MyRecon OSINTWhat Your Photos Give Away: EXIF and Image Metadata
An image file is not only an image. Cameras and phones write a block of data into it describing the device, the settings, the moment and sometimes the exact coordinates, and whether any of that reaches the person who receives the photo depends entirely on the route it travelled.
What is actually in there
The main standard is EXIF, accompanied in many files by IPTC and XMP blocks used by publishers and editing software. Between them a photograph can carry:
- Device. Make and model, and often the lens. Enough to say "these two photos came from the same model of phone", which is weaker than it sounds and still occasionally decisive.
- Timestamps. When the shutter fired, when the file was created, when it was last modified, as set by the device's own clock, in the device's own time zone.
- Camera settings. Exposure, aperture, ISO, focal length, flash. Mostly of interest for establishing that two images were or were not taken in the same session.
- GPS coordinates, where location services were enabled, latitude, longitude, frequently altitude and a compass bearing. This is the field with real consequences.
- Software history. The editor that last wrote the file, which is how you learn a photograph has been through an image editor at all.
- A thumbnail. A small embedded preview, which in older files was sometimes not regenerated after editing, so the thumbnail could still show the uncropped original. Modern tools handle this correctly, and older files in circulation do not.
- Serial numbers, on some cameras. A body or lens serial number links every photograph a camera ever took.
- Authorship and copyright fields, in IPTC and XMP, where a professional workflow has filled them in.
The coordinates are the part that matters. A phone with location services on writes where the shutter was pressed, to within a few metres. One photograph is a place. A set of photographs is a pattern: a home, a workplace, a school, a route and the hours each is occupied. The risk is not usually a single revealing image, it is that a person's photo library, shared piecemeal over years, describes their life geographically without any of it being intended.
Who strips it and who does not
This is where most assumptions go wrong in both directions.
Metadata is usually removed by the large social platforms, which re-encode every upload into their own formats and sizes, and by most messaging apps when sending as a photo rather than a file. The stripping is a side effect of compression rather than a privacy feature, which is why it is not guaranteed and not announced.
Metadata usually survives when the original file travels rather than a copy of it: email attachments, messaging apps used in "send as document" or "original quality" mode, cloud storage downloads, files transferred between devices, and images hosted on personal sites, forums and smaller platforms that do not re-encode.
So the practical rules are two, pointing in opposite directions. If you are sharing, do not rely on a platform to protect you, strip it yourself. If you are investigating, always look, because the assumption that "platforms remove it" causes people to skip a check that costs seconds.
How to read it
Every operating system exposes some of it without extra software. On Windows, right-click a file, open properties and look at the details tab. On macOS, open the image in Preview and inspect the info panel, which has a dedicated tab for GPS when coordinates are present. On a phone, the photo details view in the gallery app shows the device, the timestamp and a map when location is recorded.
Dedicated metadata tools show considerably more, including the vendor-specific blocks the system dialogs ignore, and are worth using when the question matters.
One caution about online metadata viewers: using one means uploading the image to a third party. For a photograph you are investigating that may be acceptable; for a private photograph of your own, you have just published it to a stranger's server in order to check whether it was private.
How much weight it carries
Less than people assume, in both directions.
Metadata is trivially editable. Free tools rewrite any field, including timestamps and coordinates. It is a claim made by whoever last saved the file, not a property of reality, and treating a GPS tag as proof of where a photograph was taken is how confident wrong conclusions get made in public.
Absence proves nothing. A file with no metadata may have been deliberately cleaned, or it may simply have passed through one platform that re-encodes uploads. The second is far more common. "The EXIF was stripped, so they are hiding something" is an inference the evidence does not support.
Timestamps drift. The clock belongs to the device and may be wrong, unset, or in a different time zone from the one you assume, a three-hour discrepancy is more often a traveller who did not update their phone than a fabrication.
Where metadata earns its place is as corroboration: consistent with the other evidence, or inconsistent with it in a way that demands explanation. On its own it settles nothing, which is the same standard applied in verifying an OSINT finding.
What the picture itself gives away
Because metadata is so often absent, the durable signal is the content, and it is usually richer. House numbers, street signs, shop fronts, vehicle number plates, school uniforms and logos, the view from a window, a distinctive skyline, the language on a menu, seasonal foliage, shadow direction and length, and reflections in glass, screens and eyes.
Geolocation of images as practised by investigators and open-source researchers is built almost entirely on these, not on EXIF, precisely because the coordinates are so rarely present in published images. The reverse image search guide covers how to search these elements independently of the photograph as a whole.
Practical protection
- Turn off location tagging in the camera app. The single highest-value change, and it costs almost nothing, you can still add a location to the posts where you want one.
- Strip metadata before sharing anything outside a platform. Windows offers this in the file properties dialog; macOS in Preview; phone share sheets increasingly include a location toggle.
- Screenshot when you only need the image. A screenshot is a new file with none of the original's metadata, which is the quickest reliable strip available.
- Watch the sending mode in messaging apps. "Send as file" or "original quality" preserves everything the compressed path would have removed.
- Check photos of documents before sending them, metadata aside, the visible background of a photographed document frequently includes things nobody meant to send.
- Audit what you have already posted where it sits on your own site or in a forum, since those are the places the original file is most likely to still be online intact.
Provenance metadata is the emerging counterweight. Content Credentials, under the C2PA standard, attach a signed record of how an image was created and edited, and are now being written by some cameras and editing tools. It is designed to be evidence of origin rather than a privacy risk, and it is becoming one of the few durable ways to say where an image came from, relevant precisely because generated images have no earlier existence for a reverse search to find.
Questions people ask
Does posting a photo on social media reveal my location?
Usually not through EXIF: the major platforms strip metadata when they re-encode uploads. The location leak on social media is far more often the visible content of the photo, a street sign, a view from a window, a repeated background, or a location tag you added yourself.
Where does EXIF survive?
In files sent as email attachments, shared through messaging apps that preserve originals or send as a document, downloaded from cloud storage, and hosted on personal websites and forums that do not re-encode. Anywhere the original file moves rather than a re-compressed copy of it.
Can EXIF data be faked?
Easily. Every field is editable with free tools, including the timestamp and the GPS coordinates. Metadata is a claim made by whoever last saved the file, which is why it corroborates other evidence rather than establishing anything on its own.
How do I remove metadata before sharing a photo?
On Windows, the file properties dialog has a "remove properties and personal information" option. On macOS, Preview can strip location. Phones offer a location toggle in the share sheet, and screenshotting an image produces a new file with none of the original metadata at all.