ExifTool: Complete Guide to Metadata Analysis and Digital Forensics Using Kali Linux

ExifTool is a platform-independent Perl library and command-line application for reading, writing, and editing metadata embedded in a huge variety of file formats — most famously EXIF (Exchangeable Image File Format) data in JPEG/TIFF images, but also IPTC, XMP, GPS, ICC Profile, Photoshop IRB, and format-specific metadata across images, videos, audio files, PDFs, Office documents, and even proprietary camera RAW formats. Written and maintained by Phil Harvey, ExifTool is widely regarded as the most comprehensive metadata tool available, supporting thousands of metadata tags across hundreds of file types.

In digital forensics, ExifTool is essential for extracting evidentiary metadata: the make/model of the camera or phone that took a photo, GPS coordinates embedding exact location, timestamps (which may differ from file system timestamps and are harder to spoof), software used to create or edit a file, author/creator information embedded in documents, and thumbnail images that may still exist even after the original was cropped or edited (revealing what was removed). ExifTool can also detect metadata inconsistencies that suggest tampering, such as a “last modified” timestamp inside the file that predates the file’s supposed creation date.

Key capabilities:

• Read metadata from over 30 different metadata formats across 100+ file types
• Write/edit/remove metadata tags (useful for redacting sensitive information before disclosure)
• Batch processing of entire directories recursively
• GPS coordinate extraction and conversion to human-readable format
• Extraction of embedded thumbnail/preview images
• Duplicate/renaming file operations based on metadata (e.g., rename by capture date)
• Output in multiple formats: plain text, CSV, JSON, XML
• Support for custom tag definitions and configuration files

Installation

Kali Linux (via APT):

sudo apt update
sudo apt install libimage-exiftool-perl -y

Verify installation:

exiftool -ver

Expected output:

12.76

Manual installation (latest version from source):

wget https://exiftool.org/Image-ExifTool-12.90.tar.gz
tar -xzf Image-ExifTool-12.90.tar.gz
cd Image-ExifTool-12.90
perl Makefile.PL
make
sudo make install

Standalone executable (no Perl install required, alternative method):

wget https://exiftool.org/exiftool-12.90.zip
unzip exiftool-12.90.zip
chmod +x exiftool
sudo mv exiftool /usr/local/bin/exiftool

Syntax

exiftool [options] <file_or_directory>

Command-Line Options

Option	Description
-a	Allow duplicate tags to be extracted (show all instances)
-G	Print group name for each tag (e.g., EXIF:, IPTC:, XMP:)
-s	Print tag names instead of descriptions (short output)
-j	Output in JSON format
-X	Output in XML format
-csv	Output in CSV format (useful for batch reporting)
-r	Recursively process subdirectories
-ee	Extract embedded metadata (e.g., from video frame-level data)
-b	Output tag value in binary format (used for extracting embedded images)
-ThumbnailImage	Extract the embedded thumbnail image from a JPEG
-PreviewImage	Extract the embedded full-size preview image (common in RAW files)
-gps:all	Display all GPS-related tags
-time:all	Display all date/time-related tags
-all=	Remove ALL metadata from a file
-tagsFromFile <src>	Copy metadata tags from a source file to the target file
-overwrite_original	Overwrite the original file instead of creating a backup (_original) copy
-o <file>	Write output to a specified file instead of stdout
-w <ext>	Write output for each processed file to a separate file with the given extension
-n	Print numerical values instead of human-readable conversions (e.g., raw GPS decimal degrees)
-d <format>	Specify date/time format string for output
-FileName<datetag	Rename files based on a metadata date tag
-config <file>	Load a custom configuration file defining additional tags
-m	Ignore minor errors and warnings during processing
-q	Quiet mode — suppress informational messages
-v	Verbose mode — show detailed processing information

Basic Usage

Step 1 — Extract all metadata from a single file:

exiftool photo.jpg

Expected output:

ExifTool Version Number         : 12.76
File Name                       : photo.jpg
File Size                       : 3.2 MB
Make                            : Apple
Camera Model Name               : iPhone 13
GPS Latitude                    : 31 deg 31' 13.44" N
GPS Longitude                   : 74 deg 21' 31.32" E
Date/Time Original               : 2026:06:14 15:42:11

Step 2 — Extract only GPS-related tags:

exiftool -gps:all photo.jpg

Expected output:

GPS Latitude Ref                : North
GPS Latitude                    : 31 deg 31' 13.44" N
GPS Longitude Ref                : East
GPS Longitude                   : 74 deg 21' 31.32" E

Step 3 — Process an entire directory recursively:

exiftool -r /home/claude/case_photos/

Expected output:

======== /home/claude/case_photos/img001.jpg
[metadata output]
======== /home/claude/case_photos/img002.jpg
[metadata output]
    2 image files read

Practical Examples with Output

Example 1: Basic metadata dump of a single image

exiftool suspect_photo.jpg

Output:

Make                : Samsung
Camera Model Name   : Galaxy S23
Date/Time Original  : 2026:07:10 09:12:44
GPS Position         : 31 deg 33' 5.00" N, 74 deg 19' 48.00" E
Software            : Samsung Camera Firmware v2.1

Example 2: JSON output for programmatic parsing

exiftool -j suspect_photo.jpg

Output:

[{"SourceFile":"suspect_photo.jpg","Make":"Samsung","Model":"SM-S911B","GPSLatitude":31.5514,"GPSLongitude":74.3300}]

Example 3: Extracting only date/time-related tags

exiftool -time:all suspect_photo.jpg

Output:

File Modification Date/Time   : 2026:07:10 09:15:03+05:00
File Access Date/Time         : 2026:07:19 10:00:12+05:00
Date/Time Original            : 2026:07:10 09:12:44
Create Date                    : 2026:07:10 09:12:44

Example 4: Recursively extracting metadata from a directory and saving as CSV

exiftool -r -csv /home/claude/case_photos/ > /home/claude/case_metadata.csv
head -3 /home/claude/case_metadata.csv

Output:

SourceFile,FileName,Make,Model,DateTimeOriginal,GPSLatitude,GPSLongitude
/home/claude/case_photos/img001.jpg,img001.jpg,Samsung,SM-S911B,2026:07:10 09:12:44,31.5514,74.3300

Example 5: Extracting the embedded thumbnail image

exiftool -b -ThumbnailImage suspect_photo.jpg > thumbnail_extracted.jpg
file thumbnail_extracted.jpg

Output:

thumbnail_extracted.jpg: JPEG image data, 160x120

Example 6: Removing all metadata (for redaction before evidence sharing)

exiftool -all= -overwrite_original redacted_photo.jpg
exiftool redacted_photo.jpg

Output:

File Name    : redacted_photo.jpg
File Size    : 2.9 MB
Warning      : No EXIF/IPTC/XMP metadata found

Example 7: Copying metadata from one file to another (chain of evidence verification)

exiftool -tagsFromFile original.jpg copy.jpg

Output:

1 image files updated

Example 8: Renaming files by embedded capture date/time

exiftool "-FileName<DateTimeOriginal" -d "%Y%m%d_%H%M%S.%%e" /home/claude/case_photos/

Output:

'img001.jpg' --> '20260710_091244.jpg'
'img002.jpg' --> '20260711_143012.jpg'

Example 9: Displaying raw numerical GPS coordinates for mapping tools

exiftool -n -gps:GPSLatitude -gps:GPSLongitude suspect_photo.jpg

Output:

GPS Latitude   : 31.5514
GPS Longitude  : 74.3300

Example 10: Checking for metadata tampering indicators

exiftool -a -G1 -s suspect_photo.jpg | grep -i "software\|modif"

Output:

[EXIF]    Software                        : Adobe Photoshop 2026
[EXIF]    ModifyDate                      : 2026:07:15 22:04:11
[File]    FileModifyDate                  : 2026:07:10 09:12:44

(Note the discrepancy: file system date predates the embedded EXIF ModifyDate — a red flag suggesting the file was edited after the file system timestamp, or the timestamps were manipulated.)

Example 11: Extracting metadata from a PDF document

exiftool document.pdf

Output:

Creator          : Microsoft Word
Producer         : Microsoft: Print To PDF
Create Date       : 2026:06:01 14:22:03
Author            : J. Doe

Example 12: Batch verbose scan with error tolerance for a mixed evidence folder

exiftool -r -m -q -csv /home/claude/mixed_evidence/ > /home/claude/full_metadata_report.csv
wc -l /home/claude/full_metadata_report.csv

Output:

1247 /home/claude/full_metadata_report.csv

Common Use Cases

• Geolocation of digital images: Extracting GPS coordinates embedded in photos to establish where a suspect was at a given time.
• Camera/device attribution: Determining the make/model/serial number of the device used to capture an image, potentially matching it to a seized device.
• Timeline verification: Comparing embedded metadata timestamps against file system timestamps to detect tampering or backdating.
• Document provenance investigations: Extracting author, editing software, and revision history from Office documents and PDFs.
• Evidence redaction: Stripping metadata before releasing files publicly or to opposing counsel in legal discovery, to protect sensitive location/identity data.
• Recovering hidden/cropped content: Extracting embedded thumbnails that may still show the full original (uncropped) image.
• Malware/phishing investigations: Inspecting metadata of email attachments or downloaded files for authorship clues.

Automation with Bash

#!/bin/bash
# exiftool_batch_report.sh - Batch metadata extraction and GPS mapping report

TARGET_DIR="$1"
OUTDIR="exif_report_$(date +%Y%m%d_%H%M%S)"

if [ -z "$TARGET_DIR" ]; then
    echo "Usage: $0 <target_directory>"
    exit 1
fi

mkdir -p "$OUTDIR"

echo "[*] Extracting full metadata (CSV)..."
exiftool -r -m -csv "$TARGET_DIR" > "$OUTDIR/full_metadata.csv"

echo "[*] Extracting GPS coordinates only..."
exiftool -r -n -csv -gps:GPSLatitude -gps:GPSLongitude -FileName "$TARGET_DIR" > "$OUTDIR/gps_coordinates.csv"

echo "[*] Extracting device make/model summary..."
exiftool -r -csv -Make -Model -FileName "$TARGET_DIR" > "$OUTDIR/device_summary.csv"

echo "[*] Checking for possible timestamp tampering..."
exiftool -r -a -G1 -s "$TARGET_DIR" | grep -B5 -i "software\|modifydate" > "$OUTDIR/tamper_check.txt"

echo "[*] Report generated in $OUTDIR/"

Run:

chmod +x exiftool_batch_report.sh
./exiftool_batch_report.sh /home/claude/case_photos/

Tips and Best Practices

1. Always work on copies of evidence files — writing/removing metadata with ExifTool modifies files in place unless output is redirected.
2. Use -overwrite_original cautiously — by default ExifTool preserves a _original backup copy, which is useful for evidentiary integrity but consumes extra disk space.
3. Use -n for numerical/raw output when feeding coordinates or values into other scripts or mapping tools.
4. Cross-reference embedded metadata timestamps against file system MAC times (via Sleuth Kit istat/fls) to identify inconsistencies suggesting tampering.
5. Use -csv or -j output for large batches — it integrates far more easily with spreadsheets, databases, or further scripted analysis than plain text output.
6. Remember that metadata can be intentionally stripped or falsified by a sophisticated suspect — treat ExifTool findings as one piece of evidence, not absolute proof.
7. Use -config to define custom tags when working with proprietary or unusual file formats encountered in a case.
8. When redacting for public release, always verify with a second exiftool pass after -all= to confirm no metadata remains.

Troubleshooting

Problem	Cause	Solution
“File format not recognized”	Truncated, corrupted, or unsupported file type	Use file command to verify actual file type; try -m to ignore minor errors
Warning: “Tag not found” for expected GPS/EXIF data	Metadata was stripped or was never present (e.g., messaging apps often strip EXIF)	Check original/source file rather than a downloaded/shared copy
Command hangs on very large directories	Extremely large recursive batch job	Break into smaller batches, or add -q for quieter/faster processing
Output file permissions error	Insufficient write permissions in target directory	Redirect output (>) to a writable directory instead of processing in place
Renaming operation fails/skips files	Missing DateTimeOriginal tag in some files	Use a fallback tag chain: "-FileName<DateTimeOriginal" "-FileName<CreateDate" "-FileName<FileModifyDate"
Backup _original files cluttering directory	Default backup behavior after modification	Use -overwrite_original intentionally, or clean up *_original files after verifying changes
Unicode/special character issues in output	Locale/encoding mismatch	Set -charset UTF8 or ensure terminal locale is UTF-8

References

• Official website and documentation: https://exiftool.org
• ExifTool tag name reference: https://exiftool.org/TagNames/
• Kali Linux ExifTool tool page: https://www.kali.org/tools/exiftool/
• Phil Harvey’s ExifTool FAQ: https://exiftool.org/faq.html
• SWGDE “Best Practices for Image Authentication” (metadata analysis context)