YanoSec
Progress0 of 152 lessons complete

Course / 10 Crypto and files / Lesson 09 of 19

Metadata with exiftool

Estimated time: 15 min reading · 15 min activity

A file can carry information about itself, such as a comment, time or location. This is metadata. A tag is a named metadata field and its value. EXIF is one metadata format used with images, while GPS tags may claim a geographic location.

The evidence here is a typed tag table. Its lines are not embedded in the linked four-byte JPEG marker file, which is not a complete photograph. ExifTool is a tool that reads and writes many metadata formats; a tag it displays can still have been edited. You need only the printed table to practise interpretation.

Before you begin

Estimated time
15 min reading, 15 min activity. Setup and optional practice may take longer.
Where you work
Read the supplied byte tables and authored records in any browser, with paper or a text editor. Preserve original files; inspect copies in any later lab. No scanner, image decoder, capture, memory acquisition or installation is required. Practical tool work remains separate from this reading activity.
Without a lab
All evidence needed for the activity appears on this page. Copy it into notes if downloads are unavailable. Read the labeled model and predict each result; a paper trace practises the reasoning while tool operation waits for a lab. Reading needs no JavaScript. Answer checking needs JavaScript and a secure context; saving progress also needs usable browser storage.

After this lesson you can:

  • Find the Comment line on the tag card.
  • State that the DateTime line has no timezone and was typed.
  • Keep the four-byte JPEG marker file separate from the tag card.

01Example

Fresh fictional worked tag, distinct from the guided spare-cable card.

Source: typed practice record, not a camera
Comment: spare lamp
DateTime: 2026-02-03 08:15:00
Timezone: unknown
Interpretation: the record asserts a comment and local time; no real event is confirmed.

02A tag is a sentence someone can edit

An editable field is evidence that the file or card contains a claim. It is not automatically evidence that the claimed event happened. A clock may be wrong, a timezone may be missing, or a value may have been changed. Corroboration means checking against other relevant evidence with an understood source.

Preserve originals and record edits to copies. Missing GPS means the inspected evidence did not provide that tag; it does not prove anonymity or that nobody knows a location. The historical ExifTool record for the owned fixtures remains distinct from this invented table; its absence of GPS/DateTime tags does not turn these typed lines into extracted metadata.

Read an editable tag as a sourced claim and seek independent evidence before treating it as fact.Model. A teaching model drawn by hand. It shows the idea, not real tool output.

Read the full explanation below.

Missing timezone

Source: typed practice record, not a camera
Comment: spare lamp
DateTime: 2026-02-03 08:15:00
Timezone: unknown
Interpretation: the record asserts a comment and local time; no real event is confirmed.
Source statusComment valueDateTime valueMissing timezone
What this part means

The typed record asserts the Comment value spare lamp.

It does not confirm a real event or author.

The typed record asserts the Comment value spare lamp. It does not confirm a real event or author.

Follow the explanation

  1. The typed record asserts the Comment value spare lamp. It does not confirm a real event or author.
  2. DateTime is a typed local time with unknown timezone. Do not convert it to UTC or treat it as a camera observation.
Read every state and value

1. The typed record asserts the Comment value spare lamp. It does not confirm a real event or author.

Selected parts
Source status · comment
Explanation
comment

2. DateTime is a typed local time with unknown timezone. Do not convert it to UTC or treat it as a camera observation.

Selected parts
DateTime value · Missing timezone
Explanation
time
An editable tag is a sourced claim; a local clock string without a zone cannot establish a unique event time.

03Find the Comment line

Read metadata-table.txt as a fictional document. No personal photograph or tool installation is needed.

Label: original fictional tag card. Not exiftool output.
These typed lines are the card. They are not tags inside the owned files.
owned-photo.jpg is the two bytes FF D8 followed by FF D9. It does not contain these tags.
This card does not depend on an image decoder.

Artist: Night Desk
Comment: spare cable
DateTime: 2026-01-15 09:00:00
Timezone in the tag: none
GPS: absent

The Comment line is the activity value.
The DateTime line can be edited on a copy of this card. The card does not record a real event.

Download the fictional tag card

Provenance of the fictional tag card.
The Artist, Comment, DateTime and GPS descriptions were typed for metadata-table.txt.
No camera supplied the values; they are not embedded tags in owned-photo.jpg.
The original historical ExifTool observations remain a separate record.

Download the note of how the card was typed

  1. Find the Comment field and copy its value, spare cable, with the filename as its source.
  2. Read DateTime and the timezone note. Mark the zone unknown rather than filling it from your device.
  3. Use metadata-generator.txt to identify the method: a person typed the lines; no camera supplied them. Write what independent evidence would be needed for a real event-time claim.
  4. Stop after the evidence note. The JPEG marker pair supplies no missing tag values.

04Optional challenge

In about ten optional minutes, copy the tag card into personal notes and change only its DateTime value. Keep old and new values plus a note that you made the edit. This demonstrates editability without altering any original file or investigating a person.

05Fresh cases for the checks

Use these fictional cases for the checks below. They have different inputs from the worked examples. Read them here or make notes; no installation or external service is needed.

Tag card A: independent typed fictional recordOwned fixture. An original file made for this course. Follow the activity's instructions in your own lab.

Source: typed practice card, not an ExifTool extraction or camera record.
Artist: Paper Archive
Comment: spare compass
DateTime: 2026-05-12 10:15:00
Timezone: not supplied
GPS: absent from this card
The separate marker-only JPEG file contains none of these typed fields.

Time comparison card B: independent fictional claimsOwned fixture. An original file made for this course. Follow the activity's instructions in your own lab.

B1: tag and separately sourced event record both explicitly state UTC and 09:20 for the same event.
B2: tag and separately sourced event record both explicitly state UTC, but tag says 09:20 and event record says 09:50 for the same event.
B3: tag says 09:20 with no timezone; other source says 09:50 UTC. No relation between the clocks is known.
Treat agreement as support, not proof that either source is truthful.

06Explain the evidence and its limit

Optional self-check: make an evidence table separating typed claim, file bytes, missing timezone and corroborating source.

Review it: record editability, preserve originals, avoid real-event claims from tags alone and distinguish missing GPS from proof of anonymity.

07Common mistakes

If you look for the card’s tags inside the linked marker file, return to the provenance: the table is separate authored evidence.

If absent GPS is called proof of anonymity, narrow the claim to the particular inspected field.

If a date lacks a timezone, record the uncertainty and seek another source; do not invent an offset.

References

  • ExifTool by Phil Harvey

    Official background on reading and editing metadata; the activity itself uses a separate typed table.