ExifTool is a platform-independent Perl library and command-line application for reading, writing, and editing metadata embedded in a huge variety of file formats — most famously EXIF (Exchangeable Image File Format) data in JPEG/TIFF images, but also IPTC, XMP, GPS, ICC Profile, Photoshop IRB, and format-specific metadata across images, videos, audio files, PDFs, Office documents, and even proprietary camera RAW formats. Written and maintained by Phil Harvey, ExifTool is widely regarded as the most comprehensive metadata tool available, supporting thousands of metadata tags across hundreds of file types.
In digital forensics, ExifTool is essential for extracting evidentiary metadata: the make/model of the camera or phone that took a photo, GPS coordinates embedding exact location, timestamps (which may differ from file system timestamps and are harder to spoof), software used to create or edit a file, author/creator information embedded in documents, and thumbnail images that may still exist even after the original was cropped or edited (revealing what was removed). ExifTool can also detect metadata inconsistencies that suggest tampering, such as a “last modified” timestamp inside the file that predates the file’s supposed creation date.
Key capabilities:
- Read metadata from over 30 different metadata formats across 100+ file types
- Write/edit/remove metadata tags (useful for redacting sensitive information before disclosure)
- Batch processing of entire directories recursively
- GPS coordinate extraction and conversion to human-readable format
- Extraction of embedded thumbnail/preview images
- Duplicate/renaming file operations based on metadata (e.g., rename by capture date)
- Output in multiple formats: plain text, CSV, JSON, XML
- Support for custom tag definitions and configuration files
Installation
Kali Linux (via APT):
sudo apt update
sudo apt install libimage-exiftool-perl -y
Verify installation:
exiftool -ver
Expected output:
12.76
Manual installation (latest version from source):
wget https://exiftool.org/Image-ExifTool-12.90.tar.gz
tar -xzf Image-ExifTool-12.90.tar.gz
cd Image-ExifTool-12.90
perl Makefile.PL
make
sudo make install
Standalone executable (no Perl install required, alternative method):
wget https://exiftool.org/exiftool-12.90.zip
unzip exiftool-12.90.zip
chmod +x exiftool
sudo mv exiftool /usr/local/bin/exiftool
Syntax
exiftool [options] <file_or_directory>
Command-Line Options
| Option | Description |
|---|---|
-a | Allow duplicate tags to be extracted (show all instances) |
-G | Print group name for each tag (e.g., EXIF:, IPTC:, XMP:) |
-s | Print tag names instead of descriptions (short output) |
-j | Output in JSON format |
-X | Output in XML format |
-csv | Output in CSV format (useful for batch reporting) |
-r | Recursively process subdirectories |
-ee | Extract embedded metadata (e.g., from video frame-level data) |
-b | Output tag value in binary format (used for extracting embedded images) |
-ThumbnailImage | Extract the embedded thumbnail image from a JPEG |
-PreviewImage | Extract the embedded full-size preview image (common in RAW files) |
-gps:all | Display all GPS-related tags |
-time:all | Display all date/time-related tags |
-all= | Remove ALL metadata from a file |
-tagsFromFile <src> | Copy metadata tags from a source file to the target file |
-overwrite_original | Overwrite the original file instead of creating a backup (_original) copy |
-o <file> | Write output to a specified file instead of stdout |
-w <ext> | Write output for each processed file to a separate file with the given extension |
-n | Print numerical values instead of human-readable conversions (e.g., raw GPS decimal degrees) |
-d <format> | Specify date/time format string for output |
-FileName<datetag | Rename files based on a metadata date tag |
-config <file> | Load a custom configuration file defining additional tags |
-m | Ignore minor errors and warnings during processing |
-q | Quiet mode — suppress informational messages |
-v | Verbose mode — show detailed processing information |
Basic Usage
Step 1 — Extract all metadata from a single file:
exiftool photo.jpg
Expected output:
ExifTool Version Number : 12.76
File Name : photo.jpg
File Size : 3.2 MB
Make : Apple
Camera Model Name : iPhone 13
GPS Latitude : 31 deg 31' 13.44" N
GPS Longitude : 74 deg 21' 31.32" E
Date/Time Original : 2026:06:14 15:42:11
Step 2 — Extract only GPS-related tags:
exiftool -gps:all photo.jpg
Expected output:
GPS Latitude Ref : North
GPS Latitude : 31 deg 31' 13.44" N
GPS Longitude Ref : East
GPS Longitude : 74 deg 21' 31.32" E
Step 3 — Process an entire directory recursively:
exiftool -r /home/claude/case_photos/
Expected output:
======== /home/claude/case_photos/img001.jpg
[metadata output]
======== /home/claude/case_photos/img002.jpg
[metadata output]
2 image files readPractical Examples with Output
Example 1: Basic metadata dump of a single image
exiftool suspect_photo.jpg
Output:
Make : Samsung
Camera Model Name : Galaxy S23
Date/Time Original : 2026:07:10 09:12:44
GPS Position : 31 deg 33' 5.00" N, 74 deg 19' 48.00" E
Software : Samsung Camera Firmware v2.1
Example 2: JSON output for programmatic parsing
exiftool -j suspect_photo.jpg
Output:
[{"SourceFile":"suspect_photo.jpg","Make":"Samsung","Model":"SM-S911B","GPSLatitude":31.5514,"GPSLongitude":74.3300}]
Example 3: Extracting only date/time-related tags
exiftool -time:all suspect_photo.jpg
Output:
File Modification Date/Time : 2026:07:10 09:15:03+05:00
File Access Date/Time : 2026:07:19 10:00:12+05:00
Date/Time Original : 2026:07:10 09:12:44
Create Date : 2026:07:10 09:12:44
Example 4: Recursively extracting metadata from a directory and saving as CSV
exiftool -r -csv /home/claude/case_photos/ > /home/claude/case_metadata.csv
head -3 /home/claude/case_metadata.csv
Output:
SourceFile,FileName,Make,Model,DateTimeOriginal,GPSLatitude,GPSLongitude
/home/claude/case_photos/img001.jpg,img001.jpg,Samsung,SM-S911B,2026:07:10 09:12:44,31.5514,74.3300
Example 5: Extracting the embedded thumbnail image
exiftool -b -ThumbnailImage suspect_photo.jpg > thumbnail_extracted.jpg
file thumbnail_extracted.jpg
Output:
thumbnail_extracted.jpg: JPEG image data, 160x120
Example 6: Removing all metadata (for redaction before evidence sharing)
exiftool -all= -overwrite_original redacted_photo.jpg
exiftool redacted_photo.jpg
Output:
File Name : redacted_photo.jpg
File Size : 2.9 MB
Warning : No EXIF/IPTC/XMP metadata found
Example 7: Copying metadata from one file to another (chain of evidence verification)
exiftool -tagsFromFile original.jpg copy.jpg
Output:
1 image files updated
Example 8: Renaming files by embedded capture date/time
exiftool "-FileName<DateTimeOriginal" -d "%Y%m%d_%H%M%S.%%e" /home/claude/case_photos/
Output:
'img001.jpg' --> '20260710_091244.jpg'
'img002.jpg' --> '20260711_143012.jpg'
Example 9: Displaying raw numerical GPS coordinates for mapping tools
exiftool -n -gps:GPSLatitude -gps:GPSLongitude suspect_photo.jpg
Output:
GPS Latitude : 31.5514
GPS Longitude : 74.3300
Example 10: Checking for metadata tampering indicators
exiftool -a -G1 -s suspect_photo.jpg | grep -i "software\|modif"
Output:
[EXIF] Software : Adobe Photoshop 2026
[EXIF] ModifyDate : 2026:07:15 22:04:11
[File] FileModifyDate : 2026:07:10 09:12:44
(Note the discrepancy: file system date predates the embedded EXIF ModifyDate — a red flag suggesting the file was edited after the file system timestamp, or the timestamps were manipulated.)
Example 11: Extracting metadata from a PDF document
exiftool document.pdf
Output:
Creator : Microsoft Word
Producer : Microsoft: Print To PDF
Create Date : 2026:06:01 14:22:03
Author : J. Doe
Example 12: Batch verbose scan with error tolerance for a mixed evidence folder
exiftool -r -m -q -csv /home/claude/mixed_evidence/ > /home/claude/full_metadata_report.csv
wc -l /home/claude/full_metadata_report.csv
Output:
1247 /home/claude/full_metadata_report.csv
Common Use Cases
- Geolocation of digital images: Extracting GPS coordinates embedded in photos to establish where a suspect was at a given time.
- Camera/device attribution: Determining the make/model/serial number of the device used to capture an image, potentially matching it to a seized device.
- Timeline verification: Comparing embedded metadata timestamps against file system timestamps to detect tampering or backdating.
- Document provenance investigations: Extracting author, editing software, and revision history from Office documents and PDFs.
- Evidence redaction: Stripping metadata before releasing files publicly or to opposing counsel in legal discovery, to protect sensitive location/identity data.
- Recovering hidden/cropped content: Extracting embedded thumbnails that may still show the full original (uncropped) image.
- Malware/phishing investigations: Inspecting metadata of email attachments or downloaded files for authorship clues.
Automation with Bash
#!/bin/bash
# exiftool_batch_report.sh - Batch metadata extraction and GPS mapping report
TARGET_DIR="$1"
OUTDIR="exif_report_$(date +%Y%m%d_%H%M%S)"
if [ -z "$TARGET_DIR" ]; then
echo "Usage: $0 <target_directory>"
exit 1
fi
mkdir -p "$OUTDIR"
echo "[*] Extracting full metadata (CSV)..."
exiftool -r -m -csv "$TARGET_DIR" > "$OUTDIR/full_metadata.csv"
echo "[*] Extracting GPS coordinates only..."
exiftool -r -n -csv -gps:GPSLatitude -gps:GPSLongitude -FileName "$TARGET_DIR" > "$OUTDIR/gps_coordinates.csv"
echo "[*] Extracting device make/model summary..."
exiftool -r -csv -Make -Model -FileName "$TARGET_DIR" > "$OUTDIR/device_summary.csv"
echo "[*] Checking for possible timestamp tampering..."
exiftool -r -a -G1 -s "$TARGET_DIR" | grep -B5 -i "software\|modifydate" > "$OUTDIR/tamper_check.txt"
echo "[*] Report generated in $OUTDIR/"
Run:
chmod +x exiftool_batch_report.sh
./exiftool_batch_report.sh /home/claude/case_photos/
Tips and Best Practices
- Always work on copies of evidence files — writing/removing metadata with ExifTool modifies files in place unless output is redirected.
- Use
-overwrite_originalcautiously — by default ExifTool preserves a_originalbackup copy, which is useful for evidentiary integrity but consumes extra disk space. - Use
-nfor numerical/raw output when feeding coordinates or values into other scripts or mapping tools. - Cross-reference embedded metadata timestamps against file system MAC times (via Sleuth Kit
istat/fls) to identify inconsistencies suggesting tampering. - Use
-csvor-joutput for large batches — it integrates far more easily with spreadsheets, databases, or further scripted analysis than plain text output. - Remember that metadata can be intentionally stripped or falsified by a sophisticated suspect — treat ExifTool findings as one piece of evidence, not absolute proof.
- Use
-configto define custom tags when working with proprietary or unusual file formats encountered in a case. - When redacting for public release, always verify with a second
exiftoolpass after-all=to confirm no metadata remains.
Troubleshooting
| Problem | Cause | Solution |
|---|---|---|
| “File format not recognized” | Truncated, corrupted, or unsupported file type | Use file command to verify actual file type; try -m to ignore minor errors |
| Warning: “Tag not found” for expected GPS/EXIF data | Metadata was stripped or was never present (e.g., messaging apps often strip EXIF) | Check original/source file rather than a downloaded/shared copy |
| Command hangs on very large directories | Extremely large recursive batch job | Break into smaller batches, or add -q for quieter/faster processing |
| Output file permissions error | Insufficient write permissions in target directory | Redirect output (>) to a writable directory instead of processing in place |
| Renaming operation fails/skips files | Missing DateTimeOriginal tag in some files | Use a fallback tag chain: "-FileName<DateTimeOriginal" "-FileName<CreateDate" "-FileName<FileModifyDate" |
Backup _original files cluttering directory | Default backup behavior after modification | Use -overwrite_original intentionally, or clean up *_original files after verifying changes |
| Unicode/special character issues in output | Locale/encoding mismatch | Set -charset UTF8 or ensure terminal locale is UTF-8 |
References
- Official website and documentation: https://exiftool.org
- ExifTool tag name reference: https://exiftool.org/TagNames/
- Kali Linux ExifTool tool page: https://www.kali.org/tools/exiftool/
- Phil Harvey’s ExifTool FAQ: https://exiftool.org/faq.html
- SWGDE “Best Practices for Image Authentication” (metadata analysis context)