Digital Forensics

exiftool

exiftool reads (and writes) the metadata buried in files, and it understands an astonishing range of it. Photos carry EXIF: camera model, timestamps, and often GPS coordinates of exactly where they were taken. Documents carry authorship, software versions, and edit history. exiftool surfaces all of it, across thousands of tags and hundreds of file formats, which makes it a staple of OSINT and forensics — a single photo’s metadata can reveal who, when, and where. It can just as easily strip or rewrite that data.

Official-repo package (as perl-image-exiftool); Security → Digital Forensics → exiftool. The command is exiftool.

The help it prints

exiftool’s documentation is huge; this is the top of it — the synopsis and the start of the options:

NAME
    exiftool - Read and write meta information in files

SYNOPSIS
  Reading
    exiftool [*OPTIONS*] [-*TAG*...] [--*TAG*...] *FILE*...

  Writing
    exiftool [*OPTIONS*] -*TAG*[+-^<]=[*VALUE*]... *FILE*...

  Copying
    exiftool [*OPTIONS*] -tagsFromFile *SRCFILE* [-[*DSTTAG*<]*SRCTAG*...]
    *FILE*...

  Other
    exiftool [ -ver | -list[w|f|r|wf|g[*NUM*]|d|x|geo] ]

    For specific examples, see the EXAMPLES sections below.

    This documentation is displayed if exiftool is run without an input
    *FILE* when one is expected.

DESCRIPTION
    A command-line interface to Image::ExifTool, used for reading and
    writing meta information in a variety of file types. *FILE* is one or
    more source file names, directory names, or "-" for the standard input.
    Metadata is read from source files and printed in readable form to the
    console (or written to output text files with -w).

    To write or delete metadata, tag values are assigned using
    -*TAG*=[*VALUE*], and/or the -geotag, -csv= or -json= options. To copy
    or move metadata, the -tagsFromFile feature is used. By default the
    original files are preserved with "_original" appended to their names --
    be sure to verify that the new files are OK before erasing the
    originals. Once in write mode, exiftool will ignore any read-specific
    options.

    Note: If *FILE* is a directory name then only supported file types in
    the directory are processed (in write mode only writable types are
    processed). However, files may be specified by name, or the -ext option
    may be used to force processing of files with any extension. Hidden
    files in the directory are also processed. Adding the -r option causes
    subdirectories to be processed recursively, but subdirectories with
    names beginning with "." are skipped unless -r. is used.

    Below is a list of file types and meta information formats currently
    supported by ExifTool (r = read, w = write, c = create):

      File Types
      ------------+-------------+-------------+-------------+------------
      360   r/w   | DR4   r/w/c | JP2   r/w   | ODS   r     | RW2   r/w
      3FR   r     | DSF   r     | JPEG  r/w   | ODT   r     | RWL   r/w
      3G2   r/w   | DSS   r     | JSON  r     | OFR   r     | RWZ   r
      3GP   r/w   | DV    r     | JXL   r/w   | OGG   r     | RM    r
      7Z    r     | DVB   r/w   | K25   r     | OGV   r     | SEQ   r
      A     r     | DVR-MS r    | KDC   r     | ONP   r     | SKETCH r
      AA    r     | DYLIB r     | KEY   r     | OPUS  r     | SO    r
      AAC   r     | EIP   r     | KVAR  r     | ORF   r/w   | SR2   r/w
      AAE   r     | EPS   r/w   | LA    r     | ORI   r/w   | SRF   r
      AAX   r/w   | EPUB  r     | LFP   r     | OTF   r     | SRW   r/w
      ACR   r     | ERF   r/w   | LIF   r     | PAC   r     | SVG   r
      AFM   r     | EXE   r     | LNK   r     | PAGES r     | SWF   r
      AI    r/w   | EXIF  r/w/c | LRV   r/w   | PBM   r/w   | THM   r/w
      AIFF  r     | EXR   r     | M2TS  r     | PCAP  r     | TIFF  r/w
      APE   r     | EXV   r/w/c | M4A/V r/w   | PCAPNG r    | TNEF  r
      ARQ   r/w   | F4A/V r/w   | MACOS r     | PCD   r     | TORRENT r
      ARW   r/w   | FFF   r/w   | MAX   r     | PCX   r     | TTC   r
      ASF   r     | FITS  r     | MEF   r/w   | PDB   r     | TTF   r
      AVI   r     | FLA   r     | MIE   r/w/c | PDF   r/w   | TXT   r
      AVIF  r/w   | FLAC  r     | MIFF  r     | PEF   r/w   | URL   r
      AZW   r     | FLIF  r/w   | MKA   r     | PFA   r     | VCF   r
      BMP   r     | FLV   r     | MKS   r     | PFB   r     | VNT   r
      BPG   r     | FPF   r     | MKV   r     | PFM   r     | VRD   r/w/c
      BTF   r     | FPX   r     | MNG   r/w   | PGF   r     | VSD   r
      C2PA  r     | GIF   r/w   | MOBI  r     | PGM   r/w   | VSDX  r
      CHM   r     | GLV   r/w   | MODD  r     | PLIST r     | WAV   r
      COS   r     | GPR   r/w   | MOI   r     | PICT  r     | WDP   r/w
      CR2   r/w   | GZ    r     | MOS   r/w   | PMP   r     | WEBP  r/w
      CR3   r/w   | HDP   r/w   | MOV   r/w   | PNG   r/w   | WEBM  r
      CRM   r/w   | HDR   r     | MP3   r     | PPM   r/w   | WMA   r

    ... (abridged)

Run `man exiftool` in the terminal for the complete option list.

Examples

# Show all metadata in a file
exiftool photo.jpg

# Just the GPS location (if present)
exiftool -gps:all photo.jpg

# Pull metadata from every file in a directory
exiftool -r -gps:GPSLatitude -gps:GPSLongitude ./images/

# Strip all metadata (privacy)
exiftool -all= document.pdf

# Rewrite a specific tag
exiftool -Artist="Jane Doe" photo.jpg

For thorough, format-aware metadata removal before publishing something, also see mat2.