Skip to content

Digital Metadata

Extracting metadata from digital artifacts is a foundational technique in OSINT and red team operations. Metadata often contains hidden contextual clues about the creation, modification, or usage of a file, such as timestamps, geolocation data, authorship information, and embedded headers. This section explores methods to recover and analyze metadata from common file types, emphasizing both standard and obscure sources.

1. Document Metadata Extraction

Documents (e.g., PDFs, Word files, spreadsheets) frequently store metadata in headers, footers, or embedded objects. Tools like ExifTool or Python’s PyPDF2/olefile can extract this data.

Example: PDF Metadata

exiftool -Title -Author -Creator -Subject -Keywords document.pdf
This command retrieves metadata fields like title, author, and keywords from a PDF. Note that some PDFs may strip metadata, requiring hex editing or tools like pdfinfo for low-level analysis.

Example: Microsoft Office Files

from olefile import OleFileIO
with OleFileIO("document.docx") as f:
    f.open()
    print(f.get_root().get("CoreProperties"))
This Python script accesses embedded metadata in a Word document using the olefile library.

2. Image Metadata Extraction

Images often contain EXIF, IPTC, or XMP metadata, which can reveal camera models, geolocation, and editing history. Tools like ExifTool or jpeginfo are essential for this task.

Example: EXIF Data from JPEGs

exiftool -GPSLatitude -GPSLongitude -CameraModel image.jpg
This command extracts geolocation and camera model data. For PNGs, use: 
exiftool -all image.png

Example: Python with PIL

from PIL import Image
img = Image.open("image.jpg")
print(img._getexif())  # Returns EXIF data as a dictionary

3. Hidden Metadata in Non-Traditional Sources

Some artifacts store metadata in unconventional ways: - PDFs: Use pdfinfo to check for embedded metadata. - Emails: Extract headers (e.g., Date, From, To) using tools like mailheader. - Audio/Video Files: Use ffmpeg to extract metadata: 

ffmpeg -i video.mp4

4. Analyzing Metadata for OSINT

Key insights from metadata include: - Geolocation: Latitude/longitude from images or GPS-enabled devices. - Timestamps: Creation/modification dates to infer timelines. - Authorship: Hidden signatures or embedded watermarks. - Device Fingerprinting: Camera models, software versions, or OS details.

5. Tools and Frameworks

  • ExifTool: A Swiss Army knife for metadata extraction (supports over 100 file types).
  • Foremost: For recovering deleted metadata from unallocated disk space.
  • Python Libraries: pyexiv2, Pillow, olefile, pdfplumber.

Key takeaways

  • Metadata is a critical source of contextual information for OSINT and red team analysis.
  • Use specialized tools like ExifTool or Python libraries to extract metadata from documents, images, and other files.
  • Analyze geolocation, timestamps, and authorship data to uncover hidden patterns or connections.
  • Be aware of obfuscation techniques (e.g., stripped metadata) and use low-level tools for deeper analysis.