Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I have a file jpeg which has been probably modified using DOS copy /b command. Is there any software that can detect which part has been appended?

I'd like to filter out the image part, so I can take a look at the rest of the file.

share|improve this question

closed as off-topic by Excellll, Mokubai Sep 10 at 21:19

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Questions seeking product, service, or learning material recommendations are off-topic because they become outdated quickly and attract opinion-based answers. Instead, describe your situation and the specific problem you're trying to solve. Share your research. Here are a few suggestions on how to properly ask this type of question." – Excellll, Mokubai
If this question can be reworded to fit the rules in the help center, please edit the question.

Doesn't the JPEG format have a standard header? You could probably search for that header in the body of the file using a hex editor, and truncate everything from there forwards. –  user3463 Jan 21 '11 at 0:00
@Randolph Potter It does, but that's the catch. The header is, as its name says, at the start of the file. I have data hidden in a .jpg, so the header is at the beginning and at some point the interesting data starts. That's why it looks just like normal jpeg to the OS. Is there a standard footer which I could look for? –  AndrejaKo Jan 21 '11 at 0:11
en.wikipedia.org/wiki/JPEG says there is an EOF marker. Check it out. –  user3463 Jan 21 '11 at 0:15
@Randolph Potter Jpeg has a standard header which is FF D8 FF. There's some more info about it here. The footer is FF D9. If you post your comment as an answer, I'll give you an up-vote. –  AndrejaKo Jan 21 '11 at 0:18
@Mike beat me to it. I've upvoted him. –  user3463 Jan 21 '11 at 0:19

2 Answers 2

Fire up a hex editor and look for the JPEG End Of Image (EOI) marker (0xFF, 0xD9).

Note: It can occur more than once in a JPEG file (eg once at the end of the thumbnail and again at the end of the main image) and there is always the chance it occurs in the appended data you're looking for.

share|improve this answer
Well, right after FF D9, I found 52 61 72 21 1A 07 00, so it's a .rar. I'll keep this question open for a while longer, just in case somebody gives the answer I was looking for. Still, thanks a lot. –  AndrejaKo Jan 21 '11 at 0:30
up vote 2 down vote accepted

I found an interesting program. It's called StegSecret and it can do what I need. It's under GPLv3, so it's free software. Unfortunately, it's only on Spanish, but the interface is easy enough to figure out.

share|improve this answer
Now all we need is rosettastone to learn spanish. ;-) –  Moab Jan 21 '11 at 3:53

Not the answer you're looking for? Browse other questions tagged or ask your own question.