VideoCCTV / DVR AnalysisExport footage from Hikvision, Dahua and other DVRs with correct times, frames and hashesImage & Video Metadata
Read EXIF, XMP, GPS tags and MP4 atoms with ExifTool and know what each field can prove
- Beginner
- Online or on campus
- 5 hands-on labs
- 7 modules
About this course
A photo is sent as proof that a person was at a certain place at a certain time. Before anyone relies on it, someone should check what the file itself says. Which device made it, when and where it was made and whether any software has touched it since. That is metadata analysis and it is often the quickest check in an image or video case.
This course teaches you to read and interpret metadata in photos and videos. You work with EXIF fields such as DateTimeOriginal and OffsetTimeOriginal, the GPS tags, XMP edit history written by Adobe and other software, maker notes and embedded thumbnails. For video you walk the atom (box) structure of MP4 and MOV files, including the mvhd and tkhd times, encoder names and Apple's location tags. ExifTool is the main tool and you use it from the command line so that results can be repeated.
Metadata is easy to change and easy to lose. WhatsApp and most social media platforms strip it. Anyone can edit it with free tools. A large part of the course is about what metadata cannot prove and how to say so in a report.
EXIF and XMPGPS tagsMP4 atomsExifTool
After this course you can
- Extract all metadata from images and videos with ExifTool and save it in a repeatable way
- Read EXIF date fields, time offsets and GPS tags and convert them correctly
- Spot signs of editing in XMP history, software tags, thumbnails and JPEG quantisation tables
- Walk the atom structure of MP4 and MOV files and interpret creation times and encoder tags
- Tell embedded metadata apart from file system timestamps
- Report what metadata shows and what it cannot prove
Syllabus
7 modules · 25 topics
01Metadata basics3 topics
- Embedded metadata compared with file system timestamps
- Why copying, downloading and messaging change some dates and not others
- Hashing the original file before you open it
02EXIF in depth4 topics
- Make, Model, Software and serial number fields
- DateTimeOriginal, CreateDate, ModifyDate and OffsetTimeOriginal
- Maker notes and what they add for some camera brands
- Embedded thumbnails that may still show the picture before it was edited
03GPS tags4 topics
- GPSLatitude, GPSLongitude and GPSAltitude with their reference fields
- GPSDateStamp and GPSTimeStamp in UTC compared with local camera time
- Converting to decimal degrees and plotting on a map
- Position accuracy and why indoor locations can be wrong
04XMP, IPTC and editing traces4 topics
- XMP history, DocumentID and InstanceID from Adobe software
- IPTC captions, credit and copyright fields
- JPEG quantisation tables and signs of re-saving
- HEIC, PNG and WebP files and the metadata each can carry
05Video containers4 topics
- The atom tree of MP4 and MOV files with ftyp, moov, trak, mdhd and mdat
- Creation times in mvhd and tkhd (counted from 1904) and whether they are in UTC or local time
- Encoder and handler names, such as the Lavf tag left by FFmpeg
- Apple location and device tags in the keys and udta atoms
06Platforms and messaging apps3 topics
- What WhatsApp, Instagram and other platforms strip or keep
- A file sent on WhatsApp as a photo compared with one sent as a document
- Getting the original from the sender's device when the copy has no metadata
07Reporting3 topics
- Exporting ExifTool results to CSV and JSON for the case file
- Careful wording such as 'consistent with' in place of 'proves'
- Common mistakes in metadata reports and how to avoid them
Hands-on labs
- Lab 1
Extract metadata from a folder of photos to CSV with ExifTool and sort them by DateTimeOriginal
- Lab 2
Plot GPS tags from a set of phone photos on a map and find the one that does not fit
- Lab 3
Compare an original photo with the same photo sent over WhatsApp as an image and as a document
- Lab 4
Walk an MP4 file's atoms, read the mvhd times and identify the encoder
- Lab 5
Find signs of editing in a JPEG through its XMP history, thumbnail and quantisation tables
Tools you will use
- ExifTool
- MediaInfo
- FFmpeg and ffprobe
- JPEGsnoop
- Amped Authenticate
- Autopsy
- HxD hex editor
- Google Earth Pro
Who it suits
- Students starting in image and video forensics
- Police officers and analysts who check photos submitted as evidence
- Journalists and fact-checkers
- Lawyers who need to question photo and video evidence
Before you join
- Basic computer skills
- No command line experience needed. The ExifTool commands you need are taught step by step
Questions about this course
Can metadata prove where a photo was taken?
It can support it. GPS tags can be wrong, missing or edited, so metadata should be backed by other evidence such as the device itself, cloud records or what the photo shows.
If the metadata has been removed, is the photo fake?
No. Messaging apps and websites remove metadata from most photos they handle. Missing metadata tells you about the path the file took, not about whether the picture is genuine.
Do I need paid software?
No. ExifTool, MediaInfo and FFmpeg are free and cover most of the course. Commercial tools such as Amped Authenticate add structured checks and reports. The course explains where they help.
More courses in Surveillance & Image / Video Forensics
VideoCCTV / DVR AnalysisExport footage from Hikvision, Dahua and other DVRs with correct times, frames and hashes
VideoDeepfake / AI ForensicsExamine face swaps and AI-made media, check C2PA provenance and know where detectors failNot sure this is the right one for you?
Tell us your background and what you want to do next. A counsellor will suggest a course and the next batch.