JPEG segments and PNG chunks: where metadata lives in a file
How to read every row of AuditImage's "File structure" table. What APP1, APP11, COM, tEXt and caBX hold, and what offset and size tell you.
JPEG: marker segments
A JPEG is a series of segments each starting with FF xx. Everything before the image data is metadata or decoding parameters:
| Marker | Name | Contents |
|---|---|---|
| FF D8 | SOI | start of image |
| FF E0 | APP0 | JFIF header, resolution unit, thumbnail |
| FF E1 | APP1 | EXIF (starts Exif\0\0) or XMP (starts http://ns.adobe.com/xap/1.0/) |
| FF E2 | APP2 | ICC profile, MPF multi-picture (phone depth photos) |
| FF EB | APP11 | C2PA manifest (starts JP, holds a jumb box) |
| FF ED | APP13 | Photoshop IRB, containing IPTC |
| FF EE | APP14 | Adobe colour transform flag |
| FF FE | COM | comment, arbitrary text |
| FF DB | DQT | quantisation tables |
| FF C4 | DHT | Huffman tables |
| FF C0 | SOF0 | frame header: dimensions, components |
| FF DA | SOS | start of scan, followed by compressed data up to EOI |
| FF D9 | EOI | end of image |
Each segment holds at most 64 KB. Larger payloads are split across several segments of the same kind: big XMP uses "extended XMP", big C2PA manifests are split across several APP11 segments and reassembled by sequence number. Two consecutive APP11 C2PA rows in AuditImage's table are exactly that.
PNG: chunks
A PNG begins with an 8-byte signature, then a series of chunks each with a length, type, data and CRC:
| Type | Contents |
|---|---|
| IHDR | dimensions, bit depth, colour type |
| iCCP | ICC profile |
| pHYs | physical resolution |
| eXIf | EXIF (added to the standard in 2017) |
| tEXt / iTXt / zTXt | key/value text: XMP, SD parameters and the AIGC implicit label all live here |
| caBX | C2PA manifest |
| IDAT | image data, possibly several chunks |
| IEND | end |
XMP in a PNG is an iTXt with keyword XML:com.adobe.xmp. Stable Diffusion parameters are a tEXt with keyword parameters.
WebP: RIFF chunks
WebP is a RIFF container: VP8 , VP8L or VP8X hold the image; EXIF, XMP , ICCP and C2PA are one chunk each. Extended metadata requires the VP8X header.
Reading AuditImage's "File structure" table
- Segment: the type name. Segments carrying metadata are bold in the accent colour.
- Offset: byte position in the file, hexadecimal.
- Size: the whole segment including marker and length bytes.
- Share: a bar relative to the whole file.
Useful things to notice: metadata segments normally come before the image data; repeated segments of the same kind deserve a look; a picture of a few dozen KB carrying a 200 KB APP11 means the manifest embeds a thumbnail; a COM segment with content is worth expanding.
Manual check
exiftool -v3 photo.jpg # segment by segment
exiftool -htmlDump photo.jpg > dump.html