JPEG 2000 Signature Format: Documentation & Recovery Example
JPEG 2000 (extensions: *JP2, *.JPA, *.JPM, *.JPX) is an image compression standard and coding system. It was created by the Joint Photographic Experts Group committee in year 2000 with the intention of superseding their original discrete cosine transform-based JPEG standard with a newly designed, wavelet-based method. The standardized filename extension is .jp2 for ISO/IEC 15444-1 conforming files and .jpx for the extended part-2 specifications, published as ISO/IEC 15444-2.
Improvements over the JPEG standard: Superior compression performance, Multiple resolution representation, Progressive transmission by pixel and resolution accuracy, Choice of lossless or lossy compression, Error resilience, Flexible file format, High dynamic range support, Side channel spatial information.
The JPEG 2000 file format specification was based on the QuickTime container format specification. A JPEG 2000 file is always big-endian, storing and transferring the most significant bytes first.
JPEG 2000 files consist of consecutive chunks. Each chunk has 8 byte header: 4-byte chunk size (big-endian, high byte first) and 4-byte chunk type - one of pre-defined signatures: "jP " or "jP2 ".
Second chunk must be of type "ftyp" and has a sub-type at offset 8. JPEG 2000 defined by sub-type which must be one of values: "jp2 "(file type *.JP2), "jp20" (file type *.JPA), "jpm " (file type *.JPM), "jpx " (file type *.JPX).
Iterating chunks, until unknown type is detected, we compose JPEG 2000 image/video file.
Let's examine the sample
When inspecting sample.jp2 file's binary data using any Hex Viewer, like Active@ Disk Editor we may notice it starts with a signature jP__ (hex: 6A 50 20 20) at offset 4, which defines QuickTime Multimedia Container File Type. First block size is 12 (hex: 00 00 00 0C, big-endian, high byte first), size located at offset 0. At offset 12 (hex: 0C) is located the second chunk, which has a size of 20 (hex: 00 00 00 14) and type ftyp (hex: 66 74 79 70). Second chunk's sub-type is jp2_ (hex: 6A 70 32 20) at absolute offset 20 (hex: 14), which points to JPEG 2000 JP2 file type. The next chunk is located at offset 12+20=32 (hex: 20) and has a size 345 (hex: 00 00 01 59) and type jp2h (hex: 6A 70 32 68) at offset 36 (hex: 24). This is a header for JPEG 2000 file. Iterating all data blocks the same way, we recover JPEG 2000 file.
More info:ISO/IEC 15444-1:2004 - JPEG 2000 image coding system: Core coding system
ISO/IEC 15444-2:2004 - JPEG 2000 image coding system: Extensions
QuickTime File Format