Strange bytes added to end of JPG files on SD card
A month ago, my wife upgraded from a Galaxy S5 to S7, and brought along a MicroSD card full of photos taken on the old phone. Recently, in the process of backing up new photos, I noticed that a lot of old photos have been given "new" file modification dates, which I find alarming. Large batches of photos have updated modtimes while the phone is connected to WiFi not doing anything.
I grabbed a sample modified JPG and compared it to the backed-up original. The file is identical up to the length of the original, but has some new bytes tacked onto the end of the file:
What is this? I see "BackupRestore_Data", which looks like a signature from some kind of online backup system, but I'm not aware of us opting into such a system. I also see "SEFT" which could be a magic number at the end, but searching for that didn't produce anything that looked relevant.
It doesn't seem to hurt the JPG to have this extra data appended. But generally I'm not a fan of the files being changed at all after the photo was taken. What is this extra data and what does it do?
The data seems to be some kind of hash, that whatever backup software is happening is using it to track which files have already been uploaded, and which ones haven't. Also hashes, if the hash is for the whole file it can be used to determine if the file has been altered since its last upload.
Many picture formats support metadata which is added to the pictures for the users benefit. This includes, but is not limited to EXIF and XMP profiles which allow all kind of information to be embedded that would otherwise be lost.
The most important camera information is embedded. Tags containing the names of people in the pictures can be added afterwards.
I have the same problem with my S7. Don't know what program is adding this meta data but the numbers following BackupRestore_Data is the device IMEI number.
Using Exif tool I gathered that it seems the data is an exif maker note from a Samsung app.
D:\>exiftool -s -G -U "2016-08-26 14.15.38-1.jpg"
[MakerNotes] Unknown_0x0001 : 0100
[MakerNotes] Unknown_0x0002 : 73728
[MakerNotes] Unknown_0x000c : 0
[MakerNotes] Unknown_0x0010 : undef
[MakerNotes] Unknown_0x0040 : 0
[MakerNotes] Unknown_0x0050 : 1
[MakerNotes] Unknown_0x0100 : 0
[MakerNotes] TimeStamp : 2016:08:26 14:15:38+02:00
[MakerNotes] SamsungTrailer_0x0a41Name : BackupRestore_Data
[MakerNotes] SamsungTrailer_0x0a41 : (Binary data 20 bytes, use -b option to extract)
D:\>exiftool.exe -SamsungTrailer_0x0a41Name -b -u "2016-08-26 14.15.38-1.jpg"
Warning: [minor] Unknown APP4 segment - 2016-08-26 14.15.38-1.jpg
BackupRestore_Data
D:\>exiftool.exe -SamsungTrailer_0x0a41 -b -u "2016-08-26 14.15.38-1.jpg"
Warning: [minor] Unknown APP4 segment - 2016-08-26 14.15.38-1.jpg
3588100754?????_1458 (I have masked that last 5 numbers in the IMEI)