Image & Document Metadata Analysis

Extract hidden EXIF GPS tags, device fingerprints, and document author metadata using ExifTool and FOCA.

// prerequisite reading

OSINT Basics

What is Metadata?

Metadata is “data about data” embedded automatically by digital cameras, smartphones, scanners, and software applications into media files and documents.

In OSINT investigations, metadata provides crucial intelligence:

Exact GPS coordinates (latitude, longitude, altitude)
Camera make, model, lens parameters, and serial numbers
Original creation, modification, and printing timestamps
Author names, username paths, printer serial numbers, and software versions

1. Extracting Image EXIF Data with ExifTool

EXIF (Exchangeable Image File Format) tags store camera and smartphone capture parameters inside JPEG, PNG, TIFF, and WebP files.

# View all EXIF metadata tags
exiftool image.jpg

# Filter for GPS coordinates specifically
exiftool -gps* image.jpg

# Display raw decimal GPS coordinates ready for Google Maps
exiftool -c "%.6f" -GPSLatitude -GPSLongitude image.jpg

Example ExifTool Output

Camera Model Name               : iPhone 13 Pro
Date/Time Original              : 2026:07:14 11:24:05
GPS Latitude                    : 23.777176 N
GPS Longitude                   : 90.399452 E
GPS Altitude                    : 14.2 m

Copy the latitude and longitude into Google Maps (23.777176, 90.399452) to navigate directly to the capture site.

2. Document Metadata Extraction (PDF, DOCX, XLSX)

Microsoft Office files (.docx, .xlsx) and PDF documents store embedded XML structures detailing user environments:

# Extract PDF author, creator tool, and embedded revision history
exiftool document.pdf

# Unzip DOCX files to inspect internal metadata XML files
unzip -q document.docx -d docx_extracted/
cat docx_extracted/docProps/core.xml
cat docx_extracted/docProps/app.xml

Key XML fields:

<dc:creator>: Username of file creator (e.g., C:\Users\jdoe\...).
<cp:lastModifiedBy>: Last user who saved the file.
<Template>: Internal network share path or template file location.

3. Automated Bulk Metadata Harvest with FOCA

FOCA (Fingerprinting Organizations with Collected Archives) automates document metadata discovery:

Target a corporate domain (e.g., target.com).
Search Google/Bing for indexing file extensions: site:target.com filetype:pdf OR filetype:docx OR filetype:xlsx.
FOCA automatically downloads discovered documents, extracts metadata, and correlates internal network usernames, internal IP ranges, software versions, and local path structures into an interactive graph.