secrets-in-file-metadatalisted

# Secrets in file metadata The fastest lead in an investigation is often already inside the file: GPS to six decimal places, a camera serial that ties four "unrelated" images to one body, a document author who is a real employee, a template path containing a corporate share name. Two things beginners get wrong. Absent metadata is not suspicious — it is the normal state of anything that passed through a social platform. And present metadata is not proof: every tag is a **claim written by whatever software touched the file last**, and all of it is editable with one command. ## Where to look first, given what you have | You have | Reach for | Because | |---|---|---| | A photo downloaded from a social platform | Expect nothing | Delivery pipelines re-encode. Use `find-the-original-image` to reach an un-stripped upstream copy. | | A photo from a forum, CMS, or direct file link | Full exiftool dump | These serve your bytes back. GPS survives here more often than people expect. | | A messaging attachment | Full dump, and note how it was sent | Sent-as-photo is usually re-encoded; sent-as-file usually is not. | | A folder from one source | `exiftool -r -csv` triage | You want the outlier, and the tags shared across files. | | A DOCX/XLSX/PPTX | exiftool, then unzip the container | Tracked changes, comment authors, revision identifiers and embedded images with intact EXIF are not surfaced by exiftool. | | A PDF | exiftool, then a structural parser | Producer strings, incremental r