Home

Welcome to the EXIFhunter wiki!

The “EXIFhunter” Python project automates the task of sifting through a directory of files, to discover images that contain possible Exchangeable Image File Format (EXIF) metadata. It identifies images, from a limited list of recognized image types. Those images types are, rgb, gif, pbm, pgm, ppm, tiff, rast, xbm, jpeg, bmp, png, webp, and exr.

EXIFhunter locates possible EXIF metadata by searching for the ASCII “Exif” within the image data. Although there is no standard byte offset within an image for EXIF metadata, the start of the EXIF Image File Directory (IFD) with the ASCII “Exif” seems to be a standard (Tachibanaya, 1999). That ASCII “Exif” can appear as capital case “Exif”, upper case “EXIF”, lower case “exif”, or camel case “eXif” according to my limited research. EXIFhunter will produce a list of image files, that contain possible EXIF metadata, without regard to any file extension. Additionally, EXIFhunter produces lists of files processed, including non-image files and image files that possibly did not contain EXIF metadata.

EXIF was created by the Japan Camera Industry Association and is currently managed by the managed by Japan Electronics and Information Technology Industries Association (JEITA)(Iqbal, 2019). The EXIF standard provides an Image File Directory (IFD), within the image, for storing tagging and metadata information. That information can contain a variety of data composing over 22,000 tags that include camera manufacturers, and tags specific to Microsoft and Apple (Harvey, 2022). One tag of digital forensic interest is the GPS tag. The GPS tag can contain 31 unique tag IDs that could describe the location of the device that created the photographic image.

References:

Harvey, P. (2022, September 16). ExifTool by Phil Harvey. Exiftool.org. https://exiftool.org/index.html

Iqbal, K. (2019, October 11). EXIF. FILEFORMAT. https://docs.fileformat.com/image/exif/

Tachibanaya, T. (1999, December 19). Exif file format. The Media Lab @ the MIT Museum. https://www.media.mit.edu/pia/Research/deepview/exif.html