ExifTool

Phil Harvey writes and maintains ExifTool as a Perl library, Image::ExifTool, and a command line program built on it. It is free software under the same terms as Perl. The site offers the Perl version for any system that has Perl, a Windows executable with Perl bundled inside and a macOS installer package. Version 13.60 of 28 October 2026 was current when checked. The list of metadata it reads includes EXIF, GPS, IPTC, XMP, JFIF, ICC profiles, Photoshop IRB, FlashPix, ID3, GeoTIFF and C2PA content credentials in JUMBF form, together with the maker notes of a long list of camera manufacturers and QuickTime-based metadata in video files, including timed GPS tracks. It also writes and edits metadata, which an examiner uses only on working copies.

The forensic habit is to ask for everything: all tags, duplicates included, with their group names, unknown tags shown and embedded objects followed, written to a text, XML or JSON file that goes into the case. ExifTool runs over whole folders, so a set of files from a phone can be tabulated in one pass and compared. Timestamps appear in several tags, each with its own meaning and time zone behaviour, and the examiner reads them against the file system times and the device settings rather than taking any one of them as the moment of capture. What metadata can and cannot prove is the core lesson. It is editable, social platforms strip most of it and its absence proves nothing. Its presence shows that the file carries these values, which may corroborate or contradict an account. A C2PA signature still needs its own verification step. And an examiner never writes to the evidence file.