What is ExifTool?

ExifTool is a free, open-source, platform-independent Perl library and command-line application created by Phil Harvey for reading, writing, and editing metadata in a massive range of file formats. It supports EXIF, GPS, IPTC, XMP, JFIF, GeoTIFF, ICC Profile, Photoshop IRB, FlashPix, AFCP, ID3, and many more metadata formats.

In the context of penetration testing and OSINT, ExifTool is invaluable. Uploaded images, documents, and PDFs often contain hidden metadata that reveals GPS coordinates, author names, software used, device serial numbers, and more. Attackers use it for reconnaissance; defenders use it to sanitize files before publishing.

Installation

On Kali Linux (Pre-installed)

ExifTool comes pre-installed on Kali Linux. Verify it with:

exiftool -ver

Expected Output:

12.76

Install / Update on Debian/Ubuntu

sudo apt update && sudo apt install libimage-exiftool-perl

Install on macOS

brew install exiftool

Install on Windows

Download from the official site at exiftool.org, extract the zip, and rename exiftool(-k).exe to exiftool.exe. Add it to your system PATH.

Install from Source (Latest Version)

cd /tmp
wget https://exiftool.org/Image-ExifTool-12.76.tar.gz
tar -xzf Image-ExifTool-12.76.tar.gz
cd Image-ExifTool-12.76
perl Makefile.PL
make
sudo make install

Core Concepts

Metadata is data about data. When you take a photo, your camera embeds information like the date, time, GPS location, camera model, lens info, ISO, shutter speed, and more into the file itself. Documents embed author names, software versions, revision history, and timestamps.

ExifTool reads and writes metadata across hundreds of file types including JPEG, PNG, TIFF, PDF, DOCX, MP4, MP3, HEIC, RAW formats (CR2, NEF, ARW), and more.

Key metadata standards:

• EXIF — Camera settings, date/time, GPS coordinates
• IPTC — Captions, keywords, copyright, credits
• XMP — Adobe's extensible metadata platform
• ID3 — Audio file tags (MP3)
• ICC Profile — Color management data
• MakerNotes — Proprietary camera manufacturer data

Reading Metadata (Extraction)

View All Metadata from a File

exiftool photo.jpg

Example Output:

ExifTool Version Number         : 12.76
File Name                       : photo.jpg
Directory                       : .
File Size                       : 3.2 MB
File Modification Date/Time     : 2026:03:01 14:23:45-08:00
File Access Date/Time           : 2026:03:06 09:15:22-08:00
File Type                       : JPEG
File Type Extension             : jpg
MIME Type                       : image/jpeg
Image Width                     : 4032
Image Height                    : 3024
Camera Model Name               : iPhone 15 Pro
Lens Model                      : iPhone 15 Pro back triple camera
GPS Latitude                    : 37 deg 56' 10.20" N
GPS Longitude                   : 122 deg 20' 42.60" W
Create Date                     : 2026:03:01 14:23:45
ISO                             : 64
Shutter Speed                   : 1/1250
Aperture                        : 1.8
Software                        : 18.3.1
Make                            : Apple

View Only Common Tags (Short Output)

exiftool -common photo.jpg

Example Output:

FileName        : photo.jpg
FileSize        : 3.2 MB
Model           : iPhone 15 Pro
DateTimeOriginal: 2026:03:01 14:23:45
ImageSize       : 4032x3024
Quality         : 
FocalLength     : 6.8 mm
ShutterSpeed    : 1/1250
Aperture        : 1.8
ISO             : 64
WhiteBalance    : Auto
Flash           : Off, Did not fire

Extract Specific Tags

exiftool -Make -Model -GPSLatitude -GPSLongitude photo.jpg

Output:

Make                            : Apple
Camera Model Name               : iPhone 15 Pro
GPS Latitude                    : 37 deg 56' 10.20" N
GPS Longitude                   : 122 deg 20' 42.60" W

Extract GPS Coordinates in Decimal Format

exiftool -n -GPSLatitude -GPSLongitude photo.jpg

Output:

GPS Latitude                    : 37.9361667
GPS Longitude                   : -122.3451667

The -n flag disables print conversion, giving you raw numeric values you can plug directly into Google Maps.

View Metadata in JSON Format

exiftool -json photo.jpg

Output:

[{
  "SourceFile": "photo.jpg",
  "FileName": "photo.jpg",
  "FileSize": "3.2 MB",
  "Make": "Apple",
  "Model": "iPhone 15 Pro",
  "GPSLatitude": "37 deg 56' 10.20\" N",
  "GPSLongitude": "122 deg 20' 42.60\" W"
}]

View Metadata in CSV Format

exiftool -csv photo.jpg

View Metadata in XML Format

exiftool -X photo.jpg

View Metadata in HTML Table

exiftool -htmldump photo.jpg > metadata_report.html

This creates a visual HTML dump of the entire binary metadata structure — extremely useful for forensic analysis.

View Only EXIF Data

exiftool -exif:all photo.jpg

View Only XMP Data

exiftool -xmp:all photo.jpg

View Only IPTC Data

exiftool -iptc:all photo.jpg

View MakerNotes (Manufacturer-Specific Data)

exiftool -makernotes:all photo.jpg

View Thumbnail Image Info

exiftool -ThumbnailImage -b photo.jpg > thumbnail.jpg

This extracts the embedded thumbnail from the JPEG — often overlooked during metadata scrubbing.

Reading Metadata from Documents & Other Files

PDF Files

exiftool report.pdf

Example Output:

File Name                       : report.pdf
File Size                       : 1.8 MB
File Type                       : PDF
PDF Version                     : 1.7
Title                           : Q4 Financial Report
Author                          : John Smith
Creator                         : Microsoft Word 2021
Producer                        : macOS Version 14.2 Quartz PDFContext
Create Date                     : 2026:01:15 09:30:22-08:00
Modify Date                     : 2026:02:28 16:45:11-08:00
Page Count                      : 24

Microsoft Office Documents (DOCX, XLSX, PPTX)

exiftool presentation.pptx

Example Output:

File Name                       : presentation.pptx
Creator                         : Jane Doe
Last Modified By                : Marketing Team
Revision Number                 : 12
Create Date                     : 2026:01:10 08:00:00Z
Modify Date                     : 2026:03:01 17:30:00Z
Total Edit Time                 : 4.5 hours
Words                           : 2340
Application                     : Microsoft Office PowerPoint
Slides                          : 18
Company                         : Acme Corp

Audio/Video Files (MP3, MP4, MOV)

exiftool video.mp4

Example Output:

File Name                       : video.mp4
File Size                       : 245 MB
MIME Type                       : video/mp4
Major Brand                     : Apple QuickTime (.MOV/QT)
Duration                        : 0:05:32
Image Size                      : 3840x2160
Video Frame Rate                : 60
Audio Channels                  : 2
Audio Sample Rate               : 48000
Compressor Name                 : HEVC
GPS Latitude                    : 37 deg 56' 10.20" N
GPS Longitude                   : 122 deg 20' 42.60" W
Create Date                     : 2026:02:14 18:22:33

Writing & Editing Metadata

Change the Author Tag

exiftool -Author="Abishek Lakandri" document.pdf

Output:

1 image files updated

ExifTool automatically creates a backup file (document.pdf_original) unless you use -overwrite_original.

Write Multiple Tags at Once

exiftool -Artist="John Doe" -Copyright="2026 All Rights Reserved" -Comment="Shot in San Francisco" photo.jpg

Set GPS Coordinates on an Image

exiftool -GPSLatitude=37.7749 -GPSLongitude=-122.4194 -GPSLatitudeRef=N -GPSLongitudeRef=W photo.jpg

Change the Creation Date

exiftool -DateTimeOriginal="2025:12:25 10:00:00" photo.jpg

Shift All Dates by a Time Offset

Useful when your camera clock was set wrong:

exiftool "-DateTimeOriginal+=1:30:0" photo.jpg

This adds 1 hour and 30 minutes to the original date/time.

Shift Dates Backward

exiftool "-DateTimeOriginal-=0:0:0 3:0:0" photo.jpg

Subtracts 3 hours from the date.

Set the Title and Subject on a PDF

exiftool -Title="Project Alpha Report" -Subject="Quarterly Analysis" report.pdf

Write IPTC Keywords

exiftool -Keywords="cybersecurity" -Keywords="kali" -Keywords="metadata" photo.jpg

Write XMP Tags

exiftool -XMP:Creator="My Name" -XMP:Description="Sunset at the pier" photo.jpg

Overwrite Original (No Backup)

exiftool -overwrite_original -Artist="Anonymous" photo.jpg

Removing / Stripping Metadata (OPSEC Critical)

This is one of the most important ExifTool functions for security professionals. Before uploading any file to the internet, strip all metadata to prevent information leakage.

Remove ALL Metadata from a File

exiftool -all= photo.jpg

Output:

1 image files updated

Verify by running exiftool photo.jpg again — you'll see only basic file system tags remain.

Remove All Metadata and Overwrite Original

exiftool -all= -overwrite_original photo.jpg

Remove Only GPS Data

exiftool -gps:all= photo.jpg

Remove Only EXIF Data (Keep IPTC/XMP)

exiftool -exif:all= photo.jpg

Remove All Metadata Except Certain Tags

exiftool -all= --ImageWidth --ImageHeight --FileType photo.jpg

The double dash -- means "exclude from removal" so these tags are preserved.

Remove Author and Creator from PDFs

exiftool -Author= -Creator= -Producer= report.pdf

Remove Metadata from All Files in a Directory

exiftool -all= -overwrite_original /path/to/directory/

Remove Metadata Recursively (All Subdirectories)

exiftool -all= -overwrite_original -r /path/to/directory/

Bulk / Batch Operations

Process All JPEGs in a Directory

exiftool -Artist="My Studio" *.jpg

Process Files Recursively

exiftool -r -Artist="My Studio" /photos/

Process Only Specific File Types

exiftool -ext jpg -ext png -ext tiff -Artist="My Studio" /photos/

Rename Files Based on Date Taken

exiftool '-FileName<DateTimeOriginal' -d '%Y%m%d_%H%M%S%%-c.%%le' /photos/

Before: IMG_4532.jpg

After: 20260301_142345.jpg

The %%-c adds a copy number if duplicates exist, and %%le preserves the lowercase extension.

Organize Photos into Date-Based Folders

exiftool '-Directory<DateTimeOriginal' -d '/photos/sorted/%Y/%m/%d' /photos/unsorted/

Result: Files get moved into a structure like /photos/sorted/2026/03/01/

Copy Metadata from One File to Another

exiftool -TagsFromFile source.jpg target.jpg

Copy Only GPS Tags Between Files

exiftool -TagsFromFile source.jpg -gps:all target.jpg

Copy All Metadata from One Format to Another

exiftool -TagsFromFile original.cr2 converted.jpg

Create a CSV Report of All Image Metadata

exiftool -csv -r /photos/ > metadata_report.csv

Create a JSON Report

exiftool -json -r /photos/ > metadata_report.json

Process Files Matching a Condition

Only process files taken with an iPhone:

exiftool -if '$Make eq "Apple"' -Artist="iPhone Shot" /photos/

Only process files with GPS data:

exiftool -if '$GPSLatitude' -json /photos/

Advanced Use Cases

Extract Embedded Thumbnails

exiftool -b -ThumbnailImage photo.jpg > thumb.jpg

Sometimes the thumbnail contains the original uncropped image — a known privacy risk.

Extract All Embedded Images from a File

exiftool -a -b -W %d%f_%t%-c.%s -preview:all photo.jpg

View the Hex Dump of Metadata

exiftool -v3 photo.jpg

The -v (verbose) flag levels 1-5 give increasingly detailed debug output. -v3 shows the raw hex data being parsed.

Compare Metadata Between Two Files

diff <(exiftool file1.jpg) <(exiftool file2.jpg)

Geolocation Tracking from Images

Extract GPS from every image in a folder and output to CSV:

exiftool -csv -GPSLatitude -GPSLongitude -GPSAltitude -DateTimeOriginal -r /evidence/ > gps_tracking.csv

You can then import this CSV into Google Earth, QGIS, or any mapping tool to visualize movement patterns.

Detect if Metadata Has Been Tampered With

exiftool -validate -warning -error -a photo.jpg

Look for warnings like "Bad ExifIFD SubDirectory" or unexpected tag counts.

Read Metadata from URLs (Pipe from curl)

curl -s https://example.com/image.jpg | exiftool -

The - tells ExifTool to read from stdin.

Write Metadata Using a Config File

Create a file args.txt:

-Artist=My Name
-Copyright=2026 All Rights Reserved
-Comment=Processed with ExifTool

Then run:

exiftool -@ args.txt photo.jpg

Conditional Writing with -if

Add a copyright tag only to photos taken in 2026:

exiftool -if '$DateTimeOriginal ge "2026:01:01"' -Copyright="2026 My Copyright" /photos/

OSINT & Forensics Use Cases

Investigate a Suspicious Document

When analyzing a phishing document or suspicious PDF:

exiftool -a -u -g1 suspicious.pdf

• -a shows duplicate tags

• -u shows unknown tags

• -g1 groups output by tag group for readability What to look for:

• Author / Creator — May reveal the attacker's name or username

• Producer / Software — Shows what tool created the document

• Create/Modify Dates — Timeline of document creation

• Metadata timestamps vs file system timestamps — Discrepancies suggest tampering

• Embedded GPS — May reveal the attacker's location

• Serial numbers — Camera serial numbers are unique identifiers

Extract Software and OS Information

exiftool -Software -Producer -Creator -CreatorTool document.pdf

Example Output:

Software                        : Microsoft Office Word 2019
Producer                        : macOS Version 14.3 Quartz PDFContext
Creator                         : Word
Creator Tool                    : Microsoft Word 16.82

This reveals the exact software version and operating system used.

Extract Unique Camera Serial Number

exiftool -SerialNumber -InternalSerialNumber photo.jpg

Camera serial numbers can be used to link multiple images to the same device.

Mass OSINT Extraction Script

Extract key OSINT data from all files in an evidence folder:

exiftool -r -csv \
  -FileName \
  -FileType \
  -Make -Model \
  -SerialNumber \
  -Software \
  -Author -Creator \
  -GPSLatitude -GPSLongitude \
  -DateTimeOriginal \
  -CreateDate -ModifyDate \
  /evidence/ > osint_report.csv

Useful Flags Reference

Performance Tips

Use stay_open for Batch Processing

Starting ExifTool once and piping commands is much faster than invoking it per file:

exiftool -stay_open True -@ - <<EOF
-json
photo1.jpg
-execute
-json
photo2.jpg
-execute
-stay_open
False
EOF

This avoids the Perl startup overhead for each file.

Process Large Directories Efficiently

For directories with thousands of files:

find /photos -name '*.jpg' | exiftool -@ - -csv > report.csv

Security Considerations

Always strip metadata before uploading files publicly. Real-world breaches have occurred because of metadata exposure, including revealing military base locations from soldiers' geotagged photos, identifying anonymous whistleblowers from document metadata, and tracing journalists' locations from photo GPS data.

Quick pre-upload sanitization command:

exiftool -all= -overwrite_original -r ./upload_folder/

Verify sanitization worked:

exiftool -a -u upload_folder/photo.jpg

You should only see basic file system attributes like file name, size, and MIME type.

Summary

ExifTool is one of the most versatile tools in any security professional's toolkit. Whether you are conducting OSINT investigations, performing digital forensics, sanitizing files for OPSEC, or simply organizing your photo library — ExifTool handles it all from a single command-line interface.

Key Takeaways:

• Use exiftool filename to quickly view all metadata
• Use exiftool -all= filename to strip all metadata
• Use -gps:all= to specifically remove location data
• Use -json or -csv flags for structured output
• Use -r for recursive directory processing
• Use -TagsFromFile to copy metadata between files
• Use -if for conditional batch processing
• Always sanitize files before uploading to the internet