Recover Image Location After Geotagging Removed

TL;DR

Even if geotagging is disabled, it’s often possible to determine an image’s location using forensic techniques. This guide explains how.

How to Find Image Location After Geotagging Removal

1. Understand Metadata: Images contain more than just pixels. They have metadata – data *about* the image, like camera settings and potentially location information even if geotags are stripped.
   • EXIF Data: This is a common format for storing metadata.
   • Other Formats: Images can also store metadata in formats like XMP or IPTC.
2. Tools You’ll Need: Several tools can extract and analyse image metadata.
   • ExifTool: A powerful command-line tool (recommended). https://exiftool.org/
   • Online EXIF Viewers: Useful for quick checks, but less reliable for forensic work. (e.g., https://www.metadata2go.com/)
   • Image Editing Software: Programs like Photoshop or GIMP can sometimes reveal hidden metadata.
3. Extract Metadata with ExifTool: This is the most reliable method.

   exiftool image.jpg

   This command will output all available metadata for image.jpg. Look carefully through the results.

4. Key Metadata to Examine: Even without explicit GPS coordinates, these fields can provide clues:
   • DateTimeOriginal: The date and time the photo was taken. This is crucial for correlating with other data sources.
   • Camera Model & Settings: Knowing the camera model helps identify potential lens distortion patterns that can be used in reverse geolocation (see step 8).
   • Software: The software used to process the image might leave clues about its origin or user location.
5. Check for Embedded Thumbnails: Sometimes, a smaller thumbnail within the image file retains GPS data even if the main image doesn’t.

   exiftool -Thumbnail image.jpg

6. Reverse Image Search: Use Google Images or TinEye to find other instances of the same image online. These might have geotags attached.
   • Google Images
   • TinEye
7. Correlate with Other Data: The date and time from the image metadata are vital.
   • Social Media Accounts: Check if the user posted anything on social media around that time.
   • Location History (if available): Google Timeline or similar services can provide location data for the same timeframe.
   • Cloud Storage: Check cloud storage accounts associated with the camera or user.
8. Reverse Geolocation Techniques (Advanced): If you know the camera model, lens details and approximate time of capture, it’s possible to estimate location using:
   • Sun Position: The angle of shadows can be used to calculate latitude and longitude. Requires accurate time and date information.
   • Lens Distortion Analysis: Different lenses create unique distortion patterns that can be matched against known landmarks in satellite imagery. This is complex and requires specialized software.

Important Note: Always respect privacy laws and obtain appropriate consent before conducting any forensic investigation.