secrets-in-file-metadata

Extract and interpret embedded file metadata with exiftool — EXIF GPS coordinates, camera make, model and serial, DateTimeOriginal and CreateDate timestamps, XMP and IPTC fields, and Office and PDF properties such as Author, Company, LastModifiedBy, template paths and revision counts. Use when reading EXIF from a photo, checking who really wrote a document, dating a file, fingerprinting a camera or phone, or investigating provenance in JPEG, HEIC, RAW, MP4, DOCX, XLSX or PDF. Applies to document

12stars1forksUpdated 8/13/2026

Developer Tools #metadata #exiftool #osint #forensics #investigation

Security Assessment

Safe(91/100)

Security Score91/100

About secrets-in-file-metadata

Secrets in File Metadata is a digital-forensics and OSINT skill for extracting and interpreting embedded file metadata with exiftool. It targets the fastest lead in many investigations — the data already inside a file: GPS coordinates to six decimals, a camera serial that links supposedly unrelated images to one body, a document author who is a real employee, or a template path revealing a corporate share. It sets two analytical guardrails up front: absent metadata is normal (anything through a social platform gets stripped) and present metadata is a claim written by whatever software last touched the file, editable with a single command.

The skill provides a 'where to look first' table keyed to what you have (social-platform photo, forum/CMS image, messaging attachment, folder, DOCX/XLSX/PPTX, PDF, press photo, RAW/HEIC, video) and the correct exiftool invocations, explaining why the defaults lose evidence — grouping tags by source, keeping duplicates, showing unknown vendor tags, disabling pretty-printing, and extracting embedded streams. A detailed cookbook reference covers single-file full dumps, targeted reads for GPS/serials/timestamps/software, embedded-binary extraction, directory triage to CSV, conditional -if filtering, custom output formats, correlating a set to distinct camera bodies, large-set performance, character-encoding fixes, validation, and document/PDF handling paired with unzip, Poppler, and QPDF tools. A tag catalogue reference documents which fields matter. Every command in the cookbook reads rather than writes, and it opens by hashing and working on a copy to preserve the original evidence.

It is aimed at investigators, journalists, evidence handlers, and anyone doing document-provenance disputes, insider-leak attribution, or pre-publication redaction checks. The activity is read-only metadata analysis of files already in hand, with forensic-integrity practices baked in; interpreting GPS or authorship data touches personal information, but the workflow is defensive and evidence-preserving.

FAQ

What tool does it rely on?

Primarily exiftool for reading EXIF, XMP, IPTC, MakerNotes, and Office/PDF properties, paired with helpers like unzip, ffprobe, and Poppler/QPDF tools (pdfimages, pdfdetach, pdftotext, qpdf) for containers and PDFs.

Does it modify the files it examines?

No. Every command in the cookbook reads rather than writes, and it starts by hashing the file and working on a copy with preserved timestamps to protect the original evidence.

What kinds of metadata can it surface?

GPS coordinates, camera make/model/serial and lens data, capture and modification timestamps, software/producer strings, XMP and IPTC caption/credit/person fields, and document properties like Author, Company, LastModifiedBy, template paths, and revision counts.

Which file types are covered?

JPEG, HEIC, RAW, PNG, TIFF, MP4 and other video, plus DOCX/XLSX/PPTX and PDF documents, including embedded images and streams.

How does it treat the reliability of metadata?

It warns that absent metadata is normal for anything that passed through a social platform and that any present tag is a claim written by the last software to touch the file, so findings are corroborated (for example duplicate timestamps that disagree indicate editing) rather than taken as proof.