Obtaining Geographical Location Data

Obtaining Geographical Location Data from Metadata

by GhostExodus

4/25/24 (Updated 5/5/25)

Metadata, especially Exchangeable Image File Format (EXIF) data from images and videos, acts like digital DNA. It can include timestamps, GPS coordinates, device make/model, software used, and even camera orientation.

While this can be valuable in OSINT investigations, it’s a liability for anyone producing propaganda, operational media, or influence content that needs to maintain anonymity or plausible deniability.

After all, we run across a lot of bad actors on the internet. Extracting geolocation data can be the last-ditch effort in de-anonymizing an online predator and any other investigative subject.

This tutorial will teach you how to find, extract, and analyze it.

Everything is leaking information

It’s no surprise that iOS and Android devices often embed GPS data in media files by default. Even if location services are "off," some apps can still cache coordinates in background processes.

Timestamps: Reveal the time of creation, which can be cross-referenced with other open sources (social posts, network activity, surveillance, etc.).

Device IDs: Repeated use of the same device can link multiple operations or accounts to a single actor.

Apps like Google Photos and social media platforms like Facebook, Messenger, and Instagram contain leak vectors. For example, if “Location History” or “Save location with photos” is enabled, GPS metadata can be leaked.

To mitigate this leak vector as a user, simply:

Disable “Store location” in camera settings.
Turn off location history in both Android settings and Google account.

Facebook platforms can log GPS, Wi-Fi networks, and also disclose location through posts, photos, and time of interaction.

Weather apps, including Fitness and Health apps, often sell location data to third-party advertisers, even when GPS is off. Furthermore, it’s not uncommon to find an investigative subject who drops pins in Google Maps, or even posts reviews, which ties the subject to a time and place.

Below is an example of a photo sent via SMS from a user with the metadata enabled. It shows how enabled geolocation can offer precise information about a photo, i.e., the location where it was taken,

timestamp, make and model of phone, camera type, etc.

Using ChatGPT to extract EXIF metadata

It’s easy to use ChatGPT to extract EXIF metadata from media. Even if there is no geolocation data available, the information you extract can still be used to connect images to a single device.

Depending on the number of tasks you give ChatGPT to process, it can offer hidden insights into where a photo was taken, even if there are no GPS coordinates embedded in the file.

There are also free online services like Metadata2go that will extract the data for you, some of which also allow you to download the extracted data into an easy-to-read format.

Using EXIFTOOL to extract data

One tried and true way for extracting this EXIF data is by downloading exiftool from https://exiftool.org/install.html.

For Windows users, download either the 32-bit or 64-bit version. Unzip the folder. However, launching it from the executable itself will only open read-only command prompt, allowing you to doom scroll through a lengthy tutorial.

Open Command Prompt, then navigate to the folder where you unzipped ExifTool. Type the name of the executable (e.g., exiftool-13.29_64.exe), then drag and drop the image file into the prompt to auto-fill its path. Press Enter to extract the EXIF data.

For Kali Linux users, open a terminal and run:
sudo apt install exiftool
Once installed, use it by typing exiftool <path-to-image> to extract metadata. You can also drag and drop the image into the terminal and hit Enter.

Happy OSINTing!