Where is the value in HEX for the file size in a jpg (exif)

Asked Jun 03 '20 at 15:24

Active Jun 03 '20 at 15:24

Viewed 350 times

I can carve out images no problem, but I remember a long time ago being shown where to find the file length of a jpg (in bytes) so that if i had issue with an auto recovery i can do it manually.

where in a jpg exif header in HEX are the values (which i know needs converting into little endian?) that tell me the size of the file, so i can scroll to the end of the file, find FF d9 and recover the image.

Can anyone point me to where those HEX values are in these types of JPG's?

Thank you!

asked Jun 03 '20 at 15:24

CaptainLund

Why would a file contain its own size? Ask the filesystem! – Asteroids With Wings Jun 04 '20 at 19:45
BTW EOI (FFD9) may not be at the end of the file. In particular some Samsung phones produce JPEGs with proprietary trailing data. You should parse the file's segments from top to bottom. – Asteroids With Wings Jun 04 '20 at 19:46

Where is the value in HEX for the file size in a jpg (exif)

0 Answers0