OSINT Jet · Image evidence
Photo Metadata OSINT: Read EXIF Without Overclaiming
A photograph says it was taken at a certain time and place. Is that a lead, a fact, or a setting copied from another file? Photo metadata OSINT starts by asking which file you actually have and which question each field can answer.
Before reading EXIF, ask which version of the photo arrived
A camera original, an emailed attachment, a social-media download and a screenshot of the same picture are four different files. The first may carry camera data; the others may have been resized, re-encoded or stripped of fields. If the copy has no GPS tag, you have learned something about that copy, not proved that the camera never recorded a location.
Keep the file as received and note the source URL or handoff, retrieval time, filename, dimensions and a cryptographic hash if your case requires a reproducible record. Work on a copy. The US National Archives’ preservation guidance emphasizes fixity and tracking actions on files; those ideas make even a small investigation easier to review.
When the question is “Where was this scene?” and there is no usable metadata, the visual geolocation workflow is the right next page. Here the job is narrower: interpret the metadata that is actually present.
Four fields worth reading, and four tempting mistakes
| Field or group | Useful question | Unsafe shortcut |
|---|---|---|
| Capture date and time | What time does this file describe as image capture? | “The pictured event happened then.” The device clock may be wrong and a reused image can depict an earlier event. |
| Time-zone offset | Is the capture time tied to an offset, or only a local clock reading? | Converting an unqualified local time to UTC as if the offset were known. |
| GPS coordinates | What coordinates are embedded in this particular file? | “The photographer stood here.” Coordinates may reflect a device setting, edit or another stage in the file’s history. |
| Software and modification information | Does the file indicate processing or export? | “Edited” means deceptive. Ordinary cropping, rotation and export also change a file. |
CIPA’s current Exif standard listing is the primary reference for the format and its metadata categories. Different devices and formats populate different fields. Do not force a blank field into a negative conclusion. The National Archives’ photographic metadata explainer likewise notes that a born-digital photo may not contain every metadata type.
File-system “created” and “modified” times deserve their own column. They can describe a download or export on your machine rather than a camera exposure. Label their origin instead of folding them into EXIF.
A two-copy case: the contradiction is the useful clue
Fictional exercise: a public post by the invented Coastal Atlas project claims that a harbor photo was captured on 8 May. You lawfully receive a JPEG attachment and later download a compressed copy from the post. The attachment contains a capture clock reading of 7 May at 23:35 with an offset of UTC−01:00. The web copy has no capture date or GPS field. Both show the same visible pier and a matching crop.
The offset makes the attachment’s stated instant 8 May at 00:35 UTC. That resolves the apparent one-day mismatch between two ways of expressing the time; it does not establish that the camera clock was correct. The web copy’s missing fields do not refute the attachment. Nor does the shared scene prove that both files came directly from the same camera original.
Keep two rows in your evidence ledger. Record each file’s source and hash, observed fields and what changed between versions. A single combined “photo metadata” row would conceal the provenance difference.
Cross-check the claim outside the file
- Compare the visible scene. Weather, light, signage and construction can sometimes narrow a date or place, but each clue needs an independent source.
- Find the earliest public context. A prior post or archive capture can limit when an image circulated. A first observed post is not necessarily the original upload.
- Ask for the closest lawful original. If the person who supplied the file can share a camera original and its context, compare it with the derivative. Do not pressure anyone to disclose private location data.
- Keep alternative explanations alive. A clock set to another zone, a republished old image and an export that removed tags can each explain different discrepancies.
The Berkeley Protocol provides a broader professional model for collection, preservation, verification and analysis. A metadata field is one observation in that process, not a substitute for it.
Write the conclusion at the strength of the evidence
Use three lines in a report: observed (the exact tag value and file), interpreted (what that value could mean), and unresolved (the clock, export path, independent scene confirmation). If two copies disagree, name both. If the tag is absent, say which copy was checked.
A byte-for-byte hash can show that the file you analyze has not changed since you preserved it. It cannot certify what happened before you received it. Similarly, embedded coordinates may be useful leads, but they are not an identity or exact-camera-position guarantee. If a public post could expose someone’s private home or movement, report only the precision needed for the legitimate question.
The OSINT report template shows where to put file observations and limits so another reader can inspect them. The Image OSINT page explains the separate visual-analysis path.
When a photo belongs to a larger investigation
You can inspect a single file with a free metadata utility and keep a simple worksheet. OSINT Jet’s image offering is described as visible-content analysis; metadata extraction is a separate free-utility path, not a hidden capability of the paid image add-on. If the case also involves a domain, a post, a company claim and contradictory dates, the value of a structured case is keeping those observations and relationships reviewable together.
Start with the free tools for the file you have. If you need a wider report, review the current credits and pricing before choosing an investigation. Only carry forward the claims your evidence can support.
Published by OSINT Jet · Original publication: 29 September 2026