JPEG Image
| Format | JPEG Image |
|---|---|
| Short name | JPEG |
| Category | media |
| Platforms | Windows, macOS, Linux, iOS, Android, QNX |
| Crush support | Supported (ImageParser) |
| Status | Reviewed |
| Last reviewed | 2026-10-04 |
Forensic relevance
Photos and screenshots from device cameras, messaging apps, and downloads. EXIF metadata can contain GPS coordinates, timestamps, device model, camera settings, and an embedded thumbnail — the thumbnail may reveal original content even after the main image was cropped or edited. EXIF data can be stripped or manipulated, so timestamps should be corroborated with filesystem metadata and other sources. Quantization tables in the JPEG structure can identify the software used to save or re-encode the file. JPEG is a common steganographic carrier — data can be hidden in DCT coefficients or appended after the EOI marker. XMP metadata may additionally record editing history and software chain. An embedded C2PA (Content Credentials) manifest, carried in APP11 marker segments, can record the generating/editing software, an IPTC Digital Source Type (a direct AI-generation/-editing signal), and a signed claim identity — not present in most images, but increasingly common from AI generation tools and some camera/editing apps.
Signatures
| Offset | Hex | ASCII (non-printable as .) | Description |
|---|---|---|---|
| offset 0 (0x0) | FF D8 FF | ... | JPEG SOI marker |
Known extensions
.jpg, .jpeg, .jpe, .jfif
References
- JPEG format spec (ITU-T T.81) https://www.itu.int/rec/T-REC-T.81/en
- EXIF spec (CIPA DC-008) https://www.cipa.jp/e/std/std-sec.html
- Forensically — online JPEG forensics tool https://29a.ch/photo-forensics/
- Digital Image Authentication From JPEG Headers (Kee, Johnson, Farid — IEEE TIFS 2011) https://people.csail.mit.edu/kimo/publications/jpeg
- ExifTool — read/write metadata https://exiftool.org/
- C2PA Technical Specification (Content Credentials) https://spec.c2pa.org/specifications/specifications/2.4/specs/C2PA_Specification.html
Cite this entry
Crush Format Reference, “JPEG Image”. https://kalink0.github.io/crush-forensics/formats/jpeg/ — source: crush/data/build_formats_db.py at commit 640a2a9928f4e36a976b89901512a8dce824d093, built 2026-10-21 06:46:19 UTC.
Entry in the source at this commit · Change history of the source · Report a correction