Zip in a JPEG: How to Detect and Carve Appended Files from Photos

The Mechanics of Image Container EOF Markers

Standard image formats utilize strict delimiter markers to define the end of an image stream. In JPEGs, the end of image marker is always FF D9. In PNGs, it is the 8-byte IEND chunk sequence.

Standard photo viewing applications stop parsing once they reach this delimiter. Any data stitched after the EOF marker is silently ignored by viewers, but preserved on disk.

1-Click In-Memory Carving

Our binary carver scans the byte stream for the true EOF marker. If trailing bytes are discovered, it checks for magic signatures (PK for ZIP, Rar! for RAR, %PDF- for PDF) and extracts the appended payload into a standalone downloadable file.