I'm trying to find out what is a good way to detect whether an image file has other files hidden inside it?
- Hide files inside of JPEG images at lifehacker
Method via ImageMagick/convert tool
Use ImageMagick command tool
convert to find the differences between the original file and converted one. E.g.
$ convert original.jpg converted.jpg # this is an ImageMagick command $ ls -l original.jpg converted.jpg 667228 original.jpg 648515 converted.jpg
Then you can compare the binary file, see: How do I compare binary files in Linux?
Method via strings
Look for any suspicious content via
strings. It will print any printable strings in a file which could indicate some hidden files, messages or content. E.g.:
$ strings -10 image.jpg
Method via hexdump
Every JPEG file starts by SOI (Start of image) with binary value of
0xFFD8 and it is terminated by EOI Marker (End of image) which has the binary value of
Therefore you may try to check for any extra content after EOI marker. In example:
hexdump -C image.jpg | less +/"ff d9" hexdump -C image.jpg | more +/"ff d9"
Method via xdd
xdd command-line based tool with
sed to print the content after EOI Marker.
xxd -c1 -p image.jpg | tr "\n" " " | sed -n -e 's/.*\( ff d9 \)\(.*\).*/\2/p' | xxd -r -p
Read more: How to dump part of binary file at SE