exif-metadata-analysis

Compare original and translation side by side

🇺🇸

Original

English

🇨🇳

Translation

Chinese

EXIF & Metadata Analysis

EXIF与元数据分析

Embedded metadata can reveal GPS coordinates, timestamps, device model, author names, and editing software — often the fastest lead in an investigation.

嵌入式元数据可以暴露GPS坐标、时间戳、设备型号、作者姓名以及编辑软件——这通常是调查中最快捷的线索。

Extract

提取方法

exiftool

is the tool for everything:

bash

exiftool image.jpg                       # all tags
exiftool -gps:all -createdate image.jpg  # just location + time
exiftool -a -u -g1 file.pdf              # documents (author, producer)
exiftool -r -csv DIR > meta.csv          # whole folder to CSV

Online (no install): metadata2go, Jimpl, or the Pillow/

hachoir

Python libs.

exiftool

是万能工具：

bash

exiftool image.jpg                       # 所有标签
exiftool -gps:all -createdate image.jpg  # 仅提取位置+时间
exiftool -a -u -g1 file.pdf              # 文档信息（作者、生成器）
exiftool -r -csv DIR > meta.csv          # 将整个文件夹导出为CSV格式

在线工具（无需安装）：metadata2go、Jimpl，或Python库Pillow/

hachoir

。

What to look for

重点关注内容

GPS —
```
GPSLatitude
```
/
```
GPSLongitude
```
; paste into a map. Feed to
```
geoint-photo
```
.
Timestamps —
```
DateTimeOriginal
```
(capture) vs
```
ModifyDate
```
(last edit); divergence hints at editing. Note timezone offset if present.
Device —
```
Make
```
/
```
Model
```
fingerprints a phone/camera; the same serial (
```
SerialNumber
```
) links photos to one device.
Software —
```
Photoshop
```
,
```
GIMP
```
, or AI-tool tags flag manipulation.
Documents —
```
Author
```
,
```
Creator
```
,
```
Company
```
, template paths, and tracked revisions leak real names and org info.

GPS信息 —
```
GPSLatitude
```
/
```
GPSLongitude
```
；可粘贴至地图查看，或导入
```
geoint-photo
```
工具分析。
时间戳 —
```
DateTimeOriginal
```
（拍摄时间）与
```
ModifyDate
```
（最后编辑时间）；两者存在差异则暗示文件曾被编辑。若有时区偏移需注意。
设备信息 —
```
Make
```
/
```
Model
```
可标记手机/相机的特征；相同的序列号（
```
SerialNumber
```
）可将多张照片关联到同一设备。
编辑软件 —
```
Photoshop
```
、
```
GIMP
```
或AI工具标签表明文件曾被篡改。
文档信息 —
```
Author
```
、
```
Creator
```
、
```
Company
```
、模板路径以及修订记录会泄露真实姓名和组织信息。

Critical caveats

重要注意事项

Absence proves nothing. Social platforms and messengers strip EXIF on upload; a clean file is normal, not suspicious.
Metadata is trivially forged. Treat every tag as a claim to corroborate, not proof. Confirm GPS against visual
```
chronolocation
```
.

缺失不代表异常。社交平台和即时通讯工具在上传时会剥离EXIF数据；无元数据的文件是正常情况，无需怀疑。
元数据极易伪造。需将每个标签视为待验证的陈述，而非证据。可通过视觉
```
chronolocation
```
（时间定位）来确认GPS信息的真实性。