FORMATS · PHOTOS · 15 OCTOBER 2026
Photo formats: JPEG, PNG, GIF, WebP, HEIC and AVIF
Which photo formats Frame Witness carves (JPEG, PNG, GIF, WebP, HEIC, AVIF), how each one is recognised, what a fragmented photo looks like, and the limits.
Recognised photo formats
| Format | Recognised by |
|---|---|
| JPEG (.jpg) | start-of-image marker FF D8 FF, walked to its end marker |
| PNG | the eight-byte PNG signature and its chunk chain |
| GIF | the GIF8 signature |
| WebP | a RIFF header with the WebP type |
| HEIC and AVIF | an ftyp box with an HEIF brand (heic, heix, mif1, avif...) |
Photos in pieces
Photos are carved as one run of bytes from header to end. A PNG split in two pieces can be rejoined using the CRC checksums stored in its chunks, labelled as such. Other photos stored in pieces, whose file-system record is gone, usually come back incomplete and are marked accordingly.
Dates
Dates are shown with their source (file system, embedded metadata) and never invented; a missing date stays unknown.
What cannot come back
- Overwritten data. Bytes that new files replaced are gone for every program.
- Full and overwrite formats. A full format in Windows writes zeros over the volume; an overwrite format or a wipe does the same with other patterns.
- SSD TRIM. A drive that receives TRIM usually erases freed blocks itself.
- Encryption without the key. A BitLocker volume, or a phone with file-based encryption, cannot be read without its key.
Try it on your own source
Download Frame Witness for Windows (version 1.0.14, Authenticode-signed by Aurelio Avila, SHA-256 fa22d6c7f97da0b4e5efa889e5abb9e4d98815a9b76ac0087424944b21bad6c2). The free account gives a quick scan of the first 8 GiB, up to 100 results, previews and saving files up to 1 MiB each; full scans and larger files need a licence, with current prices on the pricing page.