> For the complete documentation index, see [llms.txt](https://cajac.gitbook.io/ctf-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cajac.gitbook.io/ctf-notes/misc/image-processing/exiftool.md).
# Exiftool
ExifTool is a [free and open source software](https://en.wikipedia.org/wiki/Free_and_open_source_software) program for reading, writing, and manipulating image, audio, video, and [PDF](https://en.wikipedia.org/wiki/PDF) [metadata](https://en.wikipedia.org/wiki/Metadata). As such, ExifTool classes as a [tag editor](https://en.wikipedia.org/wiki/Tag_editor). It is [platform independent](https://en.wikipedia.org/wiki/Cross-platform#Platform-independent_software), available as both a [Perl](https://en.wikipedia.org/wiki/Perl) library (Image::ExifTool) and a [command-line](https://en.wikipedia.org/wiki/Command-line_interface) application.
## Change output format
### Standard format
```bash
┌──(kali㉿kali)-[/mnt/…/picoCTF/picoCTF_2025/Forensics/RED]
└─$ exiftool red.png
ExifTool Version Number : 13.10
File Name : red.png
Directory : .
File Size : 796 bytes
File Modification Date/Time : 2025:04:12 17:39:36+02:00
File Access Date/Time : 2025:04:13 14:53:13+02:00
File Inode Change Date/Time : 2025:04:12 17:39:36+02:00
File Permissions : -rwxrwxrwx
File Type : PNG
File Type Extension : png
MIME Type : image/png
Image Width : 128
Image Height : 128
Bit Depth : 8
Color Type : RGB with Alpha
Compression : Deflate/Inflate
Filter : Adaptive
Interlace : Noninterlaced
Poem : Crimson heart, vibrant and bold,.Hearts flutter at your sight..Evenings glow softly red,.Cherries burst with sweet life..Kisses linger with your warmth..Love deep as merlot..Scarlet leaves falling softly,.Bold in every stroke.
Image Size : 128x128
Megapixels : 0.016
```
### Short format
Short output format (`-s`). Note that tag **names** are used instead of their **description**.
```bash
┌──(kali㉿kali)-[/mnt/…/picoCTF/picoCTF_2025/Forensics/RED]
└─$ exiftool -s red.png
ExifToolVersion : 13.10
FileName : red.png
Directory : .
FileSize : 796 bytes
FileModifyDate : 2025:04:12 17:39:36+02:00
FileAccessDate : 2025:04:13 14:53:13+02:00
FileInodeChangeDate : 2025:04:12 17:39:36+02:00
FilePermissions : -rwxrwxrwx
FileType : PNG
FileTypeExtension : png
MIMEType : image/png
ImageWidth : 128
ImageHeight : 128
BitDepth : 8
ColorType : RGB with Alpha
Compression : Deflate/Inflate
Filter : Adaptive
Interlace : Noninterlaced
Poem : Crimson heart, vibrant and bold,.Hearts flutter at your sight..Evenings glow softly red,.Cherries burst with sweet life..Kisses linger with your warmth..Love deep as merlot..Scarlet leaves falling softly,.Bold in every stroke.
ImageSize : 128x128
Megapixels : 0.016
```
### Very short format
Very short output format (`-S`). No indentation used for the values.
```bash
┌──(kali㉿kali)-[/mnt/…/picoCTF/picoCTF_2025/Forensics/RED]
└─$ exiftool -S red.png
ExifToolVersion: 13.10
FileName: red.png
Directory: .
FileSize: 796 bytes
FileModifyDate: 2025:04:12 17:39:36+02:00
FileAccessDate: 2025:04:13 14:53:13+02:00
FileInodeChangeDate: 2025:04:12 17:39:36+02:00
FilePermissions: -rwxrwxrwx
FileType: PNG
FileTypeExtension: png
MIMEType: image/png
ImageWidth: 128
ImageHeight: 128
BitDepth: 8
ColorType: RGB with Alpha
Compression: Deflate/Inflate
Filter: Adaptive
Interlace: Noninterlaced
Poem: Crimson heart, vibrant and bold,.Hearts flutter at your sight..Evenings glow softly red,.Cherries burst with sweet life..Kisses linger with your warmth..Love deep as merlot..Scarlet leaves falling softly,.Bold in every stroke.
ImageSize: 128x128
Megapixels: 0.016
```
## Extract only a specific field
To extract only a specific field (name and value)
```bash
┌──(kali㉿kali)-[/mnt/…/picoCTF/picoCTF_2025/Forensics/RED]
└─$ exiftool -Poem red.png
Poem : Crimson heart, vibrant and bold,.Hearts flutter at your sight..Evenings glow softly red,.Cherries burst with sweet life..Kisses linger with your warmth..Love deep as merlot..Scarlet leaves falling softly,.Bold in every stroke.
```
To extract only the value add `-T` parameter
```bash
┌──(kali㉿kali)-[/mnt/…/picoCTF/picoCTF_2025/Forensics/RED]
└─$ exiftool -T -Poem red.png
Crimson heart, vibrant and bold,.Hearts flutter at your sight..Evenings glow softly red,.Cherries burst with sweet life..Kisses linger with your warmth..Love deep as merlot..Scarlet leaves falling softly,.Bold in every stroke.
```
## Extract preview image
To extract an embedded preview image you use
```bash
exiftool -b -PreviewImage image.jpg > preview.jpg
```
## Extract thumbnails
To extract an embedded thumbnail data/image
```bash
exiftool -b -ThumbnailImage image.jpg > thumbnail.jpg
```
## List tags
To list all valid tag names (loong list). Use `-listw` to list writable tag names.
```bash
┌──(kali㉿kali)-[/mnt/…/picoCTF/picoCTF_2025/Forensics/RED]
└─$ exiftool -list
Available tags:
A100DataOffset AAFManufacturerID ABDate ABLabel ABRelatedNames ABSActive
AB_UID ACDSeeRegion ACDSeeRegionALGArea ACDSeeRegionALGAreaH
ACDSeeRegionALGAreaW ACDSeeRegionALGAreaX ACDSeeRegionALGAreaY
ACDSeeRegionAppliedToDimensions ACDSeeRegionAppliedToDimensionsH
ACDSeeRegionAppliedToDimensionsUnit ACDSeeRegionAppliedToDimensionsW
ACDSeeRegionDLYArea ACDSeeRegionDLYAreaH ACDSeeRegionDLYAreaW
ACDSeeRegionDLYAreaX ACDSeeRegionDLYAreaY ACDSeeRegionName
<---snip--->
```
## Set tag values
exiftool can also set tag value. To set all date tags you can
```bash
┌──(kali㉿kali)-[/mnt/…/picoCTF/picoCTF_2024/Forensics/Blast_from_the_past]
└─$ exiftool -AllDates="1970:01:01 00:00:00.001+00:00" original_nulled.jpg
```
## Resources
ExifTool - Homepage:
exiftool - Linux manual page:
ExifTool - Wikipedia: