Biterra Labs preview / Forensics Basics
Images and documents can store information you do not see when you open them. A JPEG might record the camera or export software; a PDF or Word file might record its author or creation date. Those stored details are metadata.
A viewer reads the pixels or the page. These tools read the tags.
EXIF stands for Exchangeable Image File Format. Cameras and image software use it to store named metadata fields inside files such as JPEGs. Typical tags include:
| Tag | What it records |
|---|---|
| Artist | who the software stored as author |
| Image Description | a free-text description stored in the metadata |
| Document Name | often the filename before a rename |
| Software | the program that wrote the file |
| Date/Time Original | when the camera or export tool says the image was made |
| Modify Date | when EXIF says the file was last changed |
| GPSLatitude / GPSLongitude | where the camera thought it was, if it wrote GPS |
file will often mention Exif when it detects EXIF metadata in the image:
$ file recital_flyer.jpg
recital_flyer.jpg: JPEG image data, Exif standardfile confirms that EXIF metadata is present, but it does not show the stored fields. Use ExifTool to read those fields and label their values:
$ exiftool recital_flyer.jpg
Artist : box-office-intern
Document Name : setlist-draft.jpg
Software : LobbyPrinter 4.0
Image Description : reprint after the interval
Date/Time Original : 2011:03:14 19:05:00
Modify Date : 2011:03:14 19:11:00The useful clue is the mismatch between the current filename, recital_flyer.jpg, and the stored Document Name, setlist-draft.jpg. It suggests the file was renamed after that metadata was written.
stringsIf ExifTool is not installed, strings can still reveal printable text inside the JPEG:
$ strings recital_flyer.jpg
JFIF
box-office-intern
setlist-draft.jpg
LobbyPrinter 4.0
reprint after the interval
2011:03:14 19:05:00JFIF is a normal JPEG marker. The other lines may come from metadata, but strings cannot label their fields and may miss values that are not stored as printable text. Treat them as leads.
Finder's Get Info and the stat command show timestamps recorded by your filesystem. For a downloaded image, they usually describe when this copy arrived or changed on your computer, not when the photograph was taken. Download it again and the new copy may have different filesystem timestamps.
$ stat -f '%Sm %N' recital_flyer.jpg
17 Aug 2026 14:02 recital_flyer.jpg
$ stat -c '%y %n' recital_flyer.jpg
2026-08-17 14:02:00.000000000 +0100 recital_flyer.jpg
Both commands show when this copy landed on the current filesystem. The flags differ, but the question is the same.
EXIF records are stored inside the image and can report a different date:
$ exiftool -DateTimeOriginal -ModifyDate recital_flyer.jpg
Date/Time Original : 2011:03:14 19:05:00
Modify Date : 2011:03:14 19:11:00stat reports 17 August 2026, when this copy was written to the current filesystem. EXIF reports 14 March 2011, the creation and modification dates stored inside the image. Metadata can be edited, so treat both as claims from different sources rather than proof on their own.
PDFs keep an Info dictionary. pdfinfo prints it:
$ pdfinfo programme.pdf
Title: Autumn Recital
Author: box-office-intern
Creator: Microsoft Word
Producer: macOS Version 10.7 Quartz PDFContext
CreationDate: Mon Mar 14 19:05:00 2011
ModDate: Mon Mar 14 19:11:00 2011In this example, Author names the account associated with the document, Creator shows that it came from Microsoft Word, and Producer shows that macOS Quartz converted it into a PDF. The authoring program and the PDF conversion software are separate parts of the file's history.
A .docx file is a ZIP package containing XML files. ExifTool can read its core properties without opening Word:
$ exiftool handover.docx
Title : Final Handover
Creator : night-supervisor
Last Modified By : day-manager
Create Date : 2026:08:16 21:40:00
Modify Date : 2026:08:17 07:12:00To see the package itself, list it with unzip:
$ unzip -l handover.docx
912 [Content_Types].xml
734 docProps/core.xml
8421 word/document.xml
1260 word/comments.xmldocProps/core.xml holds properties such as the title, creator, and modification dates. word/document.xml contains the document body. If word/comments.xml exists, the file also contains comments that may not be obvious in the normal document view.
You can read one part without extracting the whole package:
$ unzip -p handover.docx docProps/core.xmlOne file can show different dates depending on where you look. The filesystem, the image metadata, and an archive each record a different event.
$ stat -f '%Sm' old-badge.jpg
17 Aug 2026 14:02
$ exiftool -DateTimeOriginal old-badge.jpg
Date/Time Original : 2011:03:14 19:05:00
$ unzip -l backup.zip
Length Date Time Name
412 01-01-1970 00:00 old-badge.jpg
| Source | What it is |
|---|---|
stat / Get Info | when this copy was written to this disk |
EXIF Date/Time Original | when the camera or exporter says the image was made |
| zip / tar listing | the date stored about that file in the archive |
01-01-1970 00:00 is Unix time zero: 1 January 1970, 00:00 UTC, the instant those clocks count from. When the archive stored 0 or left the field empty, tools print that. It is an unset date, not a file from 1970.
If you care when the picture was taken, read EXIF. If you care when it was added to the zip, read the listing. If you care when you downloaded it, stat is enough — and usually the least interesting of the three.
pdfinfostat on show.jpg says today. exiftool shows Date/Time Original 2011:03:14 19:05:00 and Artist stage-intern. Which of those is when this copy arrived on your machine, and which is the date stored inside the JPEG?
stat is the copy on this disk. Date/Time Original is the EXIF date. Artist is not a date.
Next challenge: Museum Label
Run file, then dump the JPEG tags.