OSINT › Module 9 › Lesson 4
Lab — Read Then Strip EXIF on a Practice File
Create or copy a practice file, read tags, strip the copy only, chmod 600.
Visual · exif_lab_practice
Lab = exiftool read + strip on YOUR practice copy. GATE 192.168.0.1.
Opening
Evidence is before-and-after on a file you can afford to mutilate.
Create or copy a practice file. Run file, strings, ExifTool read. Copy again if needed. `exiftool -all= -overwrite_original` on the copy only. Optional mediainfo/identify. Optional TinEye on YOUR image. chmod 600. No stranger photos. No PDF harvest. No 0.0.0.0. Original Cyberlium. Next: Quiz — Files and EXIF.
1. GATE, then build a file you are allowed to break
. Official still: https://exiftool.org/, https://tineye.com/, Google Lens named, FOCA as concept never harvest, mediainfo, optional identify.
If you have a photo you took, copy it into cyberlium-lab as t12-m09-practice-copy.jpg. Otherwise keep using practice.bin. Either satisfies the lab.
Command guide
GATE, then build a file you are allowed to break
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install libimage-exiftool-perl
Built-in (binutils)
Command — copy this
sudo apt install mediainfo
macOS:
Command — copy this
brew install exiftool brew install mediainfo
Windows:
Command — copy this
choco install exiftool
Use WSL or install binutils Use WSL or install file for Windows
Command — copy this
choco install mediainfo-cli
═══ COMMANDS ═══
Command — copy this
test -f "$HOME/cyberlium-lab/t12-m09-practice-copy.bin" || printf 'CYBERLIUM-PRACTICE-COPY ' > "$HOME/cyberlium-lab/t12-m09-practice-copy.bin" file "$HOME/cyberlium-lab/t12-m09-practice-copy.bin" | tee "$HOME/cyberlium-lab/t12-m09-l04-file.txt" strings "$HOME/cyberlium-lab/t12-m09-practice-copy.bin" | tee "$HOME/cyberlium-lab/t12-m09-l04-strings.txt"
2. Read, then strip the copy, save before/after notes
exiftool the copy > before.txt. Then exiftool -all= -overwrite_original on that same copy path. Then exiftool again > after.txt. If ExifTool is missing, write missing and keep file/strings evidence. Do not download pirate tools. Do not run strip on a directory of harvested PDFs.
Optional: mediainfo on a video YOU own. Optional: identify on YOUR JPEG copy. Optional: TinEye UI for YOUR JPEG.
Command guide
Read, then strip the copy, save before/after notes
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install libimage-exiftool-perl sudo apt install mediainfo
macOS:
Command — copy this
brew install exiftool brew install mediainfo
Windows:
Command — copy this
choco install exiftool choco install mediainfo-cli
3. Optional loopback ping, then lock notes for Module 10
curl -I if a toy is up. Metadata labs do not need a public bind. chmod 600 everything. These files will be packed in the Topic 12 mission lab.
Stop. Do not FOCA the internet for extra credit.
4. What you ship: before/after ExifTool on a practice copy, or honest missing
file/strings plus before/after (or exiftool missing). Strip only on practice copy. chmod 600. No harvested PDFs. DEMO GATE.
5. What you record before the next lesson
Lab paths. NEVER someone else's photos. Next: Quiz — Files and EXIF. File t12-m09-l04-exif-lab.txt packed later in M10.
6. Wrong vs right: strangers vs identifiers YOU own
Worked failure — same OSINT word, opposite target. Right never needs a classmate or a dump site.
Wrong
exiftool -all= on the only original. FOCA a website. Lens a classmate. python http.server --bind 0.0.0.0.
Right
Read YOUR copy. Strip YOUR copy. Stop. Next: Quiz — Files and EXIF.
Mission: read then strip a practice file YOU own
1) / STOP if router. 2) file/strings/exiftool on a practice copy. 3) exiftool -all= -overwrite_original on that copy only. Never harvest PDFs. Never strip strangers. Never nmap /24.
Stuck? Ask Cyberlium AI Mentor
If -overwrite_original scares you, ask Mentor how to write to a new filename instead — not how to batch-strip a scraped album.
Knowledge Check
APPLY: After strip, you still need the original photo. You:
Multiple choice
Knowledge Check
APPLY: True or False: This lab requires harvesting PDFs from the internet so ExifTool has “real documents.”
True or False
Knowledge Check
APPLY: mediainfo/identify if missing:
Multiple choice