Metadata OSINT
Extract intelligence from file metadata - EXIF, document properties, GPS, and author information.
Metadata OSINT
Metadata OSINT is the extraction and analysis of embedded file information (EXIF, author, timestamps, GPS coordinates) to identify people, locations, devices, and systems without analyzing the main file content.
How it works: Tools like exiftool, pdfinfo, and oletools parse embedded metadata that most users ignore - GPS coordinates, device models, creator usernames, software versions, thumbnails - from images, PDFs, documents, and archives.
Why it matters: Metadata often survives after the main file is edited or transmitted; it reveals creator identity, exact location, device type, and timestamps - providing OSINT pivots and even direct flags in CTF challenges.
Privacy reminder: Metadata can contain personally identifiable information (PII). Only analyze files as part of an authorized CTF or with explicit permission. When sharing examples or outputs, redact real names, emails, and GPS coordinates.
Quick Start
Run exiftool on everything
exiftool suspicious_file.jpg
exiftool -a -u suspicious_file.jpg # verbose, show unknown tags
exiftool -json photo.jpg # JSON for programmatic useRun this first on every file you receive - flags are often hidden here.
Check GPS and plot
exiftool -GPSLatitude -GPSLongitude photo.jpg
# → GPSLatitude: 40 deg 41' 21.01" N
# → GPSLongitude: 74 deg 2' 40.67" WConvert DMS to decimal and search on Google Maps.
Extract and compare thumbnail
exiftool -b -ThumbnailImage photo.jpg > thumbnail.jpgThe thumbnail may be an older version of the image - potentially showing content that was cropped out.
Check for base64 in metadata fields
exiftool photo.jpg | grep -oE "[A-Za-z0-9+/]{20,}={0,2}" | while read b64; do
echo "$b64" | base64 -d 2>/dev/null
doneFile Type Guide
exiftool photo.jpgKey fields for CTF:
Comment → often contains hidden flag
UserComment → same
Artist → author hint
Copyright → hidden info
ImageDescription → description field
GPS Latitude/Longitude → location
DateTimeOriginal → when photo was taken
Software → editing software
Camera Make/Model → device identification
Thumbnail Image → separate embedded thumbnailConverting GPS Coordinates
# Degrees, minutes, seconds → decimal degrees
def dms_to_decimal(degrees, minutes, seconds, direction):
decimal = degrees + minutes/60 + seconds/3600
if direction in ['S', 'W']:
decimal = -decimal
return decimal
# Example: 40 deg 41' 21.01" N, 74 deg 2' 40.67" W
lat = dms_to_decimal(40, 41, 21.01, 'N')
lon = dms_to_decimal(74, 2, 40.67, 'W')
print(f"{lat}, {lon}") # → 40.6892, -74.0446
# Search Google Maps: 40.6892, -74.0446Advanced Metadata Analysis
Checklist
-
exiftool -a -u file- run on everything first - Look for:
Comment,UserComment,Artist,Descriptionfields - GPS coordinates → plot on Google Maps
- Extract and compare thumbnail:
exiftool -b -ThumbnailImage photo.jpg > thumb.jpg - PDF: check
Author,Creator,Keywords,Subject - DOCX: unzip and read
core.xml/app.xml - Base64 decode any suspicious metadata values
-
exiftool -jsonfor programmatic parsing
Last updated on