I get nothing in Windows Picture viewer or only a portion of the
I will be assuming the file format is JPEG.
So there’s two issues here:
- File will not open at all; so then at least the header is damaged
- File will open but is truncated or at least appears to be
File will not open at all
So, in this case the header is invalid but possibly a whole lot more. So before trying to repair header it makes sense to open the file in a hex editor and see what we have. My favorite hex editor, which happens to be free is HxD.
First thing we’ll do is see if there’s actually data, any data:
In this case it becomes obvious we will not be able to repair the file. But how about:
We first browse approximately half way into the file, normally we’d be certain we’d be looking at the encoded JPEG data there. JPEG is high entropy data. That means chaotic unpredictable data. The data in the image looks pretty chaotic to me so that would be a good thing, and yet the data I picked for the example is not JPEG data and I’ll tell how you can spot this:
In the JPEG specification the byte FF has special meaning as it tell the JPEG decoder we’re dealing with a JPEG marker. FF is always accompanied by a second byte which tells the decode that marker it is dealing with. For example FF D9 is end of image marker. FF DA is start of scan marker. I keep a list of all markers I know of here: https://www.disktuna.com/list-of-jpeg-markers/.
This also means you will not find markers berried inside the encoded JPEG data as any FF xx byte combination would make the decoder think it ran into a JPEG marker it has to do something with. There’s a few exception though:
FF 00 is valid and FF nn where nn is D0 to D7. So FF D3 is valid. In the dump however we see for example FF 9A or FF 5E and these we would never see in valid JPEG data.
So both of these dumps are from files that can not be repaired. If we have high entropy data and no invalid JPEG markers in encoded data it is likely we can repair the image, at least to a degree by using the header of a known good JPEG that was shot with the same device.
To ‘repair’ header using HxD and reference file while assuming damage is limited to the header:
Open corrupt file in HxD, Search > Find, search for FF DA using HEX data type. If not found the file is beyond repair. It is possible multiple instances of FF DA are found, you need the LAST one. There may be a few if the JPEG included a thumbnail and preview.
Write down the address (Using View > Offset base you can switch to decimal numbers if you like). Now search for FF D9. Or, go to end of the file which is where you’d normally find FF D9.
Once found, select the entire block including from the last FF DA upto and including FF D9 > right click > copy.
Open a new file > Paste Insert > Save as ‘image.jpg’. You have now copied the image data to a new file.
Open a known good file that was shot with the same camera, using same resolution and orientation (portrait/landscape).
Use Search > Find, search for FF DA using HEX data type.
It is possible multiple instances of FF DA are found, you need the LAST one.
Select the block preceding the FF DA bytes all the way to the start of the file (FF D8)
Switch to your image.jpg file TAB containing the image data, make sure you’re at offset 0 (zero) > Paste Insert > Save the file.
A drawback of this method is, that if reference file contains a preview, this preview will be copied to the repaired file too.
Image appears only partially
There can be several causes:
File is truncated: Compare size of corrupt file with size of intact JPEG shot with same device. If file is only half expected size then it’s to be expected half of the image is missing. You can not repair this.
What I also see is file is only filled half. So, if you open file in HxD and find a good portion at bottom of file consists of zeros then image data is simply missing.
Last, and this can sometimes be repaired is corrupt data in encoded JPEG data. As we saw before invalid FF xx byte combinations will make the decoder (photo viewer) think it encountered a JPEG marker. Depending on the software, it may simply hang and stop decoding or pop up an error message like ‘invalid JPEG marker’.
The free tool JpegSnoop will report such markers.
I have been able to get images to decode that had just one or two of those invalid markers using HxD by simply replacing the invalid marker FF xx by FF 00 as you can see in below example.
Finding out about all these options for repair I wrote a tool that can do much of this more easily. Also it for example strips the header of the reference file from data specific to the reference file, such as the preview thumbnail.
It also allows me to quickly spot issues with a file. It shows a byte histogram and calculates the entropy.
In this example you can see entropy is too low (it’s why it is displayed in red characters rather than green) and also the byte histogram looks nothing like an intact JPEG.