InDesign Image Removed: Oh no!

Adobe Forensics can help find missing images in an InDesign file.

Situation:

YOUR GRAPHIC DESIGNER sends you an InDesign file that should contain an image (.jpg, say). However, he accidentally deleted it, then saved the InDesign file before sending it to you.

You open it. “Hey, where’s that (“bleepy-de-bleep”) photo that’s supposed to be here?” you ask.

“Huh? I dunno. I guess I accidentally (“bleep-bleepidee-bleep”) deleted it,” the designer replies.

“Well, can you find it and send it?”

“I don’t even know what image it was or when I even worked on it, so, like, uhhhh….,” the designers says groggily.

Here’s something you can do to solve the problem!

Image in InDesign File

Image in InDesign File

Image Removed from InDesign, then Saved

Image Removed from InDesign, then Saved

Hex Editor Finds Deleted Image Info

Hex Editor Finds Deleted Image Info

Open a web browser (Chrome, perhaps) and go to HexEd.it (there are others), developed by Jens Duttke. Open the InDesign (.indd) file from the browser.

You will see the hexadecimal code that makes up the InDesign file. To the right of the hex numbers is some human-readable text. The panel to the far right contains a search box. Search for common file types. JPG, TIF, PNG, PSD, AI, etc. In this case, the missing image was a JPG.

This will not work if the file you received was from a “Save As” version. The screenshot below shows the hexadecimal code after a SaveAs.

SaveAs removes image metadata data

SaveAs removes image metadata data

Let’s say the image was deleted and a “Package” function was initiated. (This is how InDesign collects all fonts, images, instructions, etc. into a separate folder for transport. QuarkXPress called this “Collect For Output.”)

If the file has not been saved, InDesign will tell you to save before proceeding to Packaging.

Let’s check the hex of the saved file and the Packaged file.

Package, but Save, first, retains image metadata

Package, but Save, first, retains image metadata

Packaged InDesign file loses image metadata

Packaged InDesign file loses image metadata

When Did This Happen?

InDesign also saves creation, modification and save metadata. This might come in handy when tracking down missing images as it can pinpoint exactly when an action was taken. If the file was saved at 3am on a Sunday morning, well, that may explain a lot. Here are two places to find this information from within InDesign:

Simply hold down the Command button (Mac) and click “About InDesign.”

InDesign File Info

InDesign File Info

How I Stumbled On This

I FOUND THIS handy method of Adobe Forensics when I was looking for where a color swatch was used in the document that I could not delete (it was in an Illustrator graphic). I deleted the graphic, saved the file, and checked the hex again. I noticed that the metadata was retained even though I had deleted the graphic. It’s always fun to find something unexpected when conducting …. Adobe ….. Forensics!

I hope this helps. Thanks.

For more on Adobe Forensics, see my graduate thesis: The Malicious and Forensic Uses of Adobe Software.