Example of GPS data retrieved from an image metadata on EXIF.tools
Metadata: Hidden Data Inside Your Files
Files contain hidden data about their origin, author, device, and location. Learn how to extract and analyze metadata for OSINT investigations.
What Is Metadata?
Metadata is information automatically stored inside files. It can be who created them, when, with what software and with what device. These 'hidden' details can reveal valuable insights during OSINT investigations.
Metadata is not really hidden, it's just not shown when opening files with common tools, such as image or pdf viewers. This data is located in the first bits of files, and can be extracted from each document.
Common Metadata Fields
- DateTimeOriginal: When the file was created or captured.
- GPSLatitude / GPSLongitude: Where a photo was taken. This data is almost always removed when images are uploaded on a website (social media, messaging apps, etc. almost all of these websites remove the location data)
- Author / Creator: Who created or edited the document.
- Software: The program used to generate the file.
It's worth noting that each type of document has different fields of metadata, e.g. PDF files will never have GPS coordinates.
How to Extract Metadata
There are multiple ways to view metadata safely:
- Online tools like exif.tools or Online-Metadata.
- Command-line tools like
exiftool. Simply typingexiftoolfollowed by the name of the file will show relevant metadata:exiftool image.jpg
Metadata can help us confirm authorship, location, or the authenticity of a file. For example, a photo's EXIF data might reveal GPS coordinates or the model of the camera used.
Privacy and Removal
As said earlier, most platforms automatically strip metadata for privacy reasons. However, files shared via email, messaging apps, or websites may still contain it, as it's not done automatically (developers must think to add the correct line of code to strip metadata on server side). Always check before uploading sensitive images.
