Reading photos like an investigator: EXIF and geolocation

Every photo is two things: the image you see, and a pile of hidden text describing how it was made. The hidden part is called EXIF, and when it survives, it can hand you a camera model, an exact timestamp, sometimes a GPS pin. When it doesn't survive, the image content itself still talks. Both skills matter.

9 min read · Digital Forensics · Updated October 2026

What EXIF is

EXIF (Exchangeable Image File Format) is metadata your phone or camera writes into the file at the moment of capture: timestamp, device make and model, camera settings, orientation, software version, and, if location services were on for the camera app, GPS coordinates. Screenshots usually carry none of this, which is itself a clue about how a file was made.

Forensics cares because metadata is hard to fake casually. Most people editing a photo to hide something change the pixels and forget the timestamps, or change the filename and forget the software field. Inconsistencies between the pixels and the metadata are where images get caught lying.

Reading it: ExifTool and friends

The standard tool is ExifTool, and the whole skill fits in one command:

exiftool photo.jpg

File Name        : photo.jpg
Make             : Apple
Model            : iPhone 14 Pro
DateTimeOriginal : 2026:09:14 17:42:03
GPS Latitude     : 28 deg 36' 42.15" N
GPS Longitude    : 77 deg 12' 31.80" E
Software         : 17.5.1

No terminal? Online viewers like jimpl.com or metadata2go.com do the same in the browser. Just don't upload anything sensitive to a random web tool when the point of your investigation is confidentiality.

The fields worth reading first, in order:

GPSLatitude / GPSLongitude — the jackpot. Paste them into Google Maps.
DateTimeOriginal — when the shutter fired, not when the file was copied. File modification dates lie more easily.
Make / Model / Software — narrows down the device, and an editing-software field on a "raw untouched" photo is a contradiction worth chasing.
Orientation and thumbnail data — edited images sometimes keep the original thumbnail inside the file, showing the pre-edit picture.

Turning GPS into a place

ExifTool prints coordinates in degrees-minutes-seconds; Google Maps wants decimal degrees. Convert (28°36'42.15"N = 28.611708) or just paste the whole DMS string into the Maps search box, it understands it. A couple of quick sanity checks: coordinates near 0,0 usually mean the field was never real, and a photo "taken" somewhere the sun angle doesn't match the recorded time deserves suspicion.

The catch: most platforms strip EXIF

This is the part beginners get wrong. Modern messaging apps compress images on send, and compression throws metadata away. WhatsApp, Instagram, X/Twitter, and Facebook strip EXIF from uploaded photos. If an image came from any of those, don't bother checking its EXIF; there won't be any beyond the re-encoding fingerprints.

Telegram is the interesting exception: send a photo normally and it compresses (EXIF gone); send it as a file / document and the original bytes travel untouched, metadata included. That distinction matters both as an investigator and as anyone who cares about their own privacy.

Practical consequence: treat "is there metadata?" as a question with three answers. Original file: probably yes. Messaged through a chat app: no. Downloaded from a platform that re-encodes: no, but the re-encoding pattern can still tell you which platform it passed through.

No EXIF? Geolocate the pixels

When metadata is gone, the image itself is the evidence. This is visual geolocation, and it's a genuinely learnable skill:

Read the text. Shop signs, street names, phone number formats, license plate colors, language on packaging. Text narrows a country fast.
Reverse image search. Yandex Images and Google Lens both take the photo and find where else it lives. If it's a landmark or a repost, you may get the location in one click.
Check the hardware. Bollard styles, utility pole shapes, road line colors, manhole covers, car models in traffic. GeoGuessr players call this "meta" knowledge, and it's real: specific bollard designs pin specific countries.
Use the sun. Shadow length and direction against a known timestamp rules continents in and out. Northern hemisphere, long shadows pointing north-east in the morning? That's consistent; south? That's not.
Corroborate. One clue is a guess. Three independent clues (sign language + vegetation + car model all agreeing) is a finding. Verify the final candidate in Street View or satellite imagery before calling it.

Practice on safe targets

GEOINT challenges on CipherPoint hand you artifacts exactly like these: files with metadata to read, photos to place, timelines to check against. Synthetic targets, real technique.

Try a geolocation case and see how far one coordinate gets you.

Browse challenges