Image Metadata – Hidden Information Inside the File

Digital images often contain much more information than what the eye perceives. The file carries 

Exposure settings and resolution information

This information can be useful in many OSINT situations: for example, the exact location of the image can be determined if GPS data has been recorded. Inferences can be made about the time the photo was taken, and software details may reveal modifications or manipulation of the images.

Metadata can be a crucial clue in an reconnaissance situation:

 can reveal where the photo was taken – and from there, more precise information can be accessed using tools like Google Maps or map services.

 can indicate when the photo was taken or reveal inconsistencies (e.g., if it's claimed that the image is recent but the file is three years old).

 can indicate whether the image has been altered (e.g., use of Photoshop vs. direct saving from the camera).

For example, an investigative journalist can compare the metadata of multiple images to determine the order in which events occurred or which image is likely manipulated. Similarly, a security expert can verify whether an image uploaded to a website was inadvertently left with metadata, which might reveal the uploader's name, software, or GPS data.

Anonymization: Removing Metadata Protects Privacy

Many people are unaware that the photos they take can contain precise information about their location or the devices they used. Therefore, 

 of files is an important part of secure communication and publishing.

Anonymization can be performed, for example, using ExifTool. This can protect an individual's privacy, but it can also hinder OSINT investigations – which is precisely why data security experts always recommend removing metadata before publication.

ExifTool – a powerful tool for reading and editing metadata

 is a command-line tool used for examining, editing, and removing metadata from various file formats – especially image files (such as JPG, PNG, HEIC).

Display all available metadata from an image file

Display only the GPS coordinates if they are present

Display the original capture time of the image if it is available

Add or modify the "Artist" fields information in the metadata

Remove the camera model from the metadata

Remove all metadata from the image (for anonymization purposes)

Examine the photo in your home directory and locate where the photo was taken. Additionally, try editing the metadata of the image for training purposes with the commands above.

OSINT

## Image Metadata – Hidden Information Inside the File

Digital images often contain much more information than what the eye perceives. The file carries **metadata**, which can include, for example:

- Camera brand and model
- Exact time the photo was taken
- Location data (GPS coordinates)
- Image editing programs
- File creation and modification dates
- Exposure settings and resolution information

This information can be useful in many OSINT situations: for example, the exact location of the image can be determined if GPS data has been recorded. Inferences can be made about the time the photo was taken, and software details may reveal modifications or manipulation of the images.

---

## The Use of Metadata in OSINT

Metadata can be a crucial clue in an reconnaissance situation:

- **Geolocation data** can reveal where the photo was taken – and from there, more precise information can be accessed using tools like Google Maps or map services.
- **Creation times** can indicate when the photo was taken or reveal inconsistencies (e.g., if it's claimed that the image is recent but the file is three years old).
- **Remnants of image editing software** can indicate whether the image has been altered (e.g., use of Photoshop vs. direct saving from the camera).

For example, an investigative journalist can compare the metadata of multiple images to determine the order in which events occurred or which image is likely manipulated. Similarly, a security expert can verify whether an image uploaded to a website was inadvertently left with metadata, which might reveal the uploader's name, software, or GPS data.

---

## Anonymization: Removing Metadata Protects Privacy

Many people are unaware that the photos they take can contain precise information about their location or the devices they used. Therefore, **anonymization** of files is an important part of secure communication and publishing.

Anonymization can be performed, for example, using ExifTool. This can protect an individual's privacy, but it can also hinder OSINT investigations – which is precisely why data security experts always recommend removing metadata before publication.

---

## ExifTool – a powerful tool for reading and editing metadata

[**ExifTool**](https://exiftool.org/) is a command-line tool used for examining, editing, and removing metadata from various file formats – especially image files (such as JPG, PNG, HEIC).

Examples of using ExifTool:

- Display all available metadata from an image file

```sh
exiftool image.jpg
```

- Display only the GPS coordinates if they are present

```sh
exiftool -gpslatitude -gpslongitude image.jpg
```

- Display the original capture time of the image if it is available

```sh
exiftool -createdate kuva.jpg
```

- Add or modify the "Artist" fields information in the metadata

```sh
exiftool -artist="John Doe" kuva.jpg
```

- Remove the camera model from the metadata

```sh
exiftool -model="" kuva.jpg
```

- Remove all metadata from the image (for anonymization purposes)

```sh
exiftool -all= image.jpg
```

@exercise 5aeeb2f659e0

@exercise f9633920d16a


OSINT and metadata

In today's world, the value of information has reached an all-time high. But did you know that a vast amount of useful – even critical – information is available completely openly? This is called OSINT, or Open Source Intelligence – intelligence gathered from publicly accessible sources.

In today's world, the value of information has reached an all-time high. But did you know that a vast amount of useful – even critical – information is available completely openly? This is called 

OSINT and metadata

Image Metadata – Hidden Information Inside the File

Learn to hack — start here