OSINT › Module 9 › Lesson 2
ExifTool file strings and mediainfo
Read local practice bytes with ExifTool, file, strings, mediainfo — never someone else's roll.
Visual · exif_exiftool
https://exiftool.org/ plus file, strings, mediainfo, optional ImageMagick identify. GATE.
Opening
Three readers, one ethics line: only bytes that already belong to you.
ExifTool prints and can later strip tags. `file` guesses format. `strings` shows printable leftovers. mediainfo summarizes audio/video. ImageMagick `identify` is optional. All of them in this academy point at a practice file YOU create or a photo YOU own. They are not a kit to mine a scraped album. Original Cyberlium. STOP if router. Next: Reverse Image and GPS Strip on YOUR Photo.
1. Install from the official ExifTool page, then make a practice file
https://exiftool.org/ is the official home. Package names differ by OS. If the binary is missing, bookmark and still run `file` and `strings` on a practice file you create in cyberlium-lab. Do not download a “FOCA full” pirate bundle.
Create a tiny practice blob now so later strip commands have a copy that is not your only wedding photo.
Command guide
Install from the official ExifTool page, then make a practice file
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install libimage-exiftool-perl
Built-in (binutils)
macOS:
Command — copy this
brew install exiftool
Windows:
Command — copy this
choco install exiftool
Use WSL or install file for Windows Use WSL or install binutils
═══ LINUX / macOS ═══
View file type
Command — copy this
file photo.jpg file document.pdf
Extract EXIF metadata from images
Command — copy this
exiftool photo.jpg exiftool -GPS* photo.jpg exiftool -a -u photo.jpg | head -40
Strip all metadata before sharing
Command — copy this
exiftool -all= photo.jpg
Search for readable strings in binary files
Command — copy this
strings document.pdf | head -30
═══ WINDOWS ═══
Command — copy this
exiftool photo.jpg exiftool -GPS* photo.jpg exiftool -all= photo.jpg
Optional command
PowerShell — basic file info
Command — copy this
Get-Item photo.jpg | Select-Object *
2. strings, mediainfo, optional identify, then ExifTool if present
`strings` on the practice blob should show CYBERLIUM-PRACTICE. mediainfo on a video YOU own is optional. ImageMagick `identify` is optional on YOUR image. ExifTool on YOUR photo or the practice file prints tags if the format carries them. A text blob may show little — that is OK.
If you copy a photo you took into cyberlium-lab, copy it first. Never overwrite the only original in this lesson — strip is the next lesson and only on a practice copy.
3. Do not point these readers at a harvested folder
A zip of “sample EXIF from the internet” is how people accidentally stalk. Delete that idea. Your folder is cyberlium-lab. chmod 600.
. Do not hydra a photo server.
4. What you ship: practice file plus reader outputs or honest skips
t12-m09-practice.bin created. file/strings run. ExifTool/mediainfo/identify present-or-skip. Official https://exiftool.org/. chmod 600. No stranger albums. SAFE
5. What you record before the next lesson
Date. Readers on YOUR bytes. DEMO GATE. File t12-m09-l02-exiftool.txt.
6. Wrong vs right: strangers vs identifiers YOU own
Worked failure — same OSINT word, opposite target. Right never needs a classmate or a dump site.
Wrong
exiftool a scraped Instagram export of someone else. FOCA a random PDF corpus. nmap for a NAS of photos.
Right
Practice file YOU created, optional YOUR photo copy. Next: Reverse Image and GPS Strip on YOUR Photo.
Mission: read leftover bytes in a file YOU made
1) / STOP if router. 2) Create t12-m09-practice.bin and run file and strings. 3) Run exiftool if installed (https://exiftool.org/). Never harvest PDFs. Never scan someone else's photos.
Stuck? Ask Cyberlium AI Mentor
If exiftool is not in PATH, ask Mentor for the official Windows/macOS/Linux package name — not for a FOCA harvest kit.
Knowledge Check
APPLY: The first file you should aim ExifTool at is:
Multiple choice
Knowledge Check
APPLY: True or False: `strings` on YOUR practice.bin is in-scope.
True or False
Knowledge Check
APPLY: ImageMagick identify is:
Multiple choice