±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 1 Overall: 35140
New Yesterday: 10 Visitors: 233

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Webinars

Metadata Interrogator

Forensic software discussion (commercial and open source/freeware). Strictly no advertising.
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
Go to page 1, 2  Next 
  

Metadata Interrogator

Post Posted: Tue Jan 22, 2019 1:27 pm

Hello,
First up, I don't want this to sound like an advert as I know how annoying they are - the software is free and I'm actively looking for feedback from other practitioners rather than trying to promote it. I built it as it was something I had a working need for, and I'd like to share it with you all and get your opinions.

I decided that I needed something that would pull out absolutely any and all metadata possible from files, and display it in a useful way. There are lots of options that sort of do the same thing (Jeffery's Exif tool etc.) but I had a few specific requirements (such as completely offline, portable, any file type, GUI interface etc.) which weren't met by others.

I've also tried to build in some counter fraud specific tools such as match and timeline analysis, highlighting important fields (like author names) and similar.

You can get it here if you're interested - www.metadataanalysis.com

As mentioned, I'd love your feedback and suggestions for new features.  

MI_creator
Newbie
 
 
  

Re: Metadata Interrogator

Post Posted: Tue Jan 22, 2019 2:06 pm

I used your tool on a known file that I have confirmed the metadata. This was an MOV file. What I noticed missing was information regarding the lat/long, the make and model of the camera, and the recorded date (the date you have listed as the creation date is the encoded date).

I did like how quickly your program produced the data. I also like the export options.  

kastajamah
Senior Member
 
 
  

Re: Metadata Interrogator

Post Posted: Tue Jan 22, 2019 2:16 pm

- kastajamah
I used your tool on a known file that I have confirmed the metadata. This was an MOV file. What I noticed missing was information regarding the lat/long, the make and model of the camera, and the recorded date (the date you have listed as the creation date is the encoded date).

I did like how quickly your program produced the data. I also like the export options.


Thanks so much for the feedback - I'll have a look into .MOV files asap

The creation date is a really tricky one - each file type has a few different 'creation date' fields (encoded, created, saved etc.) and it gets messy deciding which one to use as the core one for analysis. The 'creation date' field at the top tries to pick the best one (and is used for the timeline analysis etc.) but it isn't always as expected and I should probably note that up for users somewhere.  

MI_creator
Newbie
 
 
  

Re: Metadata Interrogator

Post Posted: Fri Feb 08, 2019 2:00 pm

Just a quick one, I've released version 0.5 - this version mostly includes lots of bug fixes and minor improvements to the extraction of metadata.

It also includes a very basic version of full data set analysis. This basically looks over all the files in your table and drags out some interesting information such as authors and risk rating. I'll be improving on this function in later releases, but I believe it's already of some use at the moment.

As always, if there are any features or improvements you'd like to see, let me know as I'd be happy to attempt to implement them.  

MI_creator
Newbie
 
 
  

Re: Metadata Interrogator

Post Posted: Sat Feb 09, 2019 5:13 pm

Will this help me with my problem through the below link to help me to verify that it's not been edited? I'm at my wits end Crying or Very sad

www.forensicfocus.com/...c/t=17443/  

Mark_Thompson
Newbie
 
 
  

Re: Metadata Interrogator

Post Posted: Sun Feb 10, 2019 9:46 am

- Mark_Thompson
Will this help me with my problem through the below link to help me to verify that it's not been edited? I'm at my wits end Crying or Very sad

www.forensicfocus.com/...c/t=17443/


I'm afraid it won't really help you in this case - the software helps to show which device the file came from, but it wouldn't really prove evidence of tampering/not tampering. I hope you manage to sort it out though!  

MI_creator
Newbie
 
 
  

Re: Metadata Interrogator

Post Posted: Sun Feb 10, 2019 1:38 pm

Thanks and I've looked at the metadata through the free forensic software, Video Cleaner and it tells me that it originated from the cam but I understand and read somewhere that metadata can be edited. I found it a bit peculiar that it doesn't show that it's been date and time-stamped even though it clearly shows the time and date at the bottom righthand corner in the video. Unless I've got it wrong I think what goes in my favour is the video is over an hour long with each file being 15mins long except the last one and he's on one of the 15-min files doing his act. Each 15-min file being exactly 10800000 samples in length helps?  

Mark_Thompson
Newbie
 
 

Page 1 of 2
Go to page 1, 2  Next