Exif stands for Exchangeable Image File and is sometimes called Metadata, a term which actually refers to the tags of information stored in the Exif data. The correct designation is Exif not EXIF.
Exif data is only available in images in .jpg or .tif format images. Whenever an image is captured in one of these formats using a digital device, Exif data is generally embedded into the image as a series of tags. These tags are viewable by other devices as they are in a common format.
Exif data tags can include date and time of image capture, last image modification, image capture device make and model, image capture information including flash activation, a thumbnail of the image, copyright information and GPS location data.
Be aware, though, that Exif data can be edited at any-time after the image has been captured, using software such as
http://www.colorpilot.com/exif.html
Exif data is usually transmitted with the image when you transfer it from the original device by saving it to a memory card, sending by email, publishing on a webpage or backing up to cloud storage. Some messaging applications do not transmit the exif data with the image, such as iMessage on Apple devices.
Many web services such as Facebook and Twitter remove the Exif data from images before the image is published on the service. A notable exception to this trend is Flickr, which retains Exif data and is viewable by users.
Exif data can easily be removed from an image using free software such as
There are several methods available to the researcher for viewing Exif data in an image and some of these are outlined below.
It should be noted however that when examining an image in an investigation, a working copy of the image should be created and examined, with the original being preserved in its original format for evidential integrity purposes.
EXAMINING AN IMAGE USING FIREFOX WEB BROWSER
- Install Firefox web browser from www.mozilla.org
- Select the Add-ons tab (ctrl+shift+a)
- Search for ‘Exif Viewer 2.00’ and install this add-on
- Restart Firefox and open a new tab
- Drag and drop your image into the main body of the browser from its location
- Right click on the image in the browser and select ‘View Image EXIF Data’ from the context menu
- When the Exif data window opens, scroll through the information. This information can be copied to your clipboard
- You will see GPS data towards the bottom of the information- click on one of the mapping links e.g. Google Maps
- The map will open in a new window. Consider using Google Street View or Google Earth functions at this point
- When you have completed your examination, close all open tabs and windows etc.
EXAMINING A WEB IMAGE USING FIREFOX WEB BROWSER
As above – but instead of dragging the image into the Firefox browser open the webpage and right click on the image of interest in the webpage. Try this with the images at
If you want to try this with the Google Chrome browser, download it here
and install an extension (add-on) called Exif Viewer 2.33 by Andry Virvich.
This places a small camera icon at the bottom right of any image containing Exif data.
Click on the camera icon to view the data.
EXAMINING AN IMAGE USING A WEB BASED TOOL
Web based tools allow you to upload an image from your device and provide you with a detailed analysis of the Exif Data, including GPS mapping. They can be accessed from any browser on any operating system
Some web based tools also allow you to remove exif data from your images
and some tools even display the direction the device was facing when the image was captured
EXAMINING AN IMAGE ON A MOBILE DEVICE
There are several applications that can be installed on mobile devices to examine Exif and GPS data in images. Koredoko is one that I have tested and it works well. Its available on iOS and Android platforms and is free. Check out the developers website here and download the App from you store :