Join Us!

Notifications
Clear all

Image Software  

Page 1 / 2
  RSS
techmerlin
(@techmerlin)
Member

Does anyone have a recommended piece of software used to dissect .jpg images or collect 'Metadata' from .jpg images? I am trying to get some info on a set of JGP images as to their origination

Thanks

Quote
Posted : 09/10/2005 2:31 am
keydet89
(@keydet89)
Community Legend

I've written Perl scripts that retrieve EXIF data from jpgs, if it exists.

What other information, besides EXIF data, are you considering retrieving from the images?

H. Carvey
"Windows Forensics and Incident Recovery"
http//www.windows-ir.com
http//windowsir.blogspot.com

ReplyQuote
Posted : 09/10/2005 4:38 am
keydet89
(@keydet89)
Community Legend

I've written Perl scripts that retrieve EXIF data from jpgs, if it exists.

What other information, besides EXIF data, are you considering retrieving from the images?

H. Carvey
"Windows Forensics and Incident Recovery"
http//www.windows-ir.com
http//windowsir.blogspot.com

ReplyQuote
Posted : 09/10/2005 4:39 am
techmerlin
(@techmerlin)
Member

Harlan,

EXIF data should work here, I am trying to find a link with these images to link them to where they came from EXIF data should be sufficent. thus the reason for the question asking if anyone coudl recomend certain software.

Thanks

ReplyQuote
Posted : 09/10/2005 6:39 am
ASHAY
(@ashay)
New Member

I use many of Michal Mutl's products, and would suggest that you try his Exif Reader.

This is the direct link for the program

http//www.mitec.cz/Downloads/EXIF_Trial.zip

ReplyQuote
Posted : 09/10/2005 3:46 pm
keydet89
(@keydet89)
Community Legend

techmerlin,

If it's only EXIF data you're interested in, then a Google search for that will reveal commercial and freeware tools. Perhaps the most frequent recommendation you'll get is that you should confirm the information from the commercial tool with an open source tool, beginning with a hex editor. Perl (less than a dozen lines of code) will work fine.

H. Carvey
"Windows Forensics and Incident Recovery"
www.windows-ir.com
windowsir.blogspot.com

ReplyQuote
Posted : 09/10/2005 5:50 pm
techmerlin
(@techmerlin)
Member

Harlan,

were any of these pearl scripts on the the CD in your book?

Thanks

ReplyQuote
Posted : 15/10/2005 12:42 am
keydet89
(@keydet89)
Community Legend

No. Most folks tend to use commercial apps, even though Perl allows you to format the output. Most commercial GUI apps do the formating for you…

If you do need something in Perl, let me know. I don't do pearl, though. D

H. Carvey
"Windows Forensics and Incident Recovery"
www.windows-ir.com
windowsir.blogspot.com

ReplyQuote
Posted : 15/10/2005 1:20 am
techmerlin
(@techmerlin)
Member

Thanks Haraln,

I have tried a few of the commercial items but really have not found one that works good AND gives you good reporting.

ReplyQuote
Posted : 15/10/2005 8:39 pm
keydet89
(@keydet89)
Community Legend

I have tried a few of the commercial items but really have not found one that works good AND gives you good reporting.

When one of these commercial items has not worked well for you, what happened? Was the information inaccurate? Did the commercial application not retrieve the information in question? And what kind of reporting were you looking for?

H. Carvey
"Windows Forensics and Incident Recovery"
www.windows-ir.com
windowsir.blogspot.com

ReplyQuote
Posted : 16/10/2005 2:50 am
techmerlin
(@techmerlin)
Member

Harlan,

What I am referring to, I have3 EXIF Readers, which breaks up the information from the image amongst a few different windows and does not give you the option to extract the information it finds to add to a report etc.

I also EXIF Extractor which only outputs data to a txt file so you can not preview what the image contains if anything first, instead you have to search through the txt files.

The next is EXIF Image Viewer which does give you the ability to copy the report but it does not appear to give the same data as say, EXIF Extractor

Thanks

ReplyQuote
Posted : 16/10/2005 9:36 pm
keydet89
(@keydet89)
Community Legend

One way to get all available information is to put together a script that uses the ImageEXIF module

http//search.cpan.org/dist/Image-EXIF/EXIF.pm

Compare it to what you see in the commercial tools (for completeness) and have the output go to STDOUT. Then, you can have it not report the things that you deem as being irrelevant in any case, and redirect the output to a file.

H. Carvey
"Windows Forensics and Incident Recovery"
www.windows-ir.com
windowsir.blogspot.com

ReplyQuote
Posted : 17/10/2005 4:49 pm
Andy
 Andy
(@andy)
Active Member

IrfanView at http//www.irfanview.com/

Free, simple to use, handles exif data.

Andy

ReplyQuote
Posted : 17/10/2005 10:57 pm
techmerlin
(@techmerlin)
Member

Thanks Andy -)

ReplyQuote
Posted : 19/10/2005 9:42 pm
JimmyW
(@jimmyw)
Member

You may wish to check out DataLifter .NetBonusTools, at http//www.datalifter.com/products.htm. It will produce a report providing the data in the relevant EXIF fields, and can mass-process all files in a given directory. It's not free, although the application includes a number of excellent tools. I'll add that IrfanView yields EXIF data, but is not free when used in commercial settings, which include law enforcement and other government organizations. Still, for the modest price ($10, I recall) it's a bargain.

JimmyW

ReplyQuote
Posted : 27/10/2005 8:53 am
Page 1 / 2
Share: