1 Anatomy of a camera JPEG
A JPEG from a camera is a chain of segments. Each one starts with a two-byte marker
(FF + type). Most of them carry a length, so a parser can jump from one to the next. The layout of
the sample photo used on these pages:
Only the scan holds the picture. Everything else is either needed to decode it (tables, size) or describes it (metadata). Both kinds are evidence: the metadata says what the device claims, the decoding tables say which encoder actually wrote the file.
Metadata of the sample photo (exiftool-style listing)
2 Four questions
Most multimedia work on a seized device comes down to four questions. Each page covers one of them:
3 Working with images as evidence
- Hash first, then open a copy. Many viewers and gallery apps rotate, re-save or add metadata without asking. A changed byte is a changed hash.
- Read the structure, not just the tool output. Tools disagree, skip unknown fields and hide errors. The hex views on these pages show the bytes each value comes from.
- Metadata is a claim. Every field is written by some program and can be rewritten by another. Look for fields that agree or contradict each other: the size in SOF vs. EXIF, the thumbnail vs. the main image, the camera named in EXIF vs. the tables that encoded the pixels.
- Report what you found and how certain it is. "The file contains data after the end marker" is a fact. "Someone hid a file" is an interpretation.
generator/build_learn_media.py. The cameras (Lumora LX-7, Corvane C-200) do not exist; the
GPS positions are public squares. The "tool" listings imitate exiftool, binwalk and pngcheck and are generated by
the same script.4 Warm-up
Two quick checks before you start. Everything needed is on this page or in Storage Foundations.
Which two bytes does every JPEG file start with? Type them in hex.
Look at the first box of the layout in section 1: the SOI marker.
FF D8 is SOI, "start of image". Do not confuse it with FF D9 (EOI), which ends the image, or with 89 50 4E 47, the start of a PNG signature. Carving tools search for FF D8 FF.
A TIFF header inside EXIF starts with 49 49 ("II"). What does that tell you?
"I" stands for Intel, "M" (4D 4D) for Motorola.
II = Intel byte order = little-endian: the magic number 42 is stored as 2A 00, and every offset and count after it has its least significant byte first. MM (4D 4D) means big-endian, with the magic stored as 00 2A.