levels. Pressing Ctrl-G will toggle the display of the grid. Note that the grid is automatically hidden when the zoom level is less than 100%.

File Menu
- Offset... - Allows you to specify a starting offset for the JPEG decoding process. In the dialog, the default is for entry in hexadecimal notation, but you can click on the decimal radio button to convert.
- Reprocess - Reloads the last file and reprocesses the image with the current set of configured options. Note that this is not necessary if the Auto Reprocess option under Configuration is enabled.
- Print - Standard printing support for the main report window.
Command Line Invocation
As requested by some users, command-line execution is supported. You can enable most options from the command line and generate the unlimited output file automatically. Example:
JPEGsnoop.exe -i c:\temp\20050203_1234.jpg -o c:\temp\20050203_1234_snoop.txt -nogui
The above will open up the JPEG file located at c:\temp\20050203_1234.jpg, write out to the log file c:\temp\20050203_1234_snoop.txt and do this without bringing up the GUI (application window).
Other options include:
- -help - Display command-line help
- -i fname - Opens JPEG file named fname for processing
- -b dir - Batch process directory dir
- -br dir - Batch process directory dir recursively
- -o fname - Opens text file named fname for the generated output log file
- -ext_all - Extract all from file
- -ext_dht_avi - Force insert DHT for AVI (-ext_all mode)
- -scan - Enables Scan Parse mode
- -maker - Enables Makernote decode
- -scandump - Enables Scan Dump mode
- -histo_y - Enables Luminance Histogram Dump mode
- -dhtexp - Enables DHT Expand mode
- -exif_hide_unk - Disables decoding of unknown makernotes
- -offset_start - Decode at start of file
- -offset_srch1 - Decode at 1st SOI found in file
- -offset_srch2 - Decode at 1st SOI found after start of file
- -offset_pos pos - Starts decoding at byte offset pos (in decimal)
- -done - Indicate when operations done
Reader's Comments:
Please leave your comments or suggestions below!Please help...
Say I've got directory X and it's subfolders. If I wanted to extract all from all files into folder Y without the logs, how would I do that?
I've tried a variety of things, but I would have thought something along these lines would have worked:
JPEGsnoop.exe -br C:\X C:\Y -ext_all
But I get a message saying that "Access to C:\Y was denied.
I've got about 100,000 photos to go through... Augh!!! This would make life so much easier!
I should point out as well, that under no circumstances can I get the "-nogui" command to work. It errors every time and says:
"ERROR: Unknown command-line flag [-nogui]
Thanks in advance! I definitely appreciate your work. If this does the trick, I'll be sending you some cash ;)
Fraser
For the command-line batch mode with "extract all" option, JPEGsnoop will write the extracted files into the same directory as the originals but with a suffix like ".export.000001.jpg". The "access denied" error is given because the "-br" option only takes a single directory parameter (the "C:\Y" would therefore be invalid). At this time one can't dictate a separate directory for the batch extract output, but it would be a reasonable feature to add (to the DoExtractEmbeddedJPEG function).
As for the "-nogui" option, that parameter is no longer necessary as of JPEGsnoop 1.7.5 and was removed. Batch operations from command line automatically disable the GUI now. I see that the JPEGsnoop options web page still lists this, so I will update it. Thanks!
Hope that helps & good luck!
I'm using Snoop to help debug a JPEG core I'm verifiying. I've started with a very simple 16x8 checker image (8x8 black, 8x8 white). When I run your program, the quantization tables shown in Snoop are different from the ones I parse out when running:
xxd -i small_rect.jpg small_rect_i.txt
I'm wondering are you using default quantization tables or are you extracting them from the JPEG image?
Thanks!
EDIT: Discovered through later emails that the xxd was not performing the zig-zag reordering in the dump hence the observed differences.
Thanks
When I use Options -> Scan Image -> Detailed Decode, I am getting the DCT Matrices. However, there are multiple DCT matrices for luminance for each MCU. I expected one luminance matrix per MCU Can you explain this to me?
I want to use JpegSnoop to figure out how my jpegtran'd pictures are different from what I get from ImageOptim
So, I want to dissect each image and then do some kind of diff.
So, there is 2 ways
A - jpegsnoop deletes corrupted file
B - jpegsnoop tells just error code, and file is deleted by other code.
Thank you!
However, you can probably automate the preservation of the original EXIF metadata from your NEF files to the exported JPEGs with exiftool in a script. Though I haven't tried it with NEF files, it might be possible to use exiftool to copy the metadata from the NEF file to the JPEG file with a command like the following:
If this works (please test in a copy of your directory!), then you might be able to wrap the above command in a shell script that searches through your directory for files to apply the above command to. The following hasn't been tested, but could be close to what you need:
Good luck!
I think JPEGsnoop is a great program. The Command Line option could be very useful for a school project.
I would like to use JPEGsnoop in Command Line Mode to get a Luminance Histogram Dump from a Canon CR2 RAW-files like this one: http://www.rawsamples.ch/raws/canon/RAW_CANON_EOS_1DX.CR2
If I use this command "JPEGsnoop.exe -i c:\temp\canon\RAW_CANON_1DSM3.CR2 -o c:\temp\canon\RAW_CANON_1DSM3.txt -histo_y" JPEGsnoop tells me "File did not start with JPEG marker. Consider using [Tools->Img Search Fwd] to locate embedded JPEG."
By doing this [Tools->Img Search Fwd] I can locate the offset of the embedded JPEG in the LOG: "Start Offset: 0x00008F4C"
If I then use this position in the Command-Line like this : "JPEGsnoop.exe -i c:\temp\canon\RAW_CANON_1DSM3.CR2 -o c:\temp\canon\RAW_CANON_1DSM3.txt -histo_y -offset_pos 36684" JPEGsnoop will create a LOG, but no Luminance Histogram is present in the LOG file.
Can you tell me what I am doing wrong?
Thanks,
Alex
Start Offset: 0x00000000
NOTE: File did not start with JPEG marker. Consider using [Tools->Img Search Fwd] to locate embedded JPEG.
So I followed the instructions and it said this:
No SOI markers found in forward search.
Any other ideas of how to fix this image?
Scanning these files leads to a program hang on jpegsnoop.
is there a just to find corrupt files and deleted them? maybe in a secure manner to avoid program stops?
when i use
jpegsnoop.exe file.jpg -nogui -ext_all
dialog ask when i chose yes its stock and always error
and when i choose no same think happen and if click cancel its ok.
and with gui
jpegsnoop.exe file.jpg -ext_all
all options yes,no, cancel go to loop of error
also some of pictures show dialog
do you want to continue decoding?
request add option to chose through cmd [argument] yes no
because i use it through batch cmd to extract many files and this stop to choose yes or no
i use extract_preview but its slow
thanks for your effort.
"Couldn't find User Signature Database
[C:\Users\username\AppData\Roaming\JPEGsnoop\JPEGsnoop_db.dat contains an incorrect path.]
Creating default"
and
Couldn't open file: [C:\Users\username\AppData\Roaming\JPEGsnoop\JPEGsnoop_db.dat contains an incorrect path.]
mean? There is no such directory.
I have one doubt that why standard software like MS-Paint, etc. change their huffman tables for different images. What I am trying to say is that, I took some images and saved them as .jpg files using MS-Paint. Then I examined each of those images using JPEGsnoop. The huffman tables displayed by JPEGsnoop were different for those images. Are these huffman tables static or do they change according to the content of the image (i.e. pixel values of image).
Can you please make this doubt clear and elaborate little more on Huffman coding tables.
Thanks in advance.
I have corrupted jpegs where some part of image scan is missed. I don't know the size of missed data but it is always multiple of 32 bits. All markers are present in the code but restart markers aren't used in this standard.
Can I somehow reveal the size of missed part and its position in the code?
Your program will get me there, but not without getting the "File did not start with JPEG marker" error every time, in which case I have to manually use the "IMG Search Forward" option every time. This gets me to a point where I can export the image needed, and that's great. However, I need to be able to do this full auto from the command line. When I try your command line options on my files, they all choke on the "not a jpg marker" thing.
I have explored the command line options, and they do not include the ability to "force" the "Img search forward" option (like it apparently does in the batch processing feature), or the ability to output a resulting JPG to a location (only the log file). I can't use the batch processing option in case you are wondering for multiple reasons, the main one being we have literally thousands of these images all randomly stuck together in folders with GUID type names and new ones come in all the time. We only need to access some of these photos some of the time, so I want to process them on an individual basis as need to view/print them arises with an automated process from the command line that we can then integrate into our own application processes using PHP and other scripts where we essentially just need to hand the command a file location, and then we are staring at its image.
I'm sure this is a tall order and I'm not sure you'll want to do anything about or whatever, but at the top you do ask for suggestions, so I thought I'd take a shot in the dark.
Thanks for your time.
This is superb program and a livesaver for me! I have almost 2000 photo's which are somewhat corrupt. I want to use the "extract all JPEGs" within a batch processing but it seems that this command line is not supported. Do you think it is possible to add this because it would save me a lot of time doing this automatically?
JPEGRepair tool gives me InvalidFile and fails to repair them so I'm a bit stuck here. I've got no previous versions of these files. I just want to confirm that they indeed get corrupted while copied to my NAS or on the NAS itself to decide what to do next.
Although it doesn't help now, it may be worth looking into other backup software that can retain multiple versions (ie. rollback capability) as it could help prevent these types of unfortunate scenarios.
Is there an option to dump the DCT Matrix (before IDCT) for all the MCUs in the picture? I'm particularly interested in calculating the % of non-zero coefficients in the picture.
Thanks,
Raghu
- Options -> Scan Segment -> Decode Image (enable)
- Options -> Scan Segment -> Detailed Decode...
- - Set # MCUs to a large enough number to cover many of the MCUs
- File -> Reprocess File
Unfortunately you'll find that the report becomes too large to get an accurate view of the entire image's DCT matrices.
Thanks!
jhead -st "thumb/&i" *jpg
..'reason I ask is that I've since been able to recover the .jpg files in question, which BTW numbered on the order of 20+.
But Calvin, if you're interested in investigating this, let me know, I'll forward you at least one of the files to examine. Also, note, I am not seeing your eMail address however I did disclose mine this time.
I'm trying to recompile the source code with visual studio 2012 Ultimate Edition. However, I receive a couple of of problems about compatibility. In which environment did you compile Jpegsnoop 1.6.1 ? Operating system, x86 or x64, visual studio version?
I am trying to extract the exif data of thousands of files in batch processing. But, some files raise error message and I have to re-run the batch processing. I will suppress the message box in the source code.
Big Thanks
is it possible to run 'extract all jpgs' from a command line? i'd like to batch run that command on all 500 of my corrupt photos. thanks
i expected to get some negative values for some of the coefficients but jpeg snoop gave me all positive integer values .
So when i plotted the histogram , i did not get the expected gaussian histogram shape. please help.
i need it for a class i teach :)
Hope that helps!
I have over 200 images from a trip to Rio de Janeiro Brazil that I CANNOT lose. Someone please help?
Firstly congrats on the baby; I hope that you're not having too many sleepless nights (I'm a dad of one ;)).
It's unfortunate (for me) that I've stumbled across this program after a major catastrophe with a CF card and my daughters birthday. I'm trying to repair the saved files (which of course are corrupted >( ). I have 2 questions for you: Firstly when JPEG snoop cycles through the files and comes up with a message e.g. Expected marker 0xFF, got 0xDB @ offset 0x0000D1B5, how do I interpret that location in a hex editor? And could you explain it for someone who is a complete newbie to this side of photography and understands the basics (very basics) of programming.
The second question is if the beta version still requires a novice tester would you be willing to let me loose on a copy of it?
Thanks in advance
Greetings from Vienna/Austria.
PS: A baby? Grats :)
Thanks!
THanks
I'm looking for version 1.5.3 you mentioned below, which supports the option to extract all embedded images and rename sequentially, but on your website I find only 1.5.2. Where can I find this version?
Thanks for this great software!
I want to know how to detect if a picture has been retouched.
thank you
"Perhaps the option would extract all embedded images and rename sequentially"
Yes !! Please implement this. I will personally pay pal you $20 for this addition.
I specifically wish to extract all frames of a corrupted mjpeg video file from a recovered image of a corrupted SD card. It works one by one but would take me forever to extract all frames of my video.
Note: please ensure the names are 8 digits or more ie. 00000001.jpg
Thanks and keep up the awesome work !!
[UPDATE 08/25/2011: This feature has been added to release 1.5.3 of JPEGsnoop!]
How does one indentify the date the photo was taken; where does it appear in the meta data? Thanks.
Could you point me in the right direction as to how this works?
i m doing a project on steganalysis of jpeg images using huffman bit code length statitistics. For all the diff. same resolutionstego images i m getting same huffman table. i hv used the LSB steganography algo. Please help me in analyzing HBCL statistics....
I have four corrupt photos, and the lower 3/4 of each picture is solid grey.
When I load them up in JPEGSnoop, the pictures are still 3/4 grey until I run 'Tools > Image Search FWD', then the whole image is displayed but is massively reduced in size.
Is there any way of preventing this downsizing of my image? I am VERY impressed that JPEGSnoop has managed to recover the missing sections of my images, but I would be even more impressed if I could keep them at their correct size.
Is this possible? Any advice would be greatly appreciated.
Thanks.
I'd like to use JPEGsnoop in batch mode for WinXp sp3 like here:
for %%f in (*.jpg) do jpegsnoop.exe -i %f -o %f.log -nogui -scan
with additional batch option for Image Search Fwd.
ur website is very useful for developing softwares working with images.thx a lot...
i think i finally solved the subsampling stage. i duplicate the values in pixel 0,0 to the 2x2 area vertically and horizontally. i read in your articles in jpeg huffman coding on the DCT to RGB section. you said that there is a gain of DCT transform. how do i know the gain of dct transform? is this information provided by jpegsnoop?
i am doing a project to decode JPEG files. i did all correct untill the quantization stage. i compare the values i get with the values decoded by jpegsnoop. but i dont know about the idct stage, coz jpegsnoop doesnt show the results of the idct stage.
i realized that before doing the idct stage, i need to do something about the chroma subsampling involving the Cb and Cr blocks. how do you make the 8x8 block of Cb and Cr into 16x16??
A question: Can I delete some data from the jpg like all "Photoshop" tags?
Thank you for this great tool!
Toddie
I really enjoy your site and insight. I was wondering if you could program a software that detects broken JPEGs in a multiple folders (recursive) much like this Japanese program I found from 90s: http://jpeg-checker.jp.brothersoft.com/download/ - The company making this software (Mity Software) quit and this is the only download link I was able to uncover.
You basically give this software a folder to start with and it runs through every single image in that folder and its subfolders and creates a neat sortable report on which images are missing EOF markers or have any other problems.
I work with hundreds of thousands of photos at an agency and that kind of a software can really come in handy for us and I'm sure others dealing with as many photos as we do. Sadly the Japanese software JPEG Checker is extremely old (and I don't know Japanese) so I go through it through intuition for the most part.
Please let me know if you would be interested in overtaking such a project.
NOTE: Image repair requests are not accepted. Thanks for your understanding.