ZeroTrace OSINT
Image Metadata
Full EXIF / IPTC / XMP parsing, GPS extraction with map preview, perceptual hashes, and thumbnail extraction.
The image metadata tool reads every embedded data block from a photo and surfaces it in a structured view. EXIF (camera and exposure data), IPTC (caption and copyright data), XMP (extended metadata), GPS coordinates, perceptual hashes, and embedded thumbnail.
It is the right first tool for any image investigation — the cheap wins are here, before you reach for the heavier tools.
Supported formats
JPEG, PNG, TIFF, HEIC, WebP, GIF, BMP, and the major RAW formats (CR2, NEF, ARW, DNG, ORF, RW2). Multi-image files (multi-page TIFF, animated GIF) extract per-frame metadata where present.
What you get
| Section | What it surfaces |
|---|---|
| Camera | Make, model, lens, serial number (when present), software / firmware version |
| Exposure | Date and time taken, aperture, shutter speed, ISO, focal length, flash status, white balance |
| Image | Dimensions, orientation, colour space, bit depth, compression |
| GPS | Latitude, longitude, altitude, speed, bearing, datestamp — with a static map preview |
| IPTC | Caption, keywords, copyright, creator, source |
| XMP | Author, title, description, hierarchical keywords, rating |
| Thumbnail | Embedded thumbnail extracted as a separate image — sometimes shows uncropped scenes the visible image hides |
| Perceptual hashes | pHash, dHash, aHash — used for cross-image matching |
Why GPS matters
A photo with embedded GPS is the easiest geolocation in OSINT. Coordinates plus a static map plus a click-through to OpenStreetMap, and you have your location.
The tool surfaces:
- Latitude / longitude in decimal and DMS formats.
- Altitude (where the camera recorded it).
- Direction the camera was facing (where recorded).
- Speed (where recorded — relevant for photos taken from moving vehicles).
- The GPS timestamp (sometimes different from the camera's date/time).
A pivot to the aerial comparator loads the coordinate into side-by-side satellite views.
Many social-media platforms strip GPS from uploaded photos, but the original file the user shared often retains it. If you have access to the original, EXIF GPS is the answer most of the time. If you only have the social-media version, the GPS is usually gone.
Camera serial number
Some cameras embed the camera's serial number in EXIF. If the same serial number appears in multiple photos from putatively-different sources, those photos came from the same camera — strong attribution signal.
The tool surfaces the serial number in a callout when present, with a "search the web for this serial number" affordance.
Lens serial number
Same idea, for lenses. A serial number that appears across multiple cameras and multiple photographers tells you the lens was passed around (or rented). Less common signal than camera serial, but useful in long-tail cases.
Embedded thumbnail
JPEG and many RAW formats embed a thumbnail. Sometimes the thumbnail was generated before the photographer cropped the visible image — meaning the thumbnail shows scene content the visible image hides.
The tool extracts and displays the thumbnail at full size. Worth checking on every photo — the difference between thumbnail and visible image is occasionally the entire investigation.
Perceptual hashes
The tool computes three perceptual hashes per image:
- pHash — DCT-based, robust to scaling and minor compression changes.
- dHash — gradient-based, robust to colour shifts.
- aHash — average-based, the simplest and fastest.
All three feed directly into the photo clustering tool for cross-image matching.
Pivots
| Click on... | Pivot to |
|---|---|
| GPS coordinate | Aerial comparator, sun & shadow solver (if timestamp present) |
| Camera serial | (no pivot — copy and search externally) |
| Image hashes | Photo clustering, reverse image composer |
| IPTC / XMP author / copyright | Person investigation composer |
| Date / time taken | Sun & shadow solver |
Bulk image-metadata extraction
Pass a folder. The tool processes every supported image in parallel (with bounded concurrency). The aggregate result is the input to the EXIF GPS trail tool, which then renders the GPS sequence as a map polyline.
Sources
All processing is local. The map preview fetches OSM tiles around the coordinate; that fetch is named on the result. The "search this serial externally" link is constructed locally — you visit the search engine yourself.