How to Use ExifTool to Analyze Image Metadata

An image contains more than the pixels you see on your screen. Depending on how it was created and processed, it may also contain information about the camera, capture time, image settings, software, and GPS location.

In digital forensics, this information can help investigators examine photographs, compare files, identify inconsistencies, and develop investigative leads.

ExifTool is a command-line tool that reads, writes, and edits metadata in images and many other file formats. In this guide, you will learn how to install ExifTool, extract image metadata, examine timestamps and GPS coordinates, analyze multiple files, and export results for further investigation.

What Is ExifTool?

ExifTool is a metadata analysis tool developed by Phil Harvey. It supports metadata standards such as EXIF, IPTC, and XMP across many image and other file formats.

Common uses include:

• Camera information: Examine recorded camera make, model, and exposure settings.
• Timestamps: Inspect available capture and modification date fields.
• GPS information: Check for location coordinates embedded in a file.
• Software information: Examine metadata that identifies applications used to process a file.
• Batch analysis: Compare metadata across multiple photographs.
• Reporting: Export metadata for further analysis and documentation.

ExifTool can also examine metadata in supported documents, audio files, videos, and other formats.

For forensic work, start by extracting metadata from the original evidence without modifying it. Perform any authorized changes only on an appropriate working copy.

Step 1: Install ExifTool

Download ExifTool from its official installation page. Choose the instructions for your operating system.

macOS

If you use Homebrew, open Terminal and run:

brew install exiftool

Linux

On Debian or Ubuntu:

sudo apt update
sudo apt install libimage-exiftool-perl

Windows

Download the Windows executable from the official ExifTool website. Extract the archive and follow the instructions to make the executable available from Command Prompt or PowerShell.

Verify the installation

On any system where ExifTool is available through your command line, run:

exiftool -ver

The command should display the installed version. If the system cannot find the command, check your installation and PATH configuration.

Step 2: Extract Metadata From an Image

The simplest way to use ExifTool is to provide the path to an image.

exiftool photo.jpg

Replace photo.jpg with your actual filename. If the image is in another directory, provide its full or relative path.

ExifTool displays the metadata it can read from the file. Depending on the image, the output may include the file type, dimensions, camera information, timestamps, exposure settings, software details, and GPS fields.

Understanding the output

Consider these illustrative metadata fields:

These values are examples, not findings from an actual photograph.

Not every image contains these fields. Metadata may be absent, removed during sharing, unsupported, or modified after the image was created.

Important: Metadata records information about a file; it does not independently prove that the recorded information is accurate.

Step 3: Extract Specific Metadata Fields

Displaying every available field can produce a long report. You can narrow the output to the information you need by specifying individual tags.

Check the camera make and model

exiftool -Make -Model photo.jpg

This displays the available camera manufacturer and model fields.

These values can help characterize an image, but they do not prove which physical device produced it. Metadata can be copied or edited.

Examine timestamps

exiftool -DateTimeOriginal -CreateDate -ModifyDate photo.jpg

These tags represent different recorded date and time values:

• DateTimeOriginal: Commonly associated with the original capture time.
• CreateDate: A metadata field commonly associated with the creation of the digital image data.
• ModifyDate: A metadata field that records a modification time.

Their exact meaning depends on the format, the software involved, and how the metadata was written.

Do not automatically treat these values as the actual time an event occurred. Camera clocks may be incorrect, time zones may be unclear, and metadata can be changed.

Inspect filesystem timestamps

Filesystem timestamps are distinct from dates embedded in image metadata.

To examine available filesystem-related fields, run:

exiftool -FileCreateDate -FileModifyDate -FileAccessDate photo.jpg

Availability and interpretation vary by operating system and filesystem. Copying a file between devices can also affect filesystem timestamps.

For an investigation, record which timestamp you examined and whether it came from embedded metadata or the filesystem.

Step 4: Examine GPS Coordinates

Some photographs contain GPS information that may help identify a location associated with the image.

To display available GPS metadata, run:

exiftool -GPS:all photo.jpg

Alternatively, request the principal location fields:

exiftool -GPSLatitude -GPSLongitude -GPSAltitude photo.jpg

If GPS metadata exists, the output may include latitude, longitude, altitude, and other GPS-related values.

For example, an output could contain coordinates such as:

GPS Latitude  : 28 deg 36' 30.00" N
GPS Longitude : 77 deg 12' 30.00" E
GPS Altitude  : 210 m

These are illustrative values, not findings from a real image.

If no coordinates appear, the photograph may not contain GPS metadata, or the relevant fields may be unavailable. Many cameras do not record location, and some applications remove it when exporting or sharing images.

Even when coordinates exist, they do not independently prove where or when a photograph was taken. Check the values against other evidence and document any uncertainty.

Privacy note: GPS metadata can expose a person's home, workplace, or other sensitive locations. Avoid publishing private coordinates or case-evidence details without authorization.

Step 5: Analyze Multiple Images

ExifTool can process multiple files in a single command, which is useful when examining a collection of photographs.

Examine a directory

exiftool ./images/

Replace ./images/ with the directory containing your files.

To include files in subdirectories, use:

exiftool -r ./images/

Recursive processing can produce a large amount of output. Restrict the input to the files relevant to your examination.

Compare selected metadata fields

To focus on timestamps, camera details, and GPS information, run:

exiftool -DateTimeOriginal -Make -Model -GPSLatitude -GPSLongitude ./images/

ExifTool will display the requested fields for the files it processes.

For example, several photographs may contain similar capture times and the same recorded camera model. This can help an examiner organize and compare the files, but it does not establish that the photographs came from the same physical camera or were taken by the same person.

Step 6: Export Metadata to CSV or JSON

For a large collection, it may be easier to review metadata in a spreadsheet or process it with a script.

Export selected fields to CSV

exiftool -csv -SourceFile -Make -Model -DateTimeOriginal -GPSLatitude -GPSLongitude ./images/ > metadata.csv

This creates a CSV report containing the source filename and the selected fields. You can open it in spreadsheet software to sort and compare available values.

If you need a broader metadata export, remove the selected tag arguments:

exiftool -csv ./images/ > metadata.csv

A full export can contain many columns, and the available fields vary between files.

Export metadata to JSON

exiftool -json ./images/ > metadata.json

JSON is useful when processing metadata with Python or integrating the results into another analysis workflow.

The commands above use shell redirection to save ExifTool's output to a file. Check the output directory and existing filenames before running them so you do not unintentionally overwrite a previous report.

For very large collections, consider processing smaller batches. CSV export may require substantial memory because ExifTool gathers metadata across the input files before writing the output.

Step 7: Follow Forensic Best Practices

ExifTool is useful for metadata examination, but reliable forensic work requires evidence preservation, documentation, and careful interpretation.

1. Preserve the original evidence. Work from an authorized forensic copy or follow your organization's evidence-handling procedure.
2. Calculate a SHA-256 hash when appropriate. Record the hash of the source file and verify integrity according to your examination workflow. A matching hash supports file-integrity verification; it does not prove that the metadata is truthful.
3. Record your commands and tool version. Document the ExifTool version, the files examined, the commands used, and the output location.
4. Distinguish timestamp types. Separate embedded metadata dates from filesystem timestamps, and account for time zones when they are known.
5. Corroborate findings. Compare metadata with other available evidence rather than relying on a single field.
6. Document limitations. Record missing values, conflicting timestamps, and any uncertainty about how the metadata was created or modified.

For a stronger examination, retain the original files, preserve the extracted report, and document the steps used to reach each conclusion.

Frequently Asked Questions