Forensic Image EXIF Reader Free

An EXIF reader extracts hidden metadata embedded inside image files. When a camera or phone takes a photo, it records technical details like camera model, lens, aperture, shutter speed, ISO, GPS coordinates, and timestamps directly into the file. This tool reads all of that data from JPEG, HEIC, TIFF, DNG, and RAW files without uploading anything to a server.

JPEG, HEIC/HEIF, TIFF, DNG, CR2/CR3 (Canon), NEF/NRW (Nikon), ARW (Sony), ORF (Olympus), RW2 (Panasonic), RAF (Fujifilm), SRW (Samsung), PEF (Pentax), and other RAW formats. PNG and WebP have partial support when EXIF data was embedded at capture time. This tool is designed for image files only—it does not read metadata from PDFs, Word documents, or video files.

No. Everything runs entirely in your browser using the exifr library inside a Web Worker. Your images never leave your device. SHA-256 hashes are computed using the browser's built-in Web Crypto API. You can verify this by disconnecting from the internet and using the tool normally—all features continue to work offline.

GPS coordinates embedded in EXIF data place a camera at a specific location at a specific time. Investigators use this to corroborate witness accounts, map subject movements, or verify where a photo was taken. The GPS satellite timestamp can be compared against the camera clock to detect clock manipulation. This tool also calculates the distance and time elapsed between consecutive photos in the report timeline, which can reveal travel patterns.

Yes. Facebook, Twitter/X, Instagram, Reddit, and most platforms strip EXIF data from uploaded images to protect user privacy. If you receive an image that passed through social media, expect the metadata to be gone. However, original images shared via email, messaging apps (Signal, Telegram, WhatsApp when sent as documents), cloud storage (Google Drive, Dropbox), or direct download typically retain their full EXIF data.

The "Edited" badge appears when the Software or CreatorTool field contains the name of a known photo editing application—Adobe Photoshop, Lightroom, GIMP, Snapseed, Affinity Photo, Capture One, Canva, Pixelmator, and others. This means the image was processed after capture. The original camera metadata is usually still present, but the pixel content may have been altered. Check the XMP edit history section for a step-by-step log of every saved edit.

The tool computes a SHA-256 hash of each file's raw bytes. When two or more files share the same hash, they are byte-for-byte identical copies. These files are flagged with an amber "DUPLICATE" badge in the table and appear as a warning anomaly. This helps identify re-saved copies in evidence collections and can reveal when the same image appears under different filenames.

Select exactly two files using the checkboxes and click "Compare." The comparison overlay shows 20 metadata fields—filename, type, size, dimensions, camera, lens, serials, dates, software, exposure settings, focal length, GPS, hash, and anomalies—in a two-column table. Matching values are highlighted green and differences red, so you can quickly identify what changed between two versions of an image or two images from different cameras.

Camera manufacturers embed body and lens serial numbers in proprietary maker note fields within the EXIF data. These serials link a specific image to a specific physical device. In forensic investigations, matching serial numbers across multiple images can prove they came from the same camera. This is valuable for authentication, chain of custody, and linking a suspect's device to a set of images.

Always work from a forensic copy, never the original file. Use the SHA-256 hash displayed in this tool to verify the file was not modified during analysis. Export the full metadata to JSON for a machine-readable record. Generate a PDF or printable HTML report that includes the hash, methodology, and analysis date. Document your tool, version, and the date of extraction. For court submissions, corroborate findings with a validated forensic tool like ExifTool.

CSV — Spreadsheet-compatible table of all extracted fields. JSON — Complete raw EXIF/XMP/IPTC/ICC data for programmatic analysis. KML — GPS locations for Google Earth, Apple Maps, and QGIS. GeoJSON — GPS locations in the standard GIS format used by Leaflet, Mapbox, and other mapping tools. PDF — Printable forensic report with thumbnails, maps, and methodology section. HTML — Standalone report file with interactive Leaflet maps.

When a file has both a DateTimeOriginal (when the photo was taken) and an XMP ModifyDate or MetadataDate (when it was last edited), the tool calculates the time difference between them. This "modification delta" tells you exactly how long after capture the file was modified. A large gap—days, weeks, or months—may indicate the image was edited well after it was taken. A modification date that predates the capture date is flagged as anomalous.

Phil Harvey's ExifTool supports over 300 file formats (including video, audio, PDF, and Office documents), reads deeply embedded vendor-proprietary tags, and handles edge cases that browser-based parsers cannot reach. This tool covers the most commonly needed forensic fields for JPEG, HEIC, TIFF, and major RAW formats in a convenient, zero-install browser interface. For comprehensive analysis, unusual formats, or command-line batch workflows, ExifTool remains the industry standard.

Yes. Use the Timestamp Decoder to compare EXIF timestamps against timestamps from URLs, APIs, social media snowflake IDs, or Unix epoch values. Use the IP Lookup tool to correlate GPS coordinates with network-level geolocation data from the same investigation. Export GPS locations to GeoJSON and overlay them with other geospatial data in QGIS or Leaflet.