Monday, 14 November 2011

How to strip personal data from photos

Who took this picture, and where?
Metadata might provide the answer.
Uploading digital photos and video files can put more personal information online that you might expect.

Modern digital cameras, particularly those used with smart phones and other mobile devices, often embed metadata into the media files. This can be useful. For example, you can tell what exposure settings were used, which helps troubleshoot poorly-shot images.

This metadata, known as Exif, can also include the time and place that a photo was taken. Again, this is potentially useful information for keen amateur and professional photographers alike. You could automatically compile images according to location and within a certain time frame.

So far so handy, but what happens if you are a protester providing coverage of events against the will of the prevailing authorities? Potentially the footage that you upload to the internet contains information that could identify you and your location.

Here's a short list of some of the information that can be embedded in digital photos:
  • Device manufacturer (e.g. Nikon)
  • Device model (e.g. D700)
  • Date and time (e.g. 2011:11:14 11:48:33)
  • Exif Version (e.g. Exif Version 2.1)
  • FlashPixVersion (e.g. FlashPix Version 1.0)
  • GPS values (e.g. Latitude, longitude and altitude)
Given a set of photos, an investigator could determine if they had all been taken by the same device, the time and date that they had been taken and the exact location. In the example above we have a Nikon D700 running Exif 2.1 and FlashPix 1.0. It would not take long to check these software version details on a suspect's camera.

Conversely, activists and journalists could use metadata to discredit images published by official media outlets. If a repressive regime posted fake images of protesters performing vile acts at a certain location, the metadata might tell the true tale, in which the scene was staged somewhere completely different.

You can view the metadata of digital photos easily in Windows. Right-click the file, choose Properties and then click the Details tab to reveal all.

If you want to automate the removal of all metadata, one simple and fast option is to download and install ExifTool. This includes a command-line application called exiftool. To remove all metadata simply type the following:

exiftool -exif:all= image.jpg

[Note: image.jpg is an example file name. The 'all' tag specifies all metadata.]

If you want to be really sneaky you can copy Exif data from one file and paste it into another. To perform this task automatically try the following:

exiftool -all= -tagsfromfile src.jpg -exif:all dst.jpg

[Note: src.jpg is an image that contains the metadata you want to publish, and dst.jpg is the image that you want to publish (using src.jpg's metadata).]