Repairing photos with JPEG-Repair Toolkit
Repair JPEGs: Select a tool > Select file(s) > Click Repair
Please do not let the different buttons and options intimidate you. For most simple repairs you only need the section on the left the window. In general JPEG corruption is one of two (or both): A corrupt header or bit corruption in the actual image data. You either see no picture or you do see a picture even when it is distorted one way or the other. Typically the first photo is what you get when the header is corrupt. In the second example, the image actually can be opened but ‘distorts’ at some point due to bit errors in the JPEG data.
Corrupted header:
Typical case of a corrupt header: Windows File Explorer can not show a preview.
Image distortion caused by corrupt Huffman table in JPEG file, but this is more rare.
Symptoms:
- No preview in the Windows File Explorer
- No image in Photo Viewers
- Error message: Invalid JPEG Marker
- Windows Photos: It looks like we don’t support this file format
- Old Windows Photo Viewer: File appears to be damaged, corrupted or is too large
- Distorted image
Possible repairs:
- If JPEG: Try repair using a reference file
- If JPEG: Try Extracting JPEG data
- If RAW: Use Extract to recover JPEG data
If you try to repair a corrupt header using JPEG-Repair with help of a reference file JPEG-Repair will display the image if successful. In case JPEG-Repair can not repair the image it will show the error/log window:
One common issue is ‘No SOS detected’ in ‘Last error’ column: As the header is relative tiny chances that damage is limited to header only is small. Often header is damaged or overwritten and part of the image data as well. This can then not be repaired by simply fixing the header but there may still be options (see below, ‘header and image data corruption’).
Corrupted JPEG image data:
Corrupted data in JPEG bitstream can cause various distortions in the image
Symptoms:
- Image displays only partially
- Color errors. From the point of corruption, color in all image data following is ‘off’.
- ‘Shift’ in image, image data not aligned
- Grey ‘box’, mostly at lower part of image. Image starts normal and appears cut off.
- The cut off part of often grey but can be any solid color.
- Invalid JPEG Marker error messages issues by an image viewer or photo editor.
Possible repairs:
- Use Patch mode to remove invalid JPEG markers
- Use editor (Patch mode) to remove corrupted bytes
- Use editor to re-align shifted image data
Important:
Often photos repaired using this method require post processing using a photo editor. Removing corrupted data from the photo causes image shift. To counter that zero bytes are added to replace removed data. This leaves greyish lines.
If you do not have a photo editor I recommend Paint.NET as it is easy to use even for beginners. The tool most suited to remove grey lines is the photo stamp tool.
large part at bottom of photo is grey
Grey line is a result of adding zero bytes to replace corrupted data.
Grey lines that were side effect of repair removed using clone stamping
Damage to header and image data
If both the header and part of the image data are damaged we may still be able to repair the JPEG. General symptoms are same as header damage; Windows will display generic image icon and Windows image viewer will tell the file is corrupt or not supported. Repair using a reference file however fails, most common error JPEG-Repair will show is ‘No SOS detected’. The SOS is the marker that precedes the compressed/encoded JPEG data, the start of scan marker.
We saw patch mode expects corrupt image data. If we open a file in patch mode we also have the option to ‘append a header’. This allows us to add a valid header and decode the remaining JPEG data.
This scenario we often see with certain types of ransomware, however it’s not limited to that only. I see this type of damage on a regular basis.