Hack Like a Pro: Digital Forensics for the Aspiring Hacker, Part 16 (Extracting EXIF Data from Image Files) « Null Byte :: WonderHowTo

Welcome back, my greenhorn hackers!In many cases when a computer, phone, or mobile device is seized for evidence, the system will have graphic images that might be used as evidence. Obviously, in some cases these graphic images may be the evidence such as in child pornography cases. In other situations, the graphic images may tell us something about where and when the suspect was somewhere specific.Most digital devices "stamp" information on these graphic images that can tell us a lot about the who, what, when, and where the pictures were taken. This information is known as EXIF data and can very often be useful to the forensic investigator.EXIF DataExchangeable image file format (EXIF) is a standard set by the digital camera industry to identify formats for digital images and sound files. This information includes camera settings, time, date, shutter speed, exposure, whether a flash was used, compression, the name of the camera, and other information critical to viewing and editing the image in image-editing software. This information can also be useful to the forensic investigator.Originally developed for JPG and JPEG file formats, some other formats use EXIF data as well, but this data isnotavailable for PNG and GIF image file types.Graphic Image TypesThere are numerous graphic formats. These include:PSDJPEGBMPTIFFPNGGIFBPGJFIFand many, many moreThere are numerous application that can extract this EXIF data from graphic files. Nearly everyone of the major forensic suites (EnCase, FTK, Oxygen, etc.) has this capability built in. For this lab, we will be using a simple, Windows-based tool calledExifReader(free).Update:Use a Command Line Tool, Web App, or Browser Extension to View EXIF Data on Practically Any ComputerStep 1: Install ExifreaderOnce you havedownloaded ExifReader, click on the executable and it will open a clean and simple GUI like that below.Now, simply click on the "Open" button and browse to the pictures on the system or media. JPEG and JPG contain the most information, so let's use those.Step 2: Open a Picture FileWhen you open the picture file with ExifReader, it will load the picture into the thumbnail to the left and display the EXIF data to the right down the page.Note that the picture on the suspect's computer was made with a Samsung phone, Model SCH-I535, and was taken on March 15th, 2014 at 11:04 a.m.There is numerous other information in the EXIF data, but most is related to the technical specs of the camera and photography. Most of this is of limited value to the forensic investigator.If the device had GPS enabled when the picture was taken, we would know the exact GPS coordinates of where the picture was taken.Step 3: Extract EXIF from Another PhotoLet's try another picture. Once again, this will be a JPG file. When we open it, unfortunately the thumbnail does not appear. This happens with more than a few pictures, but the EXIF data is still displayed, even if the thumbnail doesn't.As you can see below, it tells us that the picture was taken by a Nikon camera, model E3100, on February 18th, 2007Step 4: Extracting GPS DataIn this picture, we will look to see if we can extract the GPS data for the location of where the picture was taken.When we extract the EXIF data from this picture, we find out it was taken with an Apple iPhone4son August 25th, 2011 at 9:27:36 a.m.Near the bottom of the EXIF data we can find the GPS information, expressed in latitude and longitude, as this Apple iPhone had location services enabled. We can now take this data from the EXIF and put it into Google Maps or other mapping application to find the exact location where this picture was taken.Google Maps reveals that this suspect took this picture in Yosemite National Park in California, USA.When forensic investigators have graphic image files to work with, very often they can find useful information about the file and the suspect in the EXIF data. This information includes the camera manufacturer and type, the time the photo was taken, and maybe even the location where the photo was taken, all potentially useful information in a digital forensic investigation.Keep coming back, my greenhorn hackers, as we explore digital forensics to keep you safe!Want to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseRelatedHack Like a Pro:Digital Forensics for the Aspiring Hacker, Part 1 (Tools & Techniques)Hack Like a Pro:Digital Forensics for the Aspiring Hacker, Part 11 (Using Splunk)How To:Obtain Valuable Data from Images Using Exif ExtractorsHow To:The Essential Skills to Becoming a Master HackerHack Like a Pro:Digital Forensics for the Aspiring Hacker, Part 5 (Windows Registry Forensics)How To:Become a Computer Forensics Pro with This $29 TrainingNews:How to Study for the White Hat Hacker Associate Certification (CWA)Hack Like a Pro:Digital Forensics for the Aspiring Hacker, Part 6 (Using IDA Pro)Hack Like a Pro:Digital Forensics for the Aspiring Hacker, Part 8 (More Windows Registry Forensics)SPLOIT:Forensics with Metasploit ~ ( Recovering Deleted Files )News:Why YOU Should Study Digital ForensicsHack Like a Pro:Digital Forensics Using Kali, Part 1 (The Tools of a Forensic Investigator)Hack Like a Pro:Digital Forensics for the Aspiring Hacker, Part 12 (Windows Prefetch Files)Hack Like a Pro:Digital Forensics for the Aspiring Hacker, Part 14 (Live Memory Forensics)Hack Like a Pro:Digital Forensics Using Kali, Part 2 (Acquiring a Hard Drive Image for Analysis)Hack Like a Pro:Digital Forensics for the Aspiring Hacker, Part 15 (Parsing Out Key Info from Memory)Hack Like a Pro:Digital Forensics for the Aspiring Hacker, Part 9 (Finding Storage Device Artifacts in the Registry)Hack Like a Pro:Digital Forensics for the Aspiring Hacker, Part 2 (Network Forensics)Hack Like a Pro:Digital Forensics for the Aspiring Hacker, Part 3 (Recovering Deleted Files)How To:The Hardware Hacker's Introduction to Microcontrollers, Part One: Anatomy of an ArduinoHack Like a Pro:Digital Forensics Using Kali, Part 3 (Creating Cases in Autopsy & Sleuth Kit)Advanced Nmap:Top 5 Intrusive Nmap Scripts Hackers & Pentesters Should KnowHow To:Scrub the EXIF Data from Photos on Your Android Phone Before Sharing ThemHack Like a Pro:Digital Forensics for the Aspiring Hacker, Part 7 (Windows Sysinternals)Hack Like a Pro:Linux Basics for the Aspiring Hacker, Part 11 (Apache Web Servers)Hacking Windows 10:How to Find Sensitive & 'Deleted' Files RemotelyNews:Sneaky! WhatsApp Adds Encryption to iCloud Backups on the SlyNews:Airline Offers Frequent Flyer Miles to HackersHow To:Wipe & Obfuscate Identifying Information in Your Protest Photos for More Anonymous SharingHow To:Expand Your Coding Skill Set with This 10-Course Training BundleHack Like a Pro:Digital Forensics for the Aspiring Hacker, Part 13 (Browser Forensics)How To:Find Target Location with an iPhone PictureHow To:Completely Remove Your Hidden Personal Information from Digital PhotosThe Sony Hack:Thoughts & Observations from a Real HackerHow To:Don't Get Caught! How to Protect Your Hard Drives from Data ForensicsGoodnight Byte:HackThisSite, Realistic 3 - Real Hacking SimulationsGoodnight Byte:HackThisSite Walkthrough, Part 8 - Legal Hacker TrainingHow to Hack Your Game Saves:A Basic Guide to Hex EditingGoodnight Byte:HackThisSite, Realistic 4 - Real Hacking SimulationsNews:The Epson International Pano Awards Photography Contest - Deadline April 15, 2011