Skip to content

ZeroTrace OSINT

EXIF GPS Trail

Bulk EXIF extraction across a folder of photos with map polyline, distance, speed, and anomaly detection.

Investigators usually have a folder of photos, not a single one. The EXIF GPS trail tool walks the folder, extracts GPS from every image, sorts by timestamp, and renders the result as a map polyline with distance, speed, and anomaly detection.

Inputs

  • A directory path containing images, or
  • A list of file paths.

The tool walks the directory recursively (with a sensible depth cap) and processes every supported image format in parallel.

What you get

SectionWhat it surfaces
Map polylineEvery GPS-bearing photo plotted on an OpenStreetMap base, connected in timestamp order
Photo tableOne row per image: filename, timestamp, lat, lon, altitude, speed, distance from previous, time elapsed
Trip statisticsTotal distance, total elapsed time, average speed, max speed
Cluster analysisGeographic clusters (multiple photos within a small radius and short time window)
AnomaliesTimestamp gaps, GPS jumps, speed implausibilities
ExportKML, GeoJSON, CSV

Map polyline

The polyline connects sequential GPS fixes in timestamp order. It is a literal trail of where the photographer went, in the order they went there. For:

  • Travel reconstruction — what route did the subject take?
  • Verification of stated movements — does the trail match what the subject claims?
  • Investigation of staged photos — does the GPS trail support the narrative?

A static map preview renders inline; a one-click affordance opens the trail full-screen with zoom and pan.

Trip statistics

Computed across the full sequence:

  • Total distance — sum of point-to-point Haversine distances.
  • Total elapsed time — first to last timestamp.
  • Average speed — distance / time.
  • Sanity classification — walking / cycling / driving / flying based on average speed.

The classification is a sanity check. A trail with an average speed of 800 km/h was almost certainly photographed from an aircraft (or has clock errors).

Cluster detection

Photos taken within a small radius and a short time window cluster. The tool surfaces clusters as:

Cluster 1: 12 photos within 80 m at 14:30-14:45 — likely a single venue Cluster 2: 5 photos within 150 m at 16:00-16:30 — likely a single location

Clusters often correspond to single venues, single events, or single stops on a longer trip. Useful for pin-pointing where the subject spent time versus where they merely passed through.

Anomaly detection

The tool flags:

  • Timestamp jumps — large gaps between sequential photos.
  • GPS jumps — large distances between sequential photos that the elapsed time cannot explain.
  • Camera-clock errors — sequences where the EXIF clock is off by a consistent number of hours (often a timezone misconfiguration).
  • Mixed time references — sequences from multiple cameras where the clocks were not synchronised.

Anomalies do not necessarily indicate manipulation. Camera clocks drift, photographers cross timezones, GPS occasionally fails. But a flagged anomaly is worth checking before relying on the trail as evidence.

A camera clock that is consistently off by a whole number of hours is almost always a timezone mistake, not a manipulation. The tool surfaces this distinctly so you can correct mentally without losing the rest of the trail.

Export formats

FormatWhen to use
KMLOpen in Google Earth or any KML-aware mapping tool
GeoJSONOpen in QGIS, ArcGIS, or any GIS tool
CSVOpen in a spreadsheet for table-style analysis
PNG of mapStatic image for a report

Pivots

Click on...Pivot to
Individual photoImage metadata (full EXIF detail)
CoordinateAerial comparator
ClusterAerial comparator centred on the cluster
Anomaly(no pivot — flag for manual review)

Sources

  • All EXIF processing runs locally.
  • The map base layer fetches OpenStreetMap tiles; the OSM tile server is named on the result.

The tool does not transmit photos anywhere. The polyline rendering happens locally.

Command Palette

Search for a command to run...