GO KALI FREE

ExifTool

Forensics

Beginnerlow risk

ExifTool is a platform-independent tool for reading, writing, and editing metadata in a wide variety of files including images, audio, and video.

Installation

sudo apt install libimage-exiftool-perl

Basic Syntax

exiftool [options] <file>

Quick Facts

Full Name
ExifTool (Phil Harvey's Image Metadata Tool)
License
Artistic License (Open Source)
Author
Phil Harvey
Written In
Perl
Platforms
Linux, Windows, macOS
Category
Metadata Analysis
First Release
2003
Format Support
400+ file formats

Tool Overview

ExifTool is the most widely used tool for reading, writing, and editing metadata in files. It supports over 400 file formats and hundreds of metadata tags including EXIF, IPTC, XMP, GPS, and proprietary manufacturer data.

Created by Phil Harvey, ExifTool is essential for digital forensics, OSINT investigations, photography workflows, and privacy protection. It can extract timestamps, GPS coordinates, camera settings, software versions, and other embedded information from virtually any file type.

ExifTool is also powerful for metadata sanitization — stripping GPS coordinates, personal information, and other sensitive data from files before public sharing. Its batch processing capabilities make it suitable for analyzing large collections of files efficiently.

Common Commands

exiftool image.jpgDisplay all metadata from a file
exiftool /path/to/fileRead EXIF, IPTC, XMP and MakerNotes from any supported file
exiftool -a -u -g1 image.jpgShow all tags including duplicates and unknown, grouped by location
exiftool -G1 -s image.jpgList metadata with group names and short tag IDs
exiftool -s -s -s -Model image.jpgPrint only the value of the Model tag with no tag name
exiftool -common /path/to/fileShow only the common meta information tags
exiftool -GPS:all image.jpgExtract only tags in the GPS group
exiftool "-GPS*" image.jpgExtract GPS-related tags using a wildcard
exiftool -json image.jpgOutput metadata in JSON format
exiftool -X image.jpgOutput metadata as RDF/XML
exiftool -csv /path/to/file > out.csvExport metadata for a directory of files to CSV
exiftool -htmlDump image.jpg > dump.htmlProduce an HTML byte-level dump of the file structure
exiftool -Author="<USER>" image.jpgWrite or overwrite the Author tag value
exiftool -all= image.jpgRemove all metadata from a file
exiftool -all= -overwrite_original image.jpgStrip all metadata in place without keeping a backup copy

Step-by-Step Guide

  1. 1Execute the command pointing at your target file
  2. 2Analyze the extensive list of embedded tags
  3. 3Look specifically for geolocation coordinates
  4. 4Take note of device models, operating systems, and timestamp data
  5. 5Strip the data entirely if preparing a file for safe publication

Warnings

Use Cases

OSINT Investigations

Extract GPS coordinates, timestamps, and device information from images for intelligence gathering.

Privacy Protection

Strip metadata from files before sharing to remove GPS locations, names, and device identifiers.

Forensic Evidence

Extract timestamps and device info from files to establish timelines and authenticate evidence.

Photography Workflow

Batch rename, organize, and edit metadata in photo collections based on camera settings.

Copyright Investigation

Extract author and copyright information from digital files to identify ownership.

Key Features

Related Tools

Steghide

Forensics

Steganography tool for hiding data within image and audio files.

Foremost

Forensics

File carving tool for recovering deleted files from disk images.

Binwalk

Forensics

Firmware analysis tool for scanning and extracting embedded content.

Frequently Asked Questions

What is ExifTool used for?

ExifTool is used to read, write, and edit metadata in files. It extracts EXIF, IPTC, XMP, GPS, and hundreds of other metadata tags from images, audio, video, and documents for forensic investigation, OSINT, and privacy protection.

Can ExifTool remove all metadata from a file?

Yes, ExifTool can strip all metadata from files using the -all= flag. This is useful for sanitizing files before public distribution to protect privacy and remove GPS coordinates.

What file formats does ExifTool support?

ExifTool supports over 400 file formats including JPEG, PNG, TIFF, RAW camera formats, PDF, MP3, MP4, MOV, DOCX, and many more. It handles metadata in EXIF, IPTC, XMP, and proprietary manufacturer formats.

Is ExifTool safe to use?

ExifTool is safe for reading metadata. Write operations should be tested on copies first, as modifying metadata can occasionally affect file compatibility. Always backup files before batch editing.

Tags

#forensics#metadata#analysis

Output Explanation

Prints a detailed list of all embedded tags hidden within the file, which often includes hardware identifiers, timestamps, software versions, and geographic coordinates.

Ethical Usage Notice

This tool is designed for authorized security testing, educational purposes, and legitimate network administration only. Unauthorized access to computer systems is illegal.