Digital Forensics Tutorial [Part 6] – Image Forensics : EXIF Data Extraction

Digital Forensics Course

By : Bijay Acharya / studentvideotutorial 

If you are here after all of my tutorials mentioned previous, then you have clear mindset on how vast is forensics section. Here, each and every small details can lead to suspect.

Now, in this tutorial of Digital Forensics, I am going to show step by step lab on “Image Forensics, i.e. to extract EXIF Data” from any available image file. EXIF stands for Exchangeable image file format, and basically helps in identifying format details of image files including date and time, settings like shutter speed, camera used, gps, e.t.c.

Forensics investigator after seizing suspect’s device (computer/phone), can shuffle through various photographs available in device, and when investigator wants more details on specific image, then they can go through extraction of EXIF details.

Let’s start :

For this lab, we will be using Exifreader Free tool, for extracting EXIF Details of particular image. Download , install and run exifreader in your system, then screen like below will appear.

Now, let’s open a real/unedited JPEG file. Click on open, then as soon as image is opened in exifreader, you will some available details. Look image below, I’ve opened one jpeg file, and in right side of the image you will get some details (which I’ve highlighted with yellow color).

From, above image, you are clear that photo was taken with Canon EOS 80D. Date and time is also showing in the details. But, no GPS details available in this result. Remember, photos taken with smartphone or camera with location services enabled will attach GPS details to image captured. In such cases, you will get GPS detail, and from google map, we can get details on location where picture was captured. Something like below will be result if exif readers find details on GPS.

Note : You can use any software to extract EXIF Data from image. In today’s world, there are lots of Online Site, where you can upload image to get exif details, and site will give you information. But remember, forensic investigators does their stuff in secured environment and do not like to upload image files in online sites. So, it’s always better to have some good tools installed in your system for extraction of EXIF data from suspect’s captured images.

Tutorial for image forensics is still remaining. We will see more lab on image forensics. 

Leave a Reply

Your email address will not be published.