In the case where a JPEG file must be edited, but without leaving the file "apparently" edited (i.e. leaving all metadata, spec-/format-ambiguities, DCT tables, etc., byte-identical to the original), do any tools currently exist for packing/unpacking raw sectors without modifying more bytes than strictly necessary (relative to the original file)?

In particular, it's my understanding that the run-length coding used for compression will render a hex editor infeasible for this task — if it weren't for that, that'd be the tool for this job. And no conventional image editor will even approximately minimize e.g. the Hamming distance between the original and re-saved file, which is a pretty-accurate proxy for what I'm requesting here.

I'm aware that there are other forensic considerations, in addition to mere visual "plausibility" of the edits, both out-of-scope of this question. The scope of this question is specifically about editing the file without leaving forensically noticeable changes to its structure.

  • Afaik JPEG has no RLE, it diagonally fourier transforms the 8x8 chunks of the image and the gzips the stream. But I am not very sure. Hopefully you get a detailed answer.
    – peterh
    Oct 8 '20 at 21:04
  • I'll share 2 incredibly comprehensive+authoritative reference documents: ITU T.81, ECMA TR/98 it took me more than 10 minutes to find them, so I suppose a signal-boost on them is in order Oct 9 '20 at 16:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.