GDE-024 |
Image metadata forensics | |||||||
Digital forensics | ||||||||
August 2026 | ||||||||
01
What it is
EXIF data OSINT is the practice of extracting and interpreting the metadata embedded in an image file, including camera model, capture timestamp and GPS coordinates, to verify or investigate the file's origin without altering the image itself.
Every photo a camera or phone produces carries a second, invisible layer of data alongside the pixels. EXIF (Exchangeable Image File Format) tags can record the device model, exposure settings, capture timestamp and, where location services were enabled, GPS coordinates accurate to a few metres. None of this requires special access: the tags sit inside the file itself, readable with free tools in seconds.
EXIF review is rarely the whole investigation. It pairs with reverse image search and visual geolocation to build a corroborated picture of when, where and with what an image was made, and it is often the fastest of the three to run.
|
When to use this guide
|
02
How do you extract EXIF data from an image?
This section covers the tools and sequence for pulling a full metadata dump and turning it into verified findings.
Four tools cover EXIF extraction from raw command-line output through to browser-based review, free tools first.
ExifTool: Free, open source, no login. Phil Harvey's command-line tool reads and writes EXIF, GPS, IPTC and XMP tags across virtually every image, audio and video format, actively maintained with releases through early 2026. The most comprehensive option and the reference point every other tool on this list is checked against.
exif.tools: Free, no login. A browser-based port of ExifTool that runs locally in the browser rather than uploading the file to a server, the closest current replacement for Jeffrey's Image Metadata Viewer, which was permanently discontinued in December 2024.
Metadata2Go: Free, no login. Covers images, video, audio and documents in one interface. Unlike exif.tools, the file is uploaded to Metadata2Go's server for processing, worth weighing against the sensitivity of the material.
FotoForensics: Free public service, no login, paid Lab tier for private use. Combines metadata review with Error Level Analysis to flag likely manipulation. Uploads to the free public service enter a research archive that site staff and partners can view; use the paid Lab tier for anything sensitive.
|
Before you begin Stop at the login. None of the four tools in this guide require an account for base use. The distinction that matters instead is where the file goes: ExifTool and exif.tools never leave your machine or browser, while Metadata2Go and the free FotoForensics service upload the file to a third party. Route anything sensitive through a local tool or a paid private tier. Legal considerations. GPS coordinates and other identifying metadata constitute personal data under GDPR and equivalent frameworks where they can be linked to an individual. Ensure a lawful basis before extracting and retaining EXIF data as part of an investigation, and do not upload evidentiary images to a public research archive such as the free FotoForensics service. |
Instagram, X and Facebook strip EXIF from the copy other users can view or download. WhatsApp and Telegram are conditional: their standard photo-send mode strips metadata, but sending the same file as a document or file preserves it in full, including GPS. A screenshot never carries the original metadata. Trace back to the original upload, a direct download, or a document-mode attachment wherever possible before running any tool.
Run ExifTool against the file and review the complete tag list rather than a filtered summary. Note explicitly whether GPS tags are present at all; their absence is informative only if you have already confirmed you are working from an unstripped original.
Run exif.tools or Metadata2Go against the same file and compare the output. Discrepancies between tools are rare but worth resolving before a finding goes into a report. Prefer exif.tools for anything sensitive, since it never uploads the file.
EXIF stores GPS coordinates in degrees, minutes and seconds with separate hemisphere reference tags; most extraction tools convert this to decimal automatically. Plot the result on a map and cross-reference against any claimed location before treating it as confirmed, feeding into the wider geolocation workflow.
Compare the DateTimeOriginal tag against event timelines, weather records or shadow analysis. Camera clocks drift and are sometimes set incorrectly by the user, so a mismatch is a lead to investigate rather than automatic proof of tampering.
Check the Software and XMP tags for editing application signatures. A Photoshop or GIMP tag alongside a missing camera-maker tag is a prompt for closer visual analysis, not a standalone finding; run an Error Level Analysis pass through FotoForensics if the stakes warrant it.
|
03
What EXIF data OSINT gets wrong
Missing metadata, unverified coordinates and untested timestamps are the most common ways a metadata finding goes wrong.
Absent EXIF read as an empty file: A photo with no metadata is frequently a photo whose platform stripped it, not a photo that never had any. Treating an absence of tags as informative without confirming the file's provenance produces a false negative. Verifying check: confirm you are working from an original, unstripped file before drawing any conclusion from missing metadata.
GPS coordinates trusted without a sign check: EXIF stores latitude and longitude alongside separate hemisphere reference tags; a tool that mishandles the reference can silently plot a mirrored location. Verifying check: sanity-check the decimal coordinate against the claimed country or region before treating it as precise.
Timestamp treated as ground truth: Camera clocks drift and are sometimes set incorrectly by the user, and time zone offsets are not always embedded alongside the raw timestamp. Verifying check: corroborate the EXIF time against an independent signal, such as an upload log, weather record, or shadow analysis, before treating it as authoritative.
Editing-software tag read as proof of manipulation: Most images pass through some processing, including in-camera JPEG conversion and routine adjustment apps, without any deceptive intent. Verifying check: treat a Photoshop or GIMP tag as a prompt for closer visual analysis rather than a standalone finding.
EXIF data treated as tamper-proof: GPS and timestamp fields can be edited directly with the same class of tool used to read them. Verifying check: corroborate any material EXIF finding against a second, independent source before treating it as conclusive.
Chain of custody: metadata findings are only as strong as the record of which file was examined, with which tool, and when. A screenshot of a results page loses the underlying structured data.
Hash the original file with SHA-256 before running any tool against it
Export the complete raw tag dump, not only the fields relevant to the current line of inquiry
Record which tool produced which reading when cross-verifying across tools
Note whether any tool required uploading the file to a third party, and which service
Retain the unmodified original file separately from any copy used for publication
04
Go deeper
Reference cards for practitioners who want to build on this guide's metadata workflow.
CARD · IDN-001
Reverse image search and facial comparison.
Google Images, TinEye and Yandex. Multi-engine reverse search to a corroborated identity chain.
CARD · GEO-001
Image geolocation: methodology and workflow.
Google Earth Pro, SunCalc and Mapillary. Feature triangulation to an Admiralty-graded coordinate.
Evidentiary standard
Signal & Shadow operates to the LST-001 evidentiary standard. All claims are graded against the LST-001 v1.0.3 confidence tiers (Confirmed, Corroborated, Reported, Alleged) per the canonical voice and structural specification.
About Signal & Shadow
Signal & Shadow is an independent forensic investigation and methodology practice publishing tutorials, reference cards, and forensic dossiers for working practitioners. Founded by Derek Bowler.