What happend? HELP

Started Sep 10, 2004 | Discussions thread
lptk
Regular MemberPosts: 394
Like?
Recovering image data from corrupt JPEG file
In reply to Jos Blokdijk, Sep 16, 2004

Sure thing. As long as the problem is all in the file headers this should be fairly straightforward. All of the instructions below assume Windows, so if you're on a Mac you will need to use an alternate hex editor and adjust the specific steps accordingly.

JPEG unlike some other file formats doesn't really have a file header, just a "start of data" marker and some "start of image" markers with some rules. These markers delineate sections, one of which is the EXIF data, one of which is the image data, and there may be others. What we want to do is remove the data from the start of each file to the start of the image data, and then save the file.

Once all of the files are stripped down to image data, you will open a file containing only a header, and append an image data file at the end. Save that file, and open a header, append image data.

I'm going to try and make the steps as clear as possible, just in case this could be useful to someone else down the road.

Steps:
1. Install a Hex Editor. frhed is a freeware one that works pretty well:
http://www.kibria.de/frhed.html

I'm basing the following instructions on this tool to make it easier to provide clear steps.

2. Important: Make a copy of all the damaged files so that you can work on the copies rather than originals. Best to work from a copy of the entire folder for clarity.

3. Open one of the damaged files in frhed.

4. You'll see the following three sections of information displayed:
0000 ff d8 xx xx xx xx ... ÿØ ...

These three sections show you the Byte Number, Hex Data, and ASCII equivalent data, respectively. You will be most interested in the Hex Data, which is the section in the middle. This is the file data in hexidecimal (base 16 number system using the digits 0,1,2,3,4,5,6,7,8,9,a,b,c,d,e,f).

Each pair of numbers is a byte. In your corrupt files the first bytes may not be "ff d8", but they will be when we're done. You will also see hex numbers prefixed with an "x", which indicates that they are in this number system (e.g. x10, which is not equal to decimal 10).

The Byte Number (and the scroll bar for that matter) show you how far into the file you are - like line numbers, but increments for each byte in the Hex Data.

The ASCII equivalent data shows what characters match the byte value in this position of the file. So xff in ASCII = ÿ, and xd8 in ASCII = Ø.

5. We want to locate "ff da" in the hex data. This is a border between header and image data. In a survey of several image files, there are two or three of these markers per file, and the DReb seems to write three.

6. To search, use the Find feature of the hex editor to locate those two bytes. In frhed you could click Edit, Find and enter the following:
"" (without the quotes)
This indicates byte in hex ff and byte in hex da.

7. Find the second occurrance. The second should be between 2000 and 4000 bytes into the file (in hex).

Just above this, you will likely see what looks like an alphabetic series of characters going from C-Z and then c-z (probably twice), and after that some extended ASCII characters (mostly vowels with diacritic marks).

8. Highlight the "da" byte. In frhed this would be highlighted in yellow.

9. Click Edit, Select Block.

10. Enter "x0" for starting offset, and leave the current value as the ending offset. Then click Ok.

11. This should highlight from the beginning of the file up to and including your "da" byte selected in step 8.

12. Hit Delete (or right-click, delete if you prefer). This should remove everything highlighted, leaving only the image data.

13. Save this file as a JPG.

14. Repeat for each damaged file (may want to test the first few with the remaining steps before continuing just to be sure it's working)

15. Open a copy of a good JPEG file from the DReb (landscape orientation), and cut out everything EXCEPT the file header using the above method. To do this:
a. At step 8, select the "00" byte after the da byte.

b. Use Select Block, keep the current starting offset, but change the ending offset to "xffffff" (an x followed by 6 "f"s)
c. Delete selection.
d. Save as Header.JPG.

16. Open Header.jpg in frhed and click Crtl+End to place the insertion point at the end of the file.

17. Click File, Insert File, browse to the image data files created above. Select one and click Open.

18. Save this as a .JPG file - this is the (hopefully) recovered file.

19. Repeat steps 16-18 for each image data file.

Note that the first "good" file I tested with was in portrait orientation. That header resulted in a broken banding corruption of the image (disjointed bands of the image), but it did open in an image viewer. Replacing the header with one from a landscape oriented JPEG corrected this. If you see similar behavior with your final image, try an alternate source file for the header, possibly with a different orientation.

Also, I've got a header.jpg that i used to figure this out. Of course it won't display as an image, so you'll need to right-click and use "Save target as" in IE (or equivalent in other browsers) if you want it:
http://www.lptk.com/util/header.jpg

Let me know if anything is unclear or if I've missed any steps.
cheers,

  • TK

Acknowledgement- I figured out the broad strokes on this independently, but found much good detail on the JPEG file markers and EXIF data structure in the following resource:
http://www.media.mit.edu/pia/Research/deepview/exif.html
Could not have built what I hope are repeatable steps without this resource.

Reply   Reply with quote   Complain
Post (hide subjects)Posted by
imqqmi MOD
imqqmi MOD
Keyboard shortcuts:
FForum PPrevious NNext WNext unread UUpvote SSubscribe RReply QQuote BBookmark post MMy threads
Color scheme? Blue / Yellow