Tell me more ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.
up vote 4 down vote favorite

I have a file jpeg which has been probably modified using DOS copy /b command. Is there any software that can detect which part has been appended?

I'd like to filter out the image part, so I can take a look at the rest of the file.

share|improve this question
1  
Doesn't the JPEG format have a standard header? You could probably search for that header in the body of the file using a hex editor, and truncate everything from there forwards. – Randolph West Jan 21 '11 at 0:00
@Randolph Potter It does, but that's the catch. The header is, as its name says, at the start of the file. I have data hidden in a .jpg, so the header is at the beginning and at some point the interesting data starts. That's why it looks just like normal jpeg to the OS. Is there a standard footer which I could look for? – AndrejaKo Jan 21 '11 at 0:11
en.wikipedia.org/wiki/JPEG says there is an EOF marker. Check it out. – Randolph West Jan 21 '11 at 0:15
@Randolph Potter Jpeg has a standard header which is FF D8 FF. There's some more info about it here. The footer is FF D9. If you post your comment as an answer, I'll give you an up-vote. – AndrejaKo Jan 21 '11 at 0:18
@Mike beat me to it. I've upvoted him. – Randolph West Jan 21 '11 at 0:19

2 Answers

up vote 2 down vote accepted

I found an interesting program. It's called StegSecret and it can do what I need. It's under GPLv3, so it's free software. Unfortunately, it's only on Spanish, but the interface is easy enough to figure out.

share|improve this answer
2  
Now all we need is rosettastone to learn spanish. ;-) – Moab Jan 21 '11 at 3:53
up vote 6 down vote

Fire up a hex editor and look for the JPEG End Of Image (EOI) marker (0xFF, 0xD9).

Note: It can occur more than once in a JPEG file (eg once at the end of the thumbnail and again at the end of the main image) and there is always the chance it occurs in the appended data you're looking for.

share|improve this answer
Well, right after FF D9, I found 52 61 72 21 1A 07 00, so it's a .rar. I'll keep this question open for a while longer, just in case somebody gives the answer I was looking for. Still, thanks a lot. – AndrejaKo Jan 21 '11 at 0:30

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.