EXIF & Metadata Analysis

Embedded metadata can reveal GPS coordinates, timestamps, device model, author names, and editing software — often the fastest lead in an investigation.

Extract

exiftool is the tool for everything:

exiftool image.jpg                       # all tags
exiftool -gps:all -createdate image.jpg  # just location + time
exiftool -a -u -g1 file.pdf              # documents (author, producer)
exiftool -r -csv DIR > meta.csv          # whole folder to CSV

Online (no install): metadata2go, Jimpl, or the Pillow/hachoir Python libs.

What to look for