Skip to content
ctfpal
All tools
ForensicsRuns locallyNo account

JPEG marker and segment analyzer

Parse JPEG markers, read APP segments and comments, and extract data appended after the end-of-image marker.

Open in ctfpal

JPEG is a stream of markers, each beginning with FF. The ones that matter for forensics are the application segments (APP0 through APP15), the comment segment (COM), and the end-of-image marker FFD9.

Unlike PNG’s rigid chunk list, JPEG’s segments are optional and variable, which means there is no clean audit - you cannot say that every byte belongs somewhere. What you can do is find the boundaries the format guarantees, and treat anything outside them as deliberate.

Where things hide

  • After FFD9. The image ends there. Everything after is appended data - most often a ZIP, since unzip searches from the end of a file and will happily find it.
  • In COM. An arbitrary comment string, invisible in any viewer.
  • In APP1. Where EXIF lives, including the comment fields covered by the EXIF viewer.
  • In an unusual APPn. Segments the decoder does not recognise are skipped without complaint.