2

Out of curiosity, I was digging my Mac cache files and found some blobs of Instagram pictures. Blobs are cache files stored without extensions (they can be, images, sounds, scripts etc.) I opened one of them and checked it was an Instagram picture I took with my phone and uploaded to Instagram, with some kind of filter. I then opened it in a text editor and, to my surprise, the first line read this:

ˇÿˇ‡JFIFˇÌ|Photoshop

I googled for anything connecting Instagram and Photoshop but found nothing. Just found it so odd that an image I edited on my mobile with the Instagram app is signed by Photoshop... Does anyone have a clue about this?

screenshot of the blob opened in Preview and in TextEdit

  • 1
    it's difficult to say without seeing the hex of the file, but it looks like there is a reference in the header to denote that there is a photoshop specific parameter in the file, possibly association meta data. It's not safe to assume that this was created by instagram, it's more likely that this was added by iOS when the photo was taken. BLOBs can be any large binary object, not necessarily just cache files so this could just be part of iOS associating JFIF with Photoshop – Alex Sep 25 '17 at 15:50
  • that's an interesting idea, but in fact this was not taken on an iPhone, first of all. it was actually taken by a friend on a Samsung phone, she then sent it to me and I posted it on Instagram. I found the blob on my Mac's Safari Cache folder after loading the Instagram web page. anyway, I assume this could also happen on Android. I'm going to look for that in other camera pictures and other Instagram pics too. how can I see the hex of the file? – alvaroantonio Sep 25 '17 at 16:17
  • 1
    The association could happen on any OS. I'd assumed that as you mentioned it being taken on a mobile, it was likely an iPhone with this being viewed on a Mac. The image could have been edited in Photoshop previous to uploading to IG, it could be a file association on the Android device, or it could just be that this image uses a subset of JFIF developed for photoshop. To view the file as hex, you would need a dedicated hex editor. This would show the address of the relevant line in the file to identify whether this is part of the header (I suspect it is...) – Alex Sep 25 '17 at 16:25
  • That's odd. I happen to have an instagram image here and I just looked and it's an EXIF file, not JFIF. Are you sure this image wasn't edited? – mattdm Sep 25 '17 at 17:27
  • 1
    @Alex, you really need to put the info in your comments into an answer. Please see Short answers as comments — please resist the urge – Michael C Sep 26 '17 at 1:24
3

Obviously, this means that the file was edited by Adobe Photoshop at some point in time, or, in the case of the Instagram app, the application adheres to a data standard previously introduced by Photoshop.

According to the developer information at exiv2.org, Photoshop stores some additional information in JPEG:

Adobe Photoshop uses the APP13 segment for storing non-graphic information, such as layers, paths, IPTC data and more. The content of an APP13 segment is formed by APP1 marker (0xFFE1), an identifier string (usually "Photoshop 3.0\000", but also 'Adobe_Photoshop2.5:', used by earlier versions) followed by a sequence of resource data blocks. In general, a resource block contains only a few bytes, but there is the important IPTC block can be quite large. The IPTC block may not fit into one APP13 segment, so it can be split into multiple APP13 segments.

The reference document for the Photoshop file format is available at http://www.adobe.com/devnet-apps/photoshop/fileformatashtml/

The linked Adobe page lists various image parameters that can be saved in the block, such as caption, border information, background color, print settings, halftoning information, etc.

The block starts with '8BIM' signature, which indeed, can be found in your text editor, in the second line, just after "3.0" (part of "Photoshop 3.0" identifier - which must be used even if the application writing the data is not Adobe Photoshop, otherwise the data block could not be properly analyzed by other applications looking for this data).

-2

I think the term “Photoshop” has likely entered the public domain in many cultures. Thus the viewing – editing – software you are using assigns this identifier (legal or not).

  • It's possible that the web browser (or perhaps Javascript served by Instagram's servers) adds that JFIF tag, but not very likely at all. As noted in my comment to the OP, I browsed to a random Instagram image with my web browser on my computer, saved the image, and viewed it in a hex editor in read-only mode. I'm pretty sure the file is being served like that directly from Instagram. – scottbb Sep 26 '17 at 1:22
  • @scottbb agreed. the mystery remains though as to why... – alvaroantonio Sep 26 '17 at 19:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.