Exiftool

Extract, read, and remove metadata from images and files using exiftool, a powerful command-line tool for OSINT and digital forensics.

Installation

Linux/Ubuntu

# Install from package manager
sudo apt-get update
sudo apt-get install exiftool

# Or build from source
cd ~
wget https://github.com/exiftool/exiftool/archive/refs/tags/12.70.tar.gz
tar -xzf exiftool-12.70.tar.gz
cd exiftool-12.70
perl Makefile.PL
make
sudo make install

macOS

# Homebrew
brew install exiftool

# MacPorts
sudo port install exiftool

Windows

# Chocolatey
choco install exiftool

# Scoop
scoop install exiftool

# Manual: Download from https://exiftool.org/

Basic Commands

Command	Description
exiftool image.jpg	Display all metadata
exiftool -all image.jpg	Show all metadata tags
exiftool -GPS* image.jpg	Extract GPS coordinates
exiftool -DateTimeOriginal image.jpg	Show original capture date/time
exiftool -Make -Model image.jpg	Show camera make and model
exiftool -s image.jpg	Short output format
exiftool -G1 image.jpg	Group by tag family
exiftool -a image.jpg	Show all duplicate tags

Extracting Metadata

GPS & Location Data

# Extract all GPS tags
exiftool -GPS* image.jpg

# Show GPS coordinates in decimal format
exiftool -GPSLatitude -GPSLongitude image.jpg

# Extract full GPS track
exiftool -n -GPS* image.jpg

# Find all images with GPS data in directory
exiftool -filename -r -if '$GPSLatitude' dir/

# Convert GPS to decimal degrees for mapping
exiftool -GPSLatitude -GPSLongitude -n image.jpg

EXIF Data

# Extract camera info
exiftool -Make -Model -LensModel image.jpg

# Show ISO, aperture, shutter speed
exiftool -ISO -FNumber -ExposureTime image.jpg

# Get capture date/time
exiftool -DateTimeOriginal image.jpg

# Extract full EXIF dump
exiftool -EXIF:* image.jpg

IPTC & XMP Keywords

# Extract keywords/tags
exiftool -Keywords image.jpg

# Show copyright and creator
exiftool -Creator -Copyright image.jpg

# Extract all IPTC data
exiftool -IPTC:* image.jpg

# Show XMP data
exiftool -XMP:* image.jpg

Batch Processing

Extract from Multiple Files

# All images in directory
exiftool *.jpg

# Recursive directory scan
exiftool -r dir/

# Extract specific tags from all files
exiftool -FileName -DateTimeOriginal -r dir/

# Find all JPGs with location data
exiftool -filename -r -if '$GPSLatitude' dir/ > images_with_gps.txt

# Extract GPS from video files
exiftool -r -if '$GPSLatitude' -GPSLatitude -GPSLongitude *.mp4

Export Metadata to File

# Export as text
exiftool image.jpg > metadata.txt

# Export as CSV
exiftool -csv *.jpg > metadata.csv

# Export as JSON
exiftool -json image.jpg > metadata.json

# Export specific tags as CSV
exiftool -csv -FileName -DateTimeOriginal -Make -Model *.jpg > cameras.csv

Removing/Modifying Metadata

Strip Metadata

# Remove all metadata
exiftool -all= image.jpg

# Remove all metadata (preserve original)
exiftool -a -G1 -s -n image.jpg > backup.exif
exiftool -all= image.jpg

# Remove only GPS data
exiftool -GPS*= image.jpg

# Remove GPS but keep other EXIF
exiftool -gps:all= image.jpg

# Remove EXIF preserve XMP/IPTC
exiftool -EXIF:all= image.jpg

# Batch strip all metadata in directory
exiftool -all= -r -ext jpg dir/

Modify Metadata

# Set copyright
exiftool -Copyright="Company Name" image.jpg

# Set creator
exiftool -Creator="John Doe" image.jpg

# Modify capture date
exiftool -DateTimeOriginal="2024:01:15 10:30:45" image.jpg

# Add GPS coordinates
exiftool -GPSLatitude=40.7128 -GPSLongitude=-74.0060 image.jpg

# Set camera model
exiftool -Model="Custom Model" image.jpg

OSINT & Reconnaissance

Location Intelligence

# Extract coordinates from all images in folder
exiftool -r -n -GPSLatitude -GPSLongitude dir/ | grep -v '^\s*$'

# Find images taken at specific location (rough filter)
exiftool -r -if '$GPSLatitude > 40 and $GPSLatitude < 41' dir/

# Extract unique locations
exiftool -r -GPSLatitude -GPSLongitude -s dir/ | sort -u

# Timeline of image locations
exiftool -r -DateTimeOriginal -GPSLatitude -GPSLongitude -s dir/ | sort

# Find high-precision GPS data (more decimal places = higher precision)
exiftool -r -if '$GPSLatitude =~ /\.\d{6,}/' dir/

Timeline Analysis

# Sort images by date taken
exiftool -r -filename -DateTimeOriginal dir/ | sort -k2

# Find images taken in specific date range
exiftool -r -if '$DateTimeOriginal =~ /2024:01:/' -filename dir/

# Identify rapid image bursts (same second)
exiftool -r -filename -DateTimeOriginal dir/ | uniq

# Time gaps between photos
exiftool -r -DateTimeOriginal -s -n dir/ | awk '{print $NF}' | sort

Camera Identification

# Find all unique camera models
exiftool -r -Model -s dir/ | sort | uniq -c

# Find images from specific camera
exiftool -r -if '$Model =~ /iPhone 14/' -filename dir/

# Extract lens information
exiftool -r -LensModel -s dir/

# Group by camera manufacturer
exiftool -r -Make -s dir/ | sort | uniq -c

Fingerprinting

# Identify potentially fake/edited images (check for inconsistencies)
exiftool -Software -Make -Model image.jpg

# Find edited images (look for PhotoShop/Lightroom)
exiftool -r -if '$Software =~ /(Photoshop|Lightroom)/' -filename dir/

# Check for conflicting metadata
exiftool -DateTimeOriginal -CreateDate image.jpg

# Extract color space and bit depth info
exiftool -ColorSpace -BitsPerSample -SamplesPerPixel image.jpg

Advanced Techniques

Recursive Tag Dump with Filtering

# Extract all tags, grouped by type
exiftool -G1 -r dir/ > all_metadata.txt

# High-precision GPS extraction
exiftool -r -n -GPSLatitude -GPSLongitude -GPSAltitude dir/ > gps_data.csv

# Extract all software/apps used
exiftool -r -Software -s dir/ | sort | uniq -c

# Timeline with all metadata
exiftool -r -DateTimeOriginal -GPSLatitude -GPSLongitude -Model -filename dir/ | sort -k2

Video Metadata

# Extract metadata from MP4/MOV
exiftool video.mp4

# Get GPS from video (if available)
exiftool -GPS* video.mp4

# Extract creation date from video
exiftool -CreateDate -Duration video.mp4

# Find all videos with metadata
exiftool -r -if '$CreateDate' -ext mp4 -ext mov dir/

Configuration File

# Create ~/.exiftoolrc for common options
cat > ~/.exiftoolrc << 'EOF'
# Show all tags by default
-a

# Use short format
-s

# Group output
-G1

# Handle large files
-ee

# Ignore minor errors
-m
EOF

# Now use with config
exiftool -config ~/.exiftoolrc image.jpg

Practical OSINT Workflows

Profile a User from Social Media Photos

#!/bin/bash
# Download image and extract metadata

IMAGE_URL="https://example.com/photo.jpg"
wget "$IMAGE_URL" -O target.jpg

# Full metadata dump
exiftool target.jpg

# GPS coordinates
exiftool -n -GPS* target.jpg

# Camera info
exiftool -Make -Model -LensModel target.jpg

# Creation date
exiftool -DateTimeOriginal target.jpg

# Timeline analysis if you have multiple images
exiftool -r -DateTimeOriginal -s *.jpg | sort

Investigate Location from Images

#!/bin/bash
# Extract and geolocate from images

# Find all GPS data
exiftool -r -GPSLatitude -GPSLongitude -filename . > gps_locations.txt

# Check precision
exiftool -r -n -GPSLatitude -GPSLongitude . | grep -oE '[-0-9.]{5,}' | head -20

# Create KML for mapping (manual with coordinates from above)
# Then view in Google Earth or other GIS tool

# Timeline correlation
exiftool -r -DateTimeOriginal -filename . | sort

Batch Analyze Photos for Forensics

#!/bin/bash
# Comprehensive analysis of image set

mkdir -p analysis
cd analysis

# Copy images
cp ../images/* .

# Extract all metadata
exiftool -r -a -G1 . > metadata_full.txt

# CSV export for analysis
exiftool -csv -r -FileName -Make -Model -DateTimeOriginal -GPSLatitude -GPSLongitude . > analysis.csv

# Find anomalies
grep -i "photoshop\|edited\|modified" metadata_full.txt > potentially_edited.txt

# GPS locations
exiftool -r -n -GPSLatitude -GPSLongitude . > gps_coords.txt

# Timeline
exiftool -r -DateTimeOriginal -filename . | sort > timeline.txt

Best Practices

OSINT

• Always preserve original files before extracting metadata
• Check for metadata inconsistencies (edited dates, conflicting timestamps)
• Correlate GPS data with timestamps for location verification
• Look for software/editor info indicating image manipulation
• Extract high-precision GPS for accurate geolocation
• Compare camera signatures across images from same user

Forensics

• Document all metadata before analysis
• Export to structured formats (JSON/CSV) for correlation
• Look for conflicting creation/modification dates
• Check for metadata removal patterns (stripped images)
• Preserve hash of original file
• Note any unusual software or GPS altitude values

Privacy

• Remove all metadata before sharing sensitive images
• Use -all= to strip completely
• Verify metadata removal with second scan
• Be aware GPS coordinates can reveal home/work locations
• Remove image from EXIF before publishing

Common Issues

GPS Coordinates Not Showing

# Check if GPS data exists
exiftool -n -GPS* image.jpg | grep -v "^$"

# Some phones store differently
exiftool -n -gps:all image.jpg

# Check raw EXIF
exiftool -a image.jpg | grep -i gps

Metadata Partially Removed

# Some tools don't remove all EXIF
exiftool -all= image.jpg

# Verify removal
exiftool image.jpg | wc -l  # Should be minimal

# Remove persistently
exiftool -overwrite_original -all= image.jpg

Resources

• Exiftool Official Docs
• Tag Names Reference
• Forum & Support
• Metadata Privacy Guide

---

Last updated: 2026-03-30