When I run my recover program, it makes 16 JPG images. 3 of these JPG images (specifically, the 3rd, 8th, and 9th images) are perfect. The others, however, display question marks.

When I try to open them in a viewer, it says they start with incorrect bytes (usually they start with 0x67 0x00). I have used the xxd -l 4 #.jpg command to look at the first 4 bytes of each image. The ones that are correct all start ffd8 ffe1. The ones that are incorrect are all either 6700 ffe0 or 7067 00e0.

Why is my program reading these two byte combinations as equal to the starting sequence for a JPG?

Here is my code for the if statements I use to determine if the first 4 bytes represent the start of a JPG:

if ((buffer[0] == (unsigned char)255) && (buffer[1] == (unsigned char)216) &&
    (buffer[2] == (unsigned char)255) && (buffer[3] == (unsigned char)224))
    // code 
else if  ((buffer[0] == (unsigned char)255) && (buffer[1] == (unsigned char)216) &&
         (buffer[2] == (unsigned char)255) && (buffer[3] == (unsigned char)225))
  • Comments are not for extended discussion; this conversation has been moved to chat.
    – kzidane
    Commented Jul 23, 2015 at 2:31

1 Answer 1


Try checking with something like this: if(((buffer[0] == 0xff && buffer[1] == 0xd8) && (buffer[2] == 0xff) && (buffer[3] == 0xe0 || buffer[3] == 0xe1))) while using an unsigned char buffer.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .