Editing the Info in Hex Viewer

[gog2308]

I have some recovered jpg files, that have missing or incorrect headers: the hex does not commence as it should.

I want to find out how to edit the hex data, but cannot find how it is done in Irfanview.

Is anyone able to give me step by step advice, how I may successfully edit the file and save it with the picture; please?

[stefan]

For png files:

swt@politeia:~/Desktop$ hexdump irfanview430new.png | head 
0000000 5089 474e 0a0d 0a1a 0000 0d00 4849 5244
0000010 0000 8001 0000 b601 0208 0000 f900 c686
0000020 0058

Should be the correct fileheader!

For editing files in hexmode you can use this open source editor:

http://wxhexeditor.sourceforge.net

Stefan

[gog2308]

Hi Stefan!

I'm puzzled (it's normal ), but why did you give me the code for png files, my OP being about jpgs?

[stefan]

Hi,

oh, sorry for that!

Try to use:

swt@politeia:~/Desktop$ hexdump sizeold.jpeg | head
0000000 d8ff e0ff 1000 464a 4649 0100 0001 0100
0000010 0100 0000 dbff 4300

For jpg files

Stefan

[gog2308]

Septuagenarian age and ignorance is my excuse! May I presume the code is a Windows Command?

Also, I am still confused how to get the hex data in to any external editor and back again when revised.

[stefan]

You "just" have to open your recovered image into a hex editor. Make sure that you can "edit" data there

Then you should look for analog two byte block compared to my given file header.

For example your recovered jpg file looks like:

0000000 d8ff e0ff 1000 464a 0100 0100 0001 0100
0000010 0100 0100 0100 0100

You have to correct it in your hex editor like this:

0000000 d8ff e0ff 1000 464a 4649 0100 0001 0100
0000010 0100 0000 dbff 4300 0100 0001 0100 0100
0000020 0100 0100 0100 0100 0100 0100 0100 0100

It's very time consuming to correct the file header + please make sure that you have a backup (!!!) of the recovered files.

What you can do: Open IrfanView, goto "File", then "Open As" and click on "Hex editor". Then post, let's say, the first 10 lines. And I can show you, what you have to edit!

Stefan

[gog2308]

Thanks for the offer. I'll be in touch.

[gog2308]

post withdrawn due to

Fatal error:
Could not create file system directory to hold your attachment.
Unable to proceed with save while $errors array is not empty in class vB_DataManager_AttachmentFiledata in [path]/includes/class_dm.php on line 849

I'll try t find another way .

[stefan]

Hi,

please try to upload the screenshot again (fixed some file-upload permissions)

If you got the same error message again, please post here and please give me detailed information about the file (size + format etc.).

Thanks!

Stefan

[gog2308]

Still no luck, so have given Google Docs links, in hope they may work.
Pics are from cameras of different makes. The uploaded pics were 74.5 and 74.7KB jpg



https://docs.google.com/leaf?id=0B16...0MTIz&hl=en_US

https://docs.google.com/leaf?id=0B16...1NTM0&hl=en_US

[stefan]

I uploaded them here

Will have a look at your file headers soon after dinner

Stefan

[stefan]

Hi,

for both files you have to add the following values at the beginning:

00000000  ff d8 ff e0 00

Then you can try to open it in IrfanView!

Stefan

[gog2308]

Thanks I'll experiment when church duties are over.
I noticed that in some undamaged files e0 is e1. If e0 as suggested by you does not work, might e1 (without additional amendments?)?

[stefan]

Hi,

update on that:

Header must start with

FF D8 FF

E1 means your jpg file has exif information.

Then your header have to start with:

FF D8 FF E1 xx xx 45 78
69 66 00

E0 header:

FF D8 FF E0 xx xx 4A 46
49 46 00

Make sure that the last block of your file ends with:

FF D9

Source: here

Stefan

[gog2308]

Last line of of DSCF1469
9F 35 C5 D5 ED B7 99 24 F1 C4 91 8E 14, and
IMG0122
F1 C4 91 8E 14.

Line numbers as well as line contents differ. Is that in any way significant, do I just add FF D9 after what is now showing?

Code:
FF D8 FF E1 xx xx 45 78
69 66 00

I guess that xx xx are what I see immediately after E1, but if I do not see 45 78 are the two values to be inserted?