JPEG File Signature — Magic Bytes

JPEG files begin with a distinctive marker sequence that identifies them as JPEG image data. The minimum signature is two bytes — FF D8 — which is the SOI (Start of Image) marker. In practice, valid JPEG files almost always follow this with an APP0 (FF E0) or APP1 (FF E1) marker, making the effective signature three or four bytes.

JPEG marker structure:

All JPEG markers begin with FF followed by a marker type byte. The most important markers at the start of a file:

Bytes	Marker	Meaning
FF D8	SOI	Start of Image — required as the first two bytes
FF E0	APP0	JFIF metadata block follows
FF E1	APP1	EXIF metadata block follows
FF DB	DQT	Define Quantization Table
FF C0	SOF0	Start of Frame (baseline JPEG)
FF D9	EOI	End of Image — the very last two bytes

JFIF vs. EXIF variants:

A JFIF-format JPEG starts with FF D8 FF E0 followed by the length bytes and the ASCII string "JFIF". An EXIF-format JPEG (produced by most digital cameras) starts with FF D8 FF E1 followed by length bytes and the ASCII string "Exif". Both are valid JPEG files, but forensic tools may need to handle both APP0 and APP1 initial markers.

What FF D8 means technically:

The value FF is reserved in JPEG as a marker prefix. The value D8 specifically denotes the Start of Image. This two-byte sequence must appear at offset 0 — there is no optional preamble or padding allowed before it. If the first two bytes of a file are not FF D8, it cannot be a valid JPEG.

JPEG file end marker:

Unlike many file formats, JPEG also has a defined end marker: FF D9 (EOI, End of Image). This means you can locate the exact end of JPEG data within a larger binary stream — useful when extracting embedded images from firmware, memory dumps, or compound file formats.

Detecting JPEG in hex dumps:

When scanning through binary data (for example, during a disk forensics investigation), look for the byte pattern FF D8 FF. The third byte will typically be E0, E1, or DB. If you find FF D8 but the next byte is not FF, the data may be corrupted. A common technique in data carving is to search for FF D8 at the start and FF D9 at the end to extract complete JPEG images from unstructured data.

Common pitfalls:

Not every occurrence of FF D8 in a binary stream is a JPEG — it could appear coincidentally within compressed data. Always verify by checking subsequent markers. Also note that FF bytes inside compressed image data are byte-stuffed with a 00 byte (FF 00), so genuine markers always have a non-zero second byte.