Skip to content
HackIndex.io

EXIF and File Metadata Extraction

3 min read Created Aug 10, 2026 Last updated Aug 10, 2026

Overview

Embedded metadata is the fastest win in image geolocation. Cameras and phones write EXIF fields covering GPS coordinates, capture time, device make and model, and sometimes orientation and altitude. When present, a GPS tag places the image within metres. Even when coordinates are stripped, the remaining fields narrow device, timezone, and capture time, which feed chronolocation and device attribution.

  • GPS coordinates place the capture location within metres when the tag survives, ready to paste into a map or Overpass query.
  • Timestamps and timezone derive the UTC offset from OffsetTimeOriginal or GPS time, narrowing the plausible region even without coordinates.
  • Batch JSON export extracts coordinates and timestamps across a folder of images for scripted analysis and GPX track generation.
  • Thumbnail recovery extracts embedded EXIF thumbnails that may retain the original uncropped or unblurred scene after editing.

Extract Everything with exiftool

exiftool is the reference tool for reading metadata across image, video, and document formats. Start with a full dump grouped by tag family, then focus on GPS and timestamps.

┌──(kali㉿kali)-[~]
└─$ exiftool -G -a -s $IMAGE 
[EXIF]  Make          : Apple
[EXIF]  Model         : iPhone 14 Pro
[EXIF]  DateTimeOriginal : 2025:08:14 16:32:11
[EXIF]  OffsetTimeOriginal : +02:00
[GPS]   GPSLatitude   : 48 deg 51' 29.64" N
[GPS]   GPSLongitude  : 2 deg 17' 40.20" E
[GPS]   GPSAltitude   : 41.2 m Above Sea Level

Pull just the coordinates in a map-ready format:

┌──(kali㉿kali)-[~]
└─$ exiftool -gpslatitude -gpslongitude -gpsposition -c "%.6f" $IMAGE 
GPS Latitude  : 48.858233
GPS Longitude : 2.294500
GPS Position  : 48.858233, 2.294500

Paste the decimal pair straight into a map or the OpenStreetMap and Overpass workflow to confirm the surroundings.

Batch and Structured Output

Working a folder of images, extract coordinates and timestamps for every file at once and emit JSON for scripting:

┌──(kali㉿kali)-[~]
└─$ exiftool -json -gpslatitude -gpslongitude -datetimeoriginal -c "%.6f" *.jpg > metadata.json

exiftool also writes a GPX track from a set of geotagged images, which plots capture points on a map and exposes a subject's movement when several photos survive with GPS intact:

┌──(kali㉿kali)-[~]
└─$ exiftool -if '$gpslatitude' -fileOrder gpsdatetime -p /usr/local/share/exiftool/fmt_files/gpx.fmt *.jpg > track.gpx

Timestamps and Timezone

Even without coordinates, capture time is valuable. DateTimeOriginal is local camera time, and OffsetTimeOriginal or a GPS timestamp reveals the UTC offset, which alone narrows the plausible region. Compare the EXIF local time against any GPS UTC time to derive the timezone when the offset field is missing.

┌──(kali㉿kali)-[~]
└─$ exiftool -time:all -a -G1 -s $IMAGE 
[ExifIFD] DateTimeOriginal   : 2025:08:14 16:32:11
[ExifIFD] OffsetTimeOriginal : +02:00
[GPS]     GPSDateTime        : 2025:08:14 14:32:09Z

A confirmed local time and date drives the shadow and sun position cross-check.

Thumbnails and Recovery Artifacts

Editing an image sometimes updates the main frame but leaves the embedded EXIF thumbnail showing the original, uncropped or unblurred scene. Extract it before trusting the visible image:

┌──(kali㉿kali)-[~]
└─$ exiftool -b -ThumbnailImage $IMAGE > thumb.jpg
┌──(kali㉿kali)-[~]
└─$ exiftool -b -PreviewImage $IMAGE > preview.jpg

Why Metadata Is Often Missing

Most social platforms strip EXIF on upload, and screenshots carry none of the original tags. Treat a stripped file as normal, not as a dead end. Original files shared over email, messaging apps that preserve EXIF, cloud storage links, and direct downloads from listing sites frequently retain full metadata. Always seek the highest-fidelity copy of an image before concluding coordinates are gone.

References