Main Menu

Samsung metadata

Started by e@e@, May 12, 2024, 05:17:55 AM

Previous topic - Next topic

e@e@

I'm trying to analyze some Samsung device's metadata (S23, Note20.. etc) and noticed that there is a repeating APP4 segment that is shown in the devices image file as "unknown metadata segment". Their content is not consistent as I checked binary.
Does anyone know to say something about this issue?
I also found APP11 segments in some images...

Phil Harvey

While I don't know for sure about this camera, repeated large APP segments tend to be raw data for preview images. 

- Phil
...where DIR is the name of a directory/folder containing the images.  On Mac/Linux/PowerShell, use single quotes (') instead of double quotes (") around arguments containing a dollar sign ($).

e@e@

Quote from: Phil Harvey on May 12, 2024, 08:34:22 PMWhile I don't know for sure about this camera, repeated large APP segments tend to be raw data for preview images. 

- Phil


Thank you Phil.
Is there any way to save this raw data and display it as an image?

Phil Harvey

Without seeing a sample I can't even be sure this is image data.

- Phil
...where DIR is the name of a directory/folder containing the images.  On Mac/Linux/PowerShell, use single quotes (') instead of double quotes (") around arguments containing a dollar sign ($).

e@e@

Quote from: Phil Harvey on May 13, 2024, 01:25:28 PMWithout seeing a sample I can't even be sure this is image data.

- Phil

it does not look like an image, but here is a link to an image I found on the web with this kind of APP4:




StarGeek

I used the -v5 (-verbose5) option to get a hex dump of the APP4 section.  There are way too many null characters 0x00 for it to be image data, IMO. There are about 2,525 null characters out of the 6,520 characters in that section.
* Did you read FAQ #3 and use the command listed there?
* Please use the Code button for exiftool code/output.
 
* Please include your OS, Exiftool version, and type of file you're processing (MP4, JPG, etc).

e@e@

Quote from: StarGeek on May 22, 2024, 10:00:31 AMI used the -v5 (-verbose5) option to get a hex dump of the APP4 section.  There are way too many null characters 0x00 for it to be image data, IMO. There are about 2,525 null characters out of the 6,520 characters in that section.

Yes, that's what I thought too...
So what else can it be? I saw this kind of APP4 on some Samsung devices, in each picture they are a little different, but contain a lot of nulls...