ExifTool
ExifTool ExifTool is the ultimate metadata extractor for 30+ file formats, pulling EXIF, XMP, and IPTC tags from images, PDFs, and videos for OSINT recon on embedded intel like geolocs or timestamps. Run its Perl CLI on batches for JSON dumps, scripting custom tags for targeted pulls in discovery workflows. Open-source from Phil Harvey, it's the tag tracker for pentesters mining files for hidden clues.
Explore →Metagoofil
Metagoofil Metagoofil scrapes search engines for docs like PDFs or DOCs, extracting metadata such as authors or paths for user enumeration in domain recon. Run its Python script with -d for domains and -t for types, limiting results to avoid bans while compiling intel. Open-source from epsylon3, it's the doc diver for OSINT pros harvesting contacts from public files.
Explore →FOCA
FOCA FOCA fingerprints metadata from Office docs and PDFs scraped via search engines, mapping users, software, and domains for passive recon on org footprints. Launch its .NET GUI, query engines for files, and visualize relationships in graphs for intel. Open-source from ElevenPaths, it's the fingerprint forger for analysts piecing together networks from docs.
Explore →exifprobe
exifprobe exifprobe maps unknown EXIF tags in JPEGs/TIFFs with hex views, decoding proprietary fields for deep recon on camera models or embedded secrets. Compile its C code, probe files for full tag trees, and script for batch forensics. Open-source from ThomasHabets, it's the tag trailblazer for researchers exploring undocumented metadata.
Explore →Hachoir
Hachoir Hachoir parses 100+ file formats for metadata like timestamps or authors, generating readable trees for OSINT pulls from videos or archives in recon phases. Use its Python CLI or lib to walk hierarchies, extracting fields for custom queries. Open-source from haypo, it's the format forager for examiners harvesting clues from diverse files.
Explore →pdf-parser
pdf-parser pdf-parser dissects PDF internals for metadata objects, streams, and JS, flagging embedded malware or hidden text in document recon. Run its Python script with --search for keywords, dumping hex for manual review. Open-source from Didier Stevens, it's the PDF peeler for auditors uncovering secrets in portable docs.
Explore →exifread
exifread exifread is the pure Python EXIF extractor for JPEG/TIFF, pulling tags like GPS or maker notes without deps for scripted recon on photo intel. Import the lib to read from bytes, dumping dicts for analysis chains. Open-source from ianare, it's the scriptable sniffer for devs probing images in OSINT scripts.
Explore →mat2
mat2 mat2 extracts and anonymizes metadata from PDFs, images, and Office files, logging removed tags for audit trails in privacy-focused recon. Run its CLI with --show for previews before stripping, scripting for batch sanitization. Open-source from 0x90, it's the privacy pruner for users inspecting sensitive artifacts before sharing.
Explore →python-magic
python-magic python-magic wraps libmagic for file type ID with metadata hints, classifying MIME from headers for quick format confirmation in recon pipelines. Bind in scripts to sniff uploads or evidence, outputting subtypes for chained analysis. Open-source from ahupp, it's the Pythonic probe for devs templating metadata from raw bytes.
Explore →exiv2