offensive-tools/forensic/exiftool/SKILL.md
Auth/lab ref: metadata extraction, copy, conversion, and editing utility for images, video, documents, archives, executables, and many other file types.
npx skillsauth add aeondave/malskill exiftoolInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
High-coverage metadata inspection and editing across a huge range of file types.
Use ExifTool when you need to:
# Read everything ExifTool considers available
exiftool file.jpg
# Short tag names with group names
exiftool -s -G1 file.jpg
# JSON output for automation
exiftool -j file.jpg
exiftool -a -u -g1 file.jpg
Use this when you want duplicate and unknown tags grouped clearly.
exiftool -s -ImageSize -ExposureTime -CreateDate file.jpg
exiftool -j file.jpg
exiftool -csv dir/
exiftool -r -ext jpg pictures/
# Extract thumbnail
exiftool -b -ThumbnailImage image.jpg > thumbnail.jpg
# Extract embedded metadata from nested content
exiftool -ee file.pdf
-ee is especially useful for embedded documents, previews, or timed metadata in container formats.
exiftool -tagsFromFile src.jpg dst.jpg
exiftool -TagsFromFile src.jpg -all:all dst.jpg
exiftool -all= -tagsFromFile src.jpg -exif:all dst.jpg
# Write or replace one tag
exiftool -comment='new comment' file.jpg
# Delete all metadata
exiftool -all= file.jpg
# Recursive delete of one group
exiftool -r -XMP-crss:all= DIR
exiftool -geotag track.log image.jpg
exiftool -geotag track.log -geosync=-20 DIR
Use this for forensic or OSINT workflows that align image timestamps with GPS logs.
*_original backups.-overwrite_original only when you intentionally do not want those backups.-n disables print conversion and is useful when you need raw numeric values.-b is the right choice when extracting binary values like thumbnails or full XMP blobs.-G and -g matter because the same logical tag may exist in multiple metadata groups._original files too.-all= on RAW formats can destroy metadata needed by vendor workflows; use carefully.No bundled scripts/, references/, or assets/.
Use the official ExifTool documentation for the full tag database, batch formatting tricks, and advanced copy/write syntax.
development
Auth/lab ref: Unicorn Engine CPU-only emulation for shellcode, decryptors, custom VM handlers, instruction tracing, memory hooks, and register-level experiments.
development
Auth/lab ref: Renode board and SoC simulation for MCU/RTOS firmware, UART/GPIO/peripheral modeling, GDB remote debugging, REPL platforms, and RESC scripts.
development
Auth/lab ref: Qiling OS-layer binary emulation for PE/ELF/Mach-O/UEFI/shellcode with rootfs, syscall/API hooks, filesystem mapping, and runtime patching.
databases
Auth/lab ref: QEMU user-mode and full-system emulation for cross-arch binaries, firmware, kernels, disks, serial consoles, networking, and GDB stubs.