Back to OSINT guides

ExifTool Guide

The Swiss army knife of metadata. Extract, analyze and edit metadata from more than 500 file formats for your OSINT investigations.

500+ Formats
GPS & EXIF
Read/Write

What is ExifTool?

ExifTool is a Perl library and command-line tool to read, write and edit metadata in media files. Developed by Phil Harvey, it is the reference tool for metadata extraction in OSINT, forensics and photography.

Universal extraction
More than 500 supported file formats
Geolocation
Precise GPS extraction from photos and videos
Full read/write
Edit and remove metadata
Cross-platform
Windows, macOS, Linux with a powerful CLI

Key features

Advanced capabilities for metadata analysis

Full extraction

Read all EXIF, IPTC, XMP and GPS metadata across more than 500 file formats

500+ formats
EXIFIPTCXMPGPS

Geolocation

Extract GPS coordinates and see exactly where photos were taken

Precise GPS
LatitudeLongitudeAltitude

Device information

Full details on the camera, lens and shooting settings

Device info
ModelSettingsLogiciel

Horodatage

Creation, modification and digitization dates with time zones and history

Timestamps
CreationModificationTimezone

Metadata editing

Edit, add and remove metadata while preserving file integrity

Read/Write
WritingSuppressionBatch

Cross-platform

Works on Windows, macOS and Linux with a powerful command-line interface

Cross-platform
WindowsmacOSLinux

Metadata types

Supported metadata standards and formats

EXIF

Exchangeable Image File Format - the photo standard

Camera modelISOOuvertureVitesseFlashFocale

IPTC

International Press Telecommunications Council - press

CopyrightCaptionKeywordsCreditSourceContact

XMP

Extensible Metadata Platform - Adobe

RatingLabelHistoriqueCollectionsDevelopmentTags

GPS

Global Positioning System - geolocation

LatitudeLongitudeAltitudeDirectionVitesseTimestamp

File

File system information

TailleMIME typePermissionsSystem datesEncodageHash

Maker Notes

Proprietary vendor data

CanonNikonSonyFujifilmOlympusPanasonic

Supported file formats

More than 500 different file types

Images

JPEG/JPG
Standard photo format with full EXIF
PNG
Uncompressed images with XMP metadata
TIFF
Professional format with extended tags
RAW
Raw formats (CR2, NEF, ARW, DNG)
HEIC/HEIF
Apple format with geolocation

Documents

PDF
Author, software, creation dates
DOCX
Microsoft Word documents with history
XLSX
Excel spreadsheets with metadata
PPTX
PowerPoint presentations

Video

MP4
Videos with GPS and camera information
MOV
Format Apple QuickTime
AVI
Videos with codec and duration
MKV
Full multimedia container

Audio

MP3
ID3 tags with artist, album, year
WAV
Uncompressed audio metadata
FLAC
Lossless audio with Vorbis tags
M4A
Apple audio with iTunes metadata

Practical use cases

Real-world ExifTool scenarios

Photo OSINT investigation

Full metadata extraction from a photo for an investigation

Detailed workflow

1
Basic extraction

exiftool photo.jpg for an overview

2
GPS extraction

exiftool -GPS* photo.jpg for location

3
Device info

exiftool -Make -Model -Software photo.jpg

4
Timestamps

exiftool -DateTimeOriginal -CreateDate photo.jpg

5
Export JSON

exiftool -j photo.jpg > metadata.json

6
GPS visualization

Use the coordinates in Google Maps

Document forensics

Investigating the origin and history of a suspicious document

Detailed workflow

1
Full scan

exiftool -a -G1 document.pdf

2
Author & creator

exiftool -Author -Creator -Producer document.pdf

3
Historique

exiftool -ModifyDate -CreateDate -MetadataDate

4
Source software

Identify the authoring software and version

5
Change detection

Compare dates to detect tampering

6
Report export

Generate an HTML report with all the data

Metadata cleanup

Remove all sensitive metadata before publishing

Detailed workflow

1
Back up the original

Copy the file before editing

2
Check

exiftool image.jpg to see current metadata

3
Remove GPS

exiftool -GPS*= image.jpg

4
Remove everything

exiftool -all= image.jpg

5
Validation

Check that the metadata is gone

6
Batch processing

exiftool -all= -r folder/ for a whole folder

Command examples

Practical commands for different scenarios

Basic extraction

exiftool image.jpg

Show all metadata of an image

LectureComplet
exiftool -s image.jpg

Show with short tag names

CompactTags
exiftool -a -G1 image.jpg

All tags with groups (-a = duplicates, -G1 = groups)

DetailedGroupes

GPS & location

exiftool -GPS* image.jpg

Extract all GPS data (latitude, longitude, altitude)

GPSLocalisation
exiftool -GPSLatitude -GPSLongitude image.jpg

Precise GPS coordinates only

Coordinates
exiftool -n -GPS* image.jpg

GPS coordinates in decimal format (-n)

DecimalPrecise

Modification

exiftool -Author="John Doe" image.jpg

Edit the Author tag

WritingModification
exiftool -all= image.jpg

Remove ALL metadata

SuppressionNettoyage
exiftool -GPS*= image.jpg

Remove GPS data only

GPSPrivacy

Export & Batch

exiftool -j image.jpg > metadata.json

Export metadata to JSON

JSONExport
exiftool -csv -r folder/ > report.csv

Export every file in a folder to CSV

CSVRecursive
exiftool -all= -r -ext jpg folder/

Clean every JPG image in a folder

BatchNettoyage

Best practices

Recommendations for optimal use

Do

  • Back up originals
    Always make a copy before editing metadata
  • Use the -a -G1 options
    Show all tags with their groups for a complete analysis
  • Export to JSON/CSV
    Structured formats for analysis and documentation
  • Check GPS with -n
    The -n option gives precise decimal coordinates
  • Document investigations
    Keep track of commands and results for reports
  • Safe batch processing
    Test on one file before recursive processing

Avoid

  • Editing without a backup
    Changes may be irreversible
  • Ignoring warnings
    Warnings often point to real problems
  • Relying on GPS alone
    GPS data can be spoofed or inaccurate
  • Ignoring the law
    Respect privacy and copyright
  • Deleting blindly
    Check before deleting with -all=
  • Skipping validation
    Always check results after editing

Installation

Cross-platform installation guide

1

Linux (Debian/Ubuntu)

sudo apt update && sudo apt install libimage-exiftool-perl

or simply

sudo apt install exiftool
2

macOS (Homebrew)

brew install exiftool

Or via MacPorts:

sudo port install p5-image-exiftool
3

Windows

Download the standalone executable from the official website

https://exiftool.org/

Download exiftool(-k).exe and add it to your PATH

4

Checking the installation

exiftool -ver

Should display the version number (12.70+)

Privacy considerations

Metadata can contain sensitive information (GPS location, author, edit history). Make sure you respect privacy and data protection laws when extracting and sharing metadata.

Common sensitive data:

  • Exact GPS coordinates where the photo was taken
  • Device and owner information
  • Precise creation/modification dates and times
  • Author, organization and revision history

Resources and documentation

Useful links to go further

Official ExifTool website

Full documentation, downloads and FAQ

Visit the website

Tag Names Reference

Complete list of all supported tags

Browse

Community forum

Support, questions and shared experience

Join

GitHub Repository

Source code, issues and contributions

View the code

Ready to analyze your metadata?

Discover other OSINT tools and improve your digital investigation skills

See case studiesOther OSINT guides
CyberXTEL
100% Free

Ready to put it into practice?

CyberXTEL is our free platform to train hands-on: certifications, CTFs and a dedicated cyber awareness space.

Discover CyberXTEL