| Guide | GDE-024 |
| Topic | Image metadata forensics |
| Domain | Digital forensics |
| Last updated | August 2026 |
Short answer: Work from an original, unstripped file, run ExifTool for a full tag dump and cross-verify with a second tool. Corroborate the GPS coordinates and timestamp independently before treating either as a finding.
What is EXIF data OSINT?
EXIF data OSINT is the practice of extracting and interpreting the metadata embedded in an image file, including camera model, capture timestamp and GPS coordinates, to verify or investigate the file's origin without altering the image itself.
Every photo a camera or phone produces carries a second, invisible layer of data alongside the pixels. EXIF (Exchangeable Image File Format) tags can record the device model, exposure settings, capture timestamp and, where location services were enabled, GPS coordinates accurate to a few metres. None of this requires special access: the tags sit inside the file itself, readable with free tools in seconds.
EXIF review is rarely the whole investigation. It pairs with reverse image search and visual geolocation to build a corroborated picture of when, where and with what an image was made, and it is often the fastest of the three to run.
| • | Verifying whether a submitted photo was taken with the camera or device the source claims |
| • | Extracting GPS coordinates embedded in an unedited image file |
| • | Establishing a capture timestamp independent of a platform's upload date |
| • | Cross-checking a photo's metadata against a claimed location or event timeline |
| • | Confirming whether an image has passed through editing software before reaching an investigation |
How do you extract EXIF data from an image?
This section covers the tools and sequence for pulling a full metadata dump and turning it into verified findings.
Four tools cover EXIF extraction from raw command-line output through to browser-based review, free tools first.
ExifTool: Free, open source, no login. Phil Harvey's command-line tool reads and writes EXIF, GPS, IPTC and XMP tags across virtually every image, audio and video format, actively maintained with releases through early 2026. The most comprehensive option and the reference point every other tool on this list is checked against.
exif.tools: Free, no login. A browser-based port of ExifTool that runs locally in the browser rather than uploading the file to a server, the closest current replacement for Jeffrey's Image Metadata Viewer, which was permanently discontinued in December 2024.
Metadata2Go: Free, no login. Covers images, video, audio and documents in one interface. Unlike exif.tools, the file is uploaded to Metadata2Go's server for processing, worth weighing against the sensitivity of the material.
FotoForensics: Free public service, no login, paid Lab tier for private use. Combines metadata review with Error Level Analysis to flag likely manipulation. Uploads to the free public service enter a research archive that site staff and partners can view; use the paid Lab tier for anything sensitive.