Thursday, August 12, 2010

Extracting MetaData from photos using exiftool in BT4

This guide is about using exiftool, this tool is used to strip Meta data from photos. This can be used from both a Forensics standpoint as well as for doing reconnaissance work on a given target. Especially if this target is very generous when it comes to giving away too much information, in it's photos.
As a warning, it's not cool to stalk people so don't be doing it.
I mean really if you have to stalk someone you probably will never have a relationship with them anyway loser!

So the tools is located in the menu structure under Digital Forensics, or through the
/pentest/misc/exiftool/ directory.

This screen shot shows the default output when calling the command.
root@bt:/pentest/misc/exiftool# ./exiftool

From exiftool

You will need to read the README in order to learn more information.

If you want to just test the tool out, you can use the provided .jpg to do so.
The command would be
root@bt:/pentest/misc/exiftool# ./exiftool t/images/ExifTool.jpg

From exiftool

The above photos only shows a portion of the output. To see the rest you will need to run the tools yourself.
There is a lot of information that could be gained from this test, but in reality the tool author has already sanitized anything of value.
The only thing that is really left is camera information. Boring at best. So let's grab a few photos from the web and see what they can give us.

Ok so to help keep the innocent that way, I won't be linking or giving away too much on the actual photos, I downloaded.
But they are easy to find thanks to social media 2.0.
From the next photo we can parse quite a lot of data out of it.

root@bt:/pentest/misc/exiftool# ./exiftool /tmp/1444432405-37422182c96b551a67f534ead5532.4c63f758-scaled.jpg

From exiftool

So photos 3 shows some generic information on from the camera, we can determine roughly the type of phone in this case a Motorola Droid X

From exiftool

But, in photo 4 bingo, we now have the information from the GPS. So we now know exactly where our target is located, at least at the time of the photo being taken. But by looking at the same information from several photos we maybe able to determine patterns in our targets behavior.
So here is the pertinent data given up by our photograph. 28 degrees 26' 26.00" N 81 degrees 28' 26.00" West
There are many websites to include Google maps to help you put this info into something more familiar, like addresses. Depending on the phone or camera being used this information can be turned off. Which is kind of a smart thing to do.

So that's about it. There are several ways to gain this information from photos, and this is one of tools, that is included in BT to do it.

1 comment:

JJohnny said...

Really nice .. Thx Archangel Amael!