JPEG Signature Bytes for Data Recovery File Carving

File carving is a forensic and data recovery technique that reconstructs lost files directly from raw storage blocks without relying on filesystem metadata. When recovering deleted JPEG photographs, recovery tools scan unallocated disk space for unique binary patterns known as magic bytes or file signatures. This article covers the specific hexadecimal markers that define the start and end of JPEG files, the secondary headers used for validation, and the technical mechanisms tools use to extract intact images.

The Start of Image (SOI) Marker

Data recovery tools begin carving a JPEG by scanning storage clusters for the Start of Image (SOI) marker. In raw hexadecimal, every standard JPEG file starts with the two-byte sequence:

• Hex Signature: FF D8

Because FF D8 can occasionally appear at random in non-JPEG raw binary data, carving algorithms rarely rely on those two bytes alone. Immediately following the SOI marker, modern cameras and image editors append a marker segment indicating the specific metadata format used—most commonly JFIF or Exif. Consequently, carving tools typically scan for three- or four-byte sequences:

• Exif Header (Digital Cameras/Smartphones): FF D8 FF E1
• JFIF Header (Standard Web/Software JPEGs): FF D8 FF E0
• Raw JPEG Stream: FF D8 FF DB (Directly starting with a Quantization Table)

To prevent false positives, advanced carving utilities also inspect the ASCII string located a few bytes after the header. For an Exif file, the tool expects to see the ASCII string Exif (45 78 69 66 00 00 in hex) at offset 6. For a JFIF file, the tool looks for the ASCII string JFIF (4A 46 49 46 00 in hex) at offset 6.

The End of Image (EOI) Marker

Once a valid header is located, the recovery tool assumes it has found the beginning of a photograph and continues reading contiguous sectors until it reaches the End of Image (EOI) marker:

• Hex Signature: FF D9

When the carving engine encounters FF D9, it halts extraction, marks that offset as the end of the file, and saves the bytes between FF D8 and FF D9 as a .jpg or .jpeg file.

Challenges in Carving JPEG Signatures

While searching for FF D8 and FF D9 is straightforward, carving tools must account for structural complexities within the JPEG standard:

1. Embedded Thumbnails: Modern digital cameras embed a low-resolution thumbnail inside the main image's Exif metadata. Because this thumbnail is also a valid JPEG, it contains its own FF D8 and FF D9 markers. A basic carver that stops at the first FF D9 it encounters will extract only the thumbnail or a corrupted header. Robust carvers parse the Exif length tags to skip past embedded thumbnails before looking for the terminal FF D9.

2. File Fragmentation: File carving assumes that data is stored in contiguous clusters. If a deleted photograph was fragmented across non-sequential sectors, simply extracting everything between the SOI and the next available EOI will yield a corrupt or partially rendered photograph. Advanced tools validate internal JPEG markers—such as Define Quantization Table (FF DB), Define Huffman Table (FF C4), and Start of Scan (FF DA)—to detect missing or out-of-order data blocks during reconstruction.