ExifTool Cheat Sheet

Read and write metadata in images, documents, and media — GPS, camera info, author fields, and hidden tags.

Forensics & IRimagesmetadatasteganographyUpdated 2026-06-02

Overview

ExifTool extracts and edits EXIF, IPTC, XMP, and other metadata. Essential in OSINT, CTF stego challenges, and verifying document provenance during investigations.

Authorized testing only. Use only on systems, networks, and accounts you own or have explicit written permission to test. Unauthorized access is illegal.

Install

sudo apt install -y libimage-exiftool-perl

exiftool -ver

Essential commands

All metadata

exiftool photo.jpg

Common tags only

exiftool -common photo.jpg

JSON output

exiftool -j photo.jpg

Recursive directory

exiftool -r ./evidence/

Common workflows

GPS and device info —

exiftool -gps:all -G photo.jpg

exiftool -Make -Model -DateTimeOriginal -G1 *.jpg

Strip metadata (privacy / redaction) —

exiftool -all= photo.jpg

Creates photo.jpg_original backup by default

exiftool -all= -overwrite_original photo.jpg

Compare / diff metadata —

exiftool -a -u -g1 file1.docx file2.docx

CTF / stego hints —

exiftool -b -Comment image.png

exiftool -b -ThumbnailImage doc.pdf > thumb.jpg

strings image.png

Batch rename by date —

exiftool '-Filename<DateTimeOriginal' -d %Y%m%d_%H%M%S.%%e%%f dir/

Write tag (document handling) —

exiftool -Author="Analyst" -Title="Evidence Item 42" report.pdf

Flags reference

`-G`	Print group name
`-a`	Duplicate tags
`-u`	Unknown tags
`-b`	Binary output (embedded thumbnails)
`-all=`	Remove all metadata
`-overwrite_original`	No backup file
`-r`	Recursive
`-ext JPG`	Filter extensions
`-if CONDITION`	Conditional processing

Tips

Always preserve original evidence; work on copies unless court-approved redaction.
PDFs may contain hidden JavaScript — metadata is only one layer; also check pdf-parser.
-fast skips slow formats when scanning huge trees.
Combine GPS with Google Maps only in authorized investigations.