HackBlue

Tools · Ethical OSINT and privacy self-defense · 10 / 17

Image metadata: reading and removing EXIF before you share photos

See what camera and phone photos reveal through EXIF, XMP, and IPTC fields, including GPS coordinates and device serials, and strip them reliably before publishing.

8 min read · practice only with authorization

What photos carry

Most phone and camera images embed metadata: capture time, device make and model, lens, software, sometimes a serial number, and often GPS latitude and longitude. Editing software adds XMP history, and newsrooms add IPTC captions. Many social platforms strip metadata on upload, but email attachments, file shares, websites, and messaging apps that send “original quality” files frequently keep it intact.

Reading metadata with ExifTool

ExifTool reads and writes metadata for nearly every image and document format. Use it on your own files to see exactly what you would be sharing, and group output by family so you can spot location and device fields quickly.

Snippet
exiftool -G1 -a -s holiday.jpg | less
exiftool -gps:all -DateTimeOriginal -Model -SerialNumber holiday.jpg
exiftool -r -if '$gpslatitude' -filename -gpsposition ./to-publish/

Lab: audit and clean a folder before publishing

Copy a few of your own phone photos into a working folder. Run the recursive GPS check above to list which files contain coordinates. Strip all metadata into a new folder so originals stay untouched, then re-run the check on the cleaned copies and confirm nothing location-related remains. Finally, open a cleaned file in an image viewer to confirm it still renders correctly.

Snippet
mkdir -p cleaned && cp to-publish/*.jpg cleaned/
exiftool -all= -overwrite_original cleaned/*.jpg
exiftool -gps:all -Model cleaned/*.jpg   # expect no output fields

Prevention habits

Turn off location tagging in the camera app if you rarely need it, use the share-sheet option that removes location on iOS and Android, and add a metadata strip step to any website publishing workflow. Remember the image content itself can reveal location through street signs, windows, and reflections, which no metadata tool removes.

  • Disable camera location tags by default
  • Strip metadata in publishing pipelines
  • Check visible content, not only fields
  • Keep originals private, publish cleaned copies

Diagram

Photo as captured versus cleaned for publishing

The pixels stay the same; the hidden fields do not.

Original

GPS. 51.5072 N, 0.1276 W

Device. Phone model and serial

Time. Exact capture timestamp

Cleaned

GPS. Removed

Device. Removed

Time. Removed or generalized

Check yourself

1. Which embedded field most directly reveals where a photo was taken?

2. What is the safest stripping workflow?

3. What can still reveal location after metadata is removed?