Photo Metadata, Geolocation & Stenography Techniques
Part One: Photo Metadata reading with Exiftool and wxHexEditor


All photo file extensions, such as .JPEG, .PNG, .GIF, .BMP, contain “header” file information that is stored on the particular image file. Using ExiftoolGUI we can see this information displayed when uploading a file. This data is called “photo metadata” and is categorized by different image attributes such as File Name, Camera Model Name, Date/Time Original, Shooting Mode, ISO, and more..

ExifToolGUI provides an easy-to-use interface that allows us to view multiple files in a directory at once, allowing us to analyze and view multiple files without using any terminal commands. Let’s try this out on some sample files.

Now we can see exactly when the photo was taken, what camera was used in order to take it, and whether or not the photo was geotagged. Pretty cool huh?

But in some cases, there is information inside of the image header that ExifTool/GUI cannot be read. For this we will need to analyze the image with a Hex Editor. For this we will use wxHexEditor. Let's open up ‘image1.jpg’ again in that program..

Here we can see image metadata that was previously unknown to us when we only used ExifTool.

wxHexEditor
StackExchange | Why can I see EXTRA with the hex editor and not the EXIF tool
ExifTool Forum | Help with corrupt D800 NEF files (How to repair file header)
Exiftool | Supported File Types
Installing Exiftool