Autopsy User Documentation  4.1
Graphical digital forensics platform for The Sleuth Kit and other tools.
EXIF Parser Module

What Does It Do

The EXIF Parser module extracts EXIF (Exchangeable Image File Format) information from ingested pictures. This information can contain geolocation data for the picture, time, date, camera model and settings (exposure values, resolution, etc) and other information. The discovered attributes are added to the BlackBoard.

This can tell you where and when a picture was taken, and give clues to the camera that took it.

Configuration

There is no configuration required.

Using the Module

Select the checkbox in the Ingest Modules settings screen to enable the EXIF Parser.

Ingest Settings

There are no runtime ingest settings required.

Seeing Results

Results are shown in the Results tree.

EXIF-tree.PNG

Copyright © 2012-2016 Basis Technology. Generated on Tue Oct 25 2016
This work is licensed under a Creative Commons Attribution-Share Alike 3.0 United States License.