ExifTool is a free, open-source command-line utility written by Phil Harvey, maintained continuously since 2003. Reads, writes, and removes metadata from over 200 file formats: photos (EXIF, IPTC, XMP), videos, PDFs, Office documents, audio files. The de facto standard tool used by photojournalists, OSINT researchers, forensic analysts, and anyone who needs to know exactly what a file is carrying.
What it means in practice
Every photo your phone takes carries metadata: GPS coordinates of where you stood, the exact timestamp, the device model, sometimes the device serial number, the camera lens, the orientation, the software version. PDFs carry author names, the username of the person who created them, often the path on the original computer. Word docs carry the same plus revision history. ExifTool exposes all of it in plain text and lets you strip it before sending. The 2012 case of John McAfee, located in Guatemala by Vice photographers who published a phone photo with GPS metadata intact, is the textbook example of why this matters. The mitigations existed, the workflow did not include them.
Who uses it, and against whom
Used by investigative journalists to verify the provenance of leaked documents, by OSINT researchers to extract context from publicly posted images, by privacy-conscious users to clean files before sharing, and by forensic analysts to reconstruct timelines from metadata-rich evidence. The adversary perspective is the same tool: anyone receiving a file you sent runs ExifTool on it (or the equivalent feature in Photoshop, Forensic Image Viewer, etc.) and reads everything you forgot to strip. For sources sending material to journalists, this is existential: a single un-stripped photo can locate the source within meters.
What you can change today
Install ExifTool from exiftool.org (Mac, Windows, Linux). The single command that strips all writable metadata from every file in a folder is: `exiftool -all= -overwrite_original *`. For a single file: `exiftool -all= -overwrite_original photo.jpg`. Run it on every file received from a source before opening in any application that might leak the path back. On the sender side, configure the camera app to not embed GPS by default (Settings, Camera, Locations off), and run ExifTool as a final pass before transmission. Alternative for non-CLI users: the Image Privacy app on iOS or ObscuraCam on Android.