ExifTool on Kali Linux: Installation and Metadata Analysis

Install ExifTool on Kali Linux and use it for structured metadata analysis, from grouped tag output to CSV reports across whole directories.

Linux7 min read
ExifTool on Kali Linux: Installation and Metadata Analysis illustration

Kali Linux is a Debian-based distribution popular with security professionals and digital forensics students. ExifTool fits naturally into this environment because it reveals hidden information in files quickly and produces output that is easy to filter and save. This guide covers installation and the commands most useful for metadata analysis.

Installing ExifTool on Kali

ExifTool is available from the Kali repositories as the Debian package libimage-exiftool-perl, and it may already be present depending on the image you installed. Check first, then install if needed:

$ exiftool -ver
$ sudo apt update
$ sudo apt install libimage-exiftool-perl

For the very latest release, you can also run the Perl distribution from the ZIP on our download section. Extract it and run ./exiftool from the folder.

Seeing every tag and its group

For analysis, you want to see everything, including duplicate tags and where each one comes from:

$ exiftool -a -u -G1 -s evidence.jpg
  • -a shows duplicate tags instead of only the preferred one.
  • -u includes unknown tags that ExifTool can extract but not name.
  • -G1 shows the specific group, such as IFD0, ExifIFD, XMP-xmp or GPS.
  • -s prints compact tag names that you can reuse in later commands.

Differences between groups can be meaningful. A date or software tag that differs between EXIF and XMP may indicate that a file was processed by editing software.

Analysing timestamps

Files carry several kinds of time information. Compare them side by side:

$ exiftool -a -G1 -time:all evidence.jpg

This lists embedded capture dates alongside file system dates such as modification time. Remember that file system dates change when files are copied, so embedded metadata and file system timestamps should be interpreted together, not in isolation.

Scanning directories and building reports

ExifTool processes whole directory trees and writes structured reports:

$ exiftool -r -csv -FileName -Model -DateTimeOriginal -GPSPosition ./case > report.csv
$ exiftool -r -json ./case > report.json

Use conditions to find files of interest, for example images that contain GPS coordinates:

$ exiftool -r -if "$GPSLatitude" -p "$Directory/$FileName  $GPSPosition" ./case

The -p option prints a custom line per file using any tag names, which makes concise summaries easy to read or pipe into tools such as grep and sort.

Extracting embedded data

Images often include embedded thumbnails or previews, which may differ from the main image if the photo was edited carelessly. Extract them as binary data:

$ exiftool -b -ThumbnailImage evidence.jpg > thumb.jpg
$ exiftool -b -PreviewImage raw_file.cr2 > preview.jpg

Some video formats store timed metadata, such as GPS tracks, deeper inside the file. The -ee option tells ExifTool to extract embedded information from those streams:

$ exiftool -ee -G3 video.mp4

Our guide to ExifTool video metadata explains video analysis in more detail.

Responsible use

Read commands do not modify files, but writing commands do. When analysing evidence, work on verified copies, never run write options such as -all= on originals, and record the ExifTool version you used with exiftool -ver. Only examine files you are authorised to analyse.

Metadata can be edited by anyone with the right tools, including ExifTool. Treat it as one source of evidence to corroborate, not as absolute proof.

New to the command structure? Start with the beginner's guide.