Guide to GPS Metadata in Photos (Part 3): How to spoof GPS and other metadata in photos

Table of Contents: Guide to GPS Metadata in Photos

1. Programs for manipulating metainformation in images

2. How to understand, extract and convert geographic coordinates

3. How to spoof GPS and other metadata in photos

3.1 How to find out the coordinates of any place

3.2 Metadata tag names. Tag groups

3.3 Programs display only the meta information they support. Sometimes meta information cannot be removed completely

3.4 How to remove only certain tags in metadata

3.4.1 How to remove only GPS metadata

3.4.2 How to remove only creation date and time

3.4.3 How to delete only camera information

3.4.4 How to delete only comments

3.5 How to change GPS coordinates in a photo

3.5.1 Change location in Geotag

3.5.2 Changing the shooting location in ExifTool

3.5.3 Changing the location in Exiv2

3.6 How to change the shooting date in the photo metadata

3.6.1 Changing the date of the shooting in Geotag

3.6.2 Changing the shooting date in ExifTool

3.6.3 Changing the shooting date in Exiv2

3.7 How to change notes in photo file metadata

3.7.1 Modifying Notes in Geotag

3.7.2 Changing notes in ExifTool

3.7.3 Changing notes in Exiv2

3.8 How to change camera model in snapshot metadata

3.9 How to save metadata to a separate file

3.10 Copying metadata between files

3.11 Processing numerous photos

3.12 Spoofing metadata example

4. How to build motion tracks based on a group of photos


Take a look at the metadata of this image: https://hackware.ru/files/Kremlin.zip

Namely, look at the coordinates, shooting date, camera, notes. Use geolocation services to compare how the location they show differs from the image in the photo.

The file has been archived so that you can also estimate the date of modification.

After reading this manual, you can make fun of those who like to check metadata, as well as services that automatically indicate the location of the shooting (Instagram, Twitter).

How to find out the coordinates of any place

For GPS spoofing, you need to know which geographic coordinates the desired location has. This can be done by opening the map (https://www.google.com/maps), then find the place you need and adjust the view so that it is in the center, if necessary, zoom in. Then look at the address bar of your web browser, it will be something like: https://www.google.com/maps/@14.9684368,98.6656482,10.75z

The first two numbers after “@”, which are separated by commas, are latitude and longitude.

Metadata tag names. Tag groups

If you decide not just to delete meta information, but to manipulate it, then you need to know more details in order not to get into a loophole due to the fact that you forgot about the tag with duplicate data, as a result of which the meta information will become inconsistent or just give out real data.

To manipulate meta information tags (delete, change, show, exclude selected tags), you need to know their name. Tag names are standardized.

Metadata programs usually do not display the correct tag names. Instead, they usually display data in a user-friendly manner, sometimes even translating into the user's language.

The correct tag name can be viewed using the Exiv2 program if you run it with the "-p a" option:

exiv2 -p a PHOTO

The tag name from this output can also be used for ExifTool – you need to take the part of the name after the last period. In Exiv2, you must use the full name.

This method sounds simple, but it is NOT ideal because exiv2 only supports three groups of tags: Exif, IPTC, and XMP. But there are dozens of tag groups (not tags, but GROUPS) – the ExifTool documentation lists the tag groups that this program supports, estimate their quantity.

ExifTool has extensive documentation on tags with their correct names, to see it run the command:

man Image::ExifTool::TagNames

There are many groups of tags, the most popular for .jpg files is Exif. Also common are IPTC, XMP, MakerNotes.

You can see which group the meta-information tag belongs to using exiv2 programs (with the “-p a” option, as shown above, the name of the group comes first, and then the name of the subgroup does, and then the tag itself). As well, you can use exiftool to show tag group if you specify the -G option. You can add the -e option to not display composite (fake, generated for convenience) tags:

exiftool -G -e PHOTO

It is important to know that the same information can be duplicated in different tags belonging to a different group. Moreover, one group may contain tags with similar functions. For example, the Exif group contains DateTime, DateTimeOriginal, and DateTimeDigitized tags — all associated with creation time. Also in this group there are tags Model and Software – the last tag contains the name of the phone's firmware and allows you to uniquely identify the model, like the first tag, which contains the name of the model.

Examples of tags related to time:

[File]          File Modification Date/Time     : 2020:12:13 11:37:12+03:00
[File]          File Access Date/Time           : 2020:12:14 07:44:19+03:00
[File]          File Inode Change Date/Time     : 2020:12:14 07:43:58+03:00
[EXIF]          Modify Date                     : 2019:11:10 16:17:30
[EXIF]          Date/Time Original              : 2019:11:10 16:17:30
[EXIF]          Create Date                     : 2019:11:10 16:17:30
[EXIF]          GPS Time Stamp                  : 09:17:30
[EXIF]          GPS Date Stamp                  : 2019:11:10
[MakerNotes]    Time Stamp                      : 2019:11:10 12:17:31+03:00

[File] is not really meta information, it is file properties.

Examples of tags that allow you to determine the type and model of a device:

[EXIF]          Make                            : samsung
[EXIF]          Camera Model Name               : SM-J710F
[EXIF]          Software                        : J710FXXU6CSE1
[MakerNotes]    Device Type                     : Cell Phone

Note: these are not all possible tags and duplicates. These are the tags that I found in the first photo I came across.

Programs display only the meta information they support. Sometimes meta information cannot be removed completely

Let's count how many lines exiv2 outputs:

exiv2 -p a 20190930_095515.jpg | wc -l
63

And now for exiftool:

exiftool -e 20190930_095515.jpg | wc -l
76

This is because Exiv2 only supports three groups of tags: Exif, IPTC, and XMP. And the ExifTool program supports almost all possible tag groups.

Please be aware that some files do not allow you to completely remove meta information from them. An example of such files is PDF. Changes to PDF files using ExifTool are reversible (by removing the update with “-PDF-update:all=”), since the original information is never removed from the file. Thus, ExifTool alone cannot be used to safely edit metadata in PDF files.

You also need to be careful with MakerNotes. For example, with the command to completely remove MakerNotes, I was still unable to get rid of the timestamped tag in MakerNotes, although all other tags from this group were removed. In RAW (unprocessed) formats, MakerNotes can store important information for post-processing the image, so you need to be careful when removing this group.

How to remove only certain tags in metadata

We already have all the necessary theoretical part to fake location in photo metadata, but let's start by looking at other possibilities that are not available in simple metadata cleaning programs.

Programs like mat and mat2 can clean up all the metadata at once. But ExifTool allows you to remove certain tags or leave certain tags. For example, you can remove only GPS metadata while leaving all other information intact. Let's look at some examples.

You can combine the following methods of removing part of the metadata with each other (for example, removing GPS and camera model). This can be achieved both by sequential execution of the specified commands, or in one command, combining all the necessary options in it for deletion.

How to remove only GPS metadata

To remove all GPS geotags using ExifTool run it with the “-gps:all=” option:

exiftool -gps:all= PHOTO

The original file will be saved and "_original" will be added to its name (after the extension). By the way, the exiv2 command overwrites the existing file without making a backup.

When using the exiftool command, the new file replaces the original one (although it keeps a backup copy), with the -o option you can explicitly specify the location and name of the new file:

exiftool -gps:all= -o NEW_FILE.jpg SOURCE_FILE.jpg

To check the GPS metadata after deletion, use the command:

exiftool -G PHOTO | grep -i 'gps'

How to remove only creation date and time

To remove timestamps, use a command like:

exiftool -Date:all= -Time:all= PHOTO

To check the available time and date metadata:

exiftool -G PHOTO | grep -i -E '(date)|(time)'

Sample metadata before deletion:

[File]          File Modification Date/Time     : 2020:12:13 11:37:12+03:00
[File]          File Access Date/Time           : 2020:12:13 11:45:29+03:00
[File]          File Inode Change Date/Time     : 2020:12:13 11:37:12+03:00
[EXIF]          Modify Date                     : 2019:11:10 16:17:30
[EXIF]          Exposure Time                   : 1/1439
[EXIF]          Date/Time Original              : 2019:11:10 16:17:30
[EXIF]          Create Date                     : 2019:11:10 16:17:30
[EXIF]          Sub Sec Time                    : 0980
[EXIF]          Sub Sec Time Original           : 0980
[EXIF]          Sub Sec Time Digitized          : 0980
[EXIF]          GPS Time Stamp                  : 09:17:30
[EXIF]          GPS Date Stamp                  : 2019:11:10
[MakerNotes]    Time Stamp                      : 2019:11:10 12:17:31+03:00
[Composite]     Create Date                     : 2019:11:10 16:17:30.0980
[Composite]     Date/Time Original              : 2019:11:10 16:17:30.0980
[Composite]     Modify Date                     : 2019:11:10 16:17:30.0980
[Composite]     GPS Date/Time                   : 2019:11:10 09:17:30Z

Example of metadata after deletion:

[File]          File Modification Date/Time     : 2020:12:13 11:46:58+03:00
[File]          File Access Date/Time           : 2020:12:13 11:46:58+03:00
[File]          File Inode Change Date/Time     : 2020:12:13 11:46:58+03:00
[EXIF]          Exposure Time                   : 1/1439
[MakerNotes]    Time Stamp                      : 2019:11:10 12:17:31+03:00

[File] are timestamps in the file system. They change along with the change in the file, but they can be set to arbitrary (details in the article “How to see and change timestamps in Linux. How to perform timestamps-based searching”.

Also, the creation time of the file is saved in MakerNotes. Typically, MakerNotes tags are considered “Permanent” and can be edited, but cannot be created or deleted individually. This avoids many potential problems, including the inevitable compatibility issues with OEM software, which can be very inflexible about the information one expects to find in the manufacturer's notes.

That is, we can remove the creation date from the MakerNotes, but only if we remove the entire MakerNotes. To do this, you can use a command of the form:

exiftool -Date:all= -Time:all= -MakerNotes:all= PHOTO

For example:

exiftool -Date:all= -Time:all= -MakerNotes:all= 20191110_161731.jpg

Note: With this option, I was still unable to remove the Time Stamp from the MakerNotes in my test image (although all other tags in this group were removed). But you may not have this problem. If it is really necessary, you could remove Time Stamp from MakerNotes using the following algorithm: 1) copying Exif metadata to a file; 2) complete removal of all metadata from the file (with the help of “-all=” the Time Stamp was also removed from MakerNotes); 3) recovering Exif metadata from a file.

How to delete only camera information

Use a command like:

exiftool -Make= -Model= -Software= -makernotes:all= PHOTO

For example:

exiftool -Make= -Model= -Software= -makernotes:all= 20191110_161731.jpg

To check metadata associated with a model:

exiftool -G PHOTO | grep -i -E '(Make )|(Model)|(Software)|(Device)'

Output example:

[EXIF]          Make                            : samsung
[EXIF]          Camera Model Name               : SM-J710F
[EXIF]          Software                        : J710FXXU6CSE1
[MakerNotes]    Device Type                     : Cell Phone

After using the cleanup command, the output should be empty when checked.

How to delete only comments

To delete only a comment, run a command like this:

exiftool -UserComment= PHOTO

For example:

exiftool -UserComment= 20191110_161731.jpg

Command to check notes in metadata:

exiftool -G PHOTO | grep -i -E 'Comment'

How to change GPS coordinates in a photo

Change location in Geotag

In Geotag, click on the Latitude or Longitude column of the image for which you want to change coordinates and edit the coordinates for the selected photo. Please note that the decimal point can be either a full stop or a comma (depending on the OS language). That is, if 55.7520263 and 37.6153107 were rounded to 55 and 37, then enter 55,7520263 и 37,6153107 and vice versa.

When everything is ready, right-click on the image and select “Save New Locations”.

Changing the shooting location in ExifTool

In ExifTool, the location is changed with the following tags:

  • -GPSLatitude – latitude, the sign of the number is not important
  • -GPSLongitude – longitude, the sign of the number is not important
  • -GPSLatitudeRefN or S, that is, north or south
  • -GPSLongitudeRefE or W, that is, east or west

You don't have to use all tags at once.

General command form:

exiftool -GPSLatitude='DECIMAL.NUMBER' -GPSLongitude='DECIMAL.NUMBER' -GPSLatitudeRef='N|S' -GPSLongitudeRef='E|W' PHOTO

Example:

exiftool -GPSLatitude='55.7520263' -GPSLongitude='37.6153107' -GPSLatitudeRef='S' -GPSLongitudeRef='W' ФОТОГРАФИЯ

To check, use the command (the -e option is needed to avoid creating composite tags):

exiftool -G -e PHOTO | grep -i -E 'gps'

Changing the location in Exiv2

This program takes coordinates as three rational numbers. Three is degrees, minutes, seconds. Rational – then indicate additionally “/1”.

The following example sets the latitude to 4 degrees 15 minutes and 33 seconds north. The Exif standard specifies that the GPSLatitude tag consists of three rational numbers for degrees, minutes and seconds of latitude, and GPSLatitudeRef contains either “N” or “S” for north or south latitude, respectively.

exiv2 -M"set Exif.GPSInfo.GPSLatitude 4/1 15/1 33/1" -M"set Exif.GPSInfo.GPSLatitudeRef N" image.jpg

Longitude is set in a similar way.

Tag List:

  • Exif.GPSInfo.GPSLatitude
  • Exif.GPSInfo.GPSLatitudeRef
  • Exif.GPSInfo.GPSLongitude
  • Exif.GPSInfo.GPSLongitudeRef

How to change the shooting date in the photo metadata

Changing the date of the shooting in Geotag

In Geotag for images you can see:

  • GPS time
  • Offset (time zone)
  • Camera time

To change, right-click on the snapshot whose creation time you want to change and select “Set snapshot time”.

Then select your desired date and time and time zone.

But for me this function worked somehow strange – only the “GPS Time” has changed, I do not understand how to change the “Camera Time”.

Changing the shooting date in ExifTool

The names of the tags that I found in my test photo (so it is quite possible that this is an incomplete list):

  • DateTime
  • DateTimeOriginal
  • DateTimeDigitized
  • ModifyDate
  • CreateDate
  • GPSTimeStamp
  • GPSDateStamp

To change time tags, first look at which date and time tags are present in your snapshot, for example, with the following command:

exiftool -G PHOTO | grep -i -E '(date)|(time)'

Also, the timestamp can be present in MakerNotes – you cannot change it there, you can only completely delete MakerNotes (option “-MakerNotes:all=”).

Do not forget that apart from meta information, time stamps are present in the file properties.

In ExifTool you can set a new date and time, for example:

exiftool -DateTimeOriginal='2021:04:02 07:41:12' 20191110_161731.jpg
exiftool -GPSDateStamp='2039:04:02' -GPSTimeStamp='22:41:12' 20191110_161731.jpg

Moreover, if the data is impossible, for example, the 29th hour, then they are still stored:

exiftool -GPSDateStamp='2039:04:02' -GPSTimeStamp='29:41:12' 20191110_161731.jpg

You can use "+=" and "-=" to increase or decrease date and time.

The following command will refine the original date/time for all images in the DIRECTORY directory by subtracting one hour and 30 minutes. This is equivalent to “-DateTimeOriginal-=1.5”:

exiftool -DateTimeOriginal-='0:0:0 1:30:0' DIRECTORY

Add 3 hours to the CreateDate and ModifyDate time stamps of two images.

exiftool -createdate+=3 -modifydate+=3 a.jpg b.jpg

Changing the shooting date in Exiv2

Tag name with timestamps:

  • Exif.Image.DateTime
  • Exif.Image.DateTimeOriginal
  • Exif.Photo.DateTimeOriginal
  • Exif.Photo.DateTimeDigitized
  • Exif.GPSInfo.GPSTimeStamp
  • Exif.GPSInfo.GPSDateStamp

An example of a command that changes three tags at once:

exiv2 -M"set Exif.Image.DateTime 2021:04:02 07:41:12" -M"set Exif.Photo.DateTimeOriginal 2021:04:02 07:41:12" -M"set Exif.Photo.DateTimeDigitized 2021:04:02 07:41:12" 20191110_161731.jpg

The following options allow you to add and subtract years/months/days/hours/minutes/seconds.

-a TIME

Time change, format [-]HH[:MM[:SS]].

-Y YEAR

Time adjustment for positive or negative years.

-O MONTH

Time adjustment for positive or negative months.

-D DAY

Time adjustments for positive or negative days.

To make it clear, let's look at a couple of examples.

Add two years to a date:

exiv2 -Y 2 20191110_161731.jpg

Subtract ten years, add two months and ten days, and subtract three hours:

exiv2 -Y -10 -O 02 -D 10 -a '-03:00:0' 20191110_161731.jpg

How to change notes in photo file metadata

Modifying Notes in Geotag

Notes can be changed in the image table. The string from “Description” will be placed in the Exif.Photo.UserComment tag.

If it is an Ascii string (English letters), then most programs will be able to display it. Letters of national alphabets can be used and they will be correctly saved in UTF8 encoding, but not all simple programs will be able to display it.

Tags from other columns of the table are saved to the IPTC metadata group (if it does not exist, then it is created).

Another tag that is not used in Geotag, but which you can set or change in ExifTool and Exiv2 is Exif.GPSInfo.GPSAreaInformation.

When everything is ready, right-click on the image and select “Save New Locations” (this item is used for any saves – places, comments, times.

Changing notes in ExifTool

The Exif comment is changed with the following command:

exiftool -UserComment='COMMENT HERE' PHOTO

Of course, if you like, you can use the above IPTC tags to store geographic notes.

Name of IPTC tags for storing location notes:

  • LocationName
  • Sub-location
  • City
  • Province-State
  • Country-PrimaryLocationCode
  • Country-PrimaryLocationName

Changing notes in Exiv2

The following command sets an Exif comment to an ASCII string:

exiv2 -M"set Exif.Photo.UserComment charset=Ascii New Exif comment" PHOTO

Example:

exiv2 -M"set Exif.Photo.UserComment charset=Ascii Made for HackWare.ru" 20191110_161731.jpg

Actually "charset=Ascii" string can be skipped, usually programs will correctly recognize the encoding, especially Ascii.

Of course, if you like, you can use IPTC tags to store notes about geographic locations.

Name of IPTC tags for storing location notes:

  • Iptc.Application2.LocationName
  • Iptc.Application2.SubLocation
  • Iptc.Application2.City
  • Iptc.Application2.ProvinceState
  • Iptc.Application2.CountryName

For example:

exiv2 -M"set Iptc.Application2.LocationName Yebenya" 20191110_161731.jpg

How to change camera model in snapshot metadata

Only the ExifTool program can handle this task.

Use a command like:

exiftool -Make='MANUFACTURER' -Model='MODEL' -Software='SOFTWARE' -makernotes:all= PHOTO

For example:

exiftool -Make='samsung' -Model='Galaxy s40 Ultra' -Software='G988BXXU5CTKG' -makernotes:all= 20191110_161731.jpg

To check metadata associated with a model:

exiftool -G PHOTO | grep -i -E '(Make )|(Model)|(Software)|(Device)'

How to save metadata to a separate file

You can save all metadata or individual tags to a file. To do this, use the -TagsFromFile option:

To save all metadata to a file, run a command like this:

exiftool -a -TagsFromFile IMAGE META_FILE

The following command will copy all the meta information from the "a.jpg" snapshot to the XMP data file. If the XMP data file "out.xmp" already exists, it will be updated with the new information. Otherwise, an XMP data file will be created. This way you can create files containing only metadata (files containing images can be edited, but not created).

exiftool -Tagsfromfile a.jpg out.xmp

To write metadata from a file to an image, you need to swap the files, that is, you get the following command:

exiftool -a -TagsFromFile META_FILE IMAGE

You can still use tag names and tag groups to store only the data you need.

More command examples in the article “How to recover metadata in processed photos”.

Copying metadata between files

The following examples simply cover the capabilities of the -TagsFromFile option and the flexibility of exiftool.

Copy the values of all writable tags from "src.jpg" to "dst.jpg", keeping the original tag groups.

exiftool -TagsFromFile src.jpg -all:all dst.jpg

Remove all meta information from the "dst.jpg" image, then copy the EXIF tags from "src.jpg".

exiftool -all= -tagsfromfile src.jpg -exif:all dst.jpg

Copy ICC_Profile from one image to another.

exiftool -TagsFromFile src.jpg -icc_profile dst.jpg

Copy all meta information from "a.jpg" to "b.jpg" removing all XMP information and thumbnail image from destination.

exiftool -tagsFromFile a.jpg -XMP:All= -ThumbnailImage= -m b.jpg

Copy the title from one image to another and set the new author name.

exiftool -TagsFromFile src.jpg -title -author=Phil dst.jpg

Copy ISO from one image and comment from another image to target image.

exiftool -TagsFromFile a.jpg -ISO -TagsFromFile b.jpg -comment dst.jpg

Copy only EXIF information from one image to another, excluding SubIFD tags.

exiftool -tagsfromfile src.jpg -exif:all --subifd:all dst.jpg

Processing numerous photos

You can process many files at once.

This example removes GPS tags from all JPG images in the current directory, writing the modified images to a new directory.

exiftool -gps:all= -o NEW_DIRECTORY -ext jpg .

In this command:

  • . (dot) means all files in the current directory
  • -ext jpg means to process only jpg files
  • -o NEW_DIRECTORY specifies the folder to save the received new files

Spoofing metadata example

All shown actions for deleting and editing metadata can be combined with each other.

As an example, I'll show you how I made the file, the link to which is given at the beginning of the article.

We save the existing metadata to the meta.exif file. This is done in order to completely remove MakerNotes with a timestamp – I only succeed when removing all metadata at all. But I want to keep all the Exif tags so that the resulting set of metadata looks more natural, they will have a lot of tags with shooting conditions and so on, which is not important to us.

exiftool -a -TagsFromFile Kremlin.jpg meta.exif

You can add the “-exif:all” option to this command to copy only Exif metadata.

By the way, you can see exactly which tags are present in the file, which is the storage of metadata:

exiftool -G -e meta.exif

Remove all metadata from the file (due to a problem with MakerNotes):

exiftool -all= Kremlin.jpg

Let’s check:

exiftool -G -e Kremlin.jpg

Recovering metadata:

exiftool -a -TagsFromFile meta.exif Kremlin.jpg

We set new values for a number of tags:

exiftool -GPSLatitude='55.7520263' -GPSLongitude='37.6153107' -GPSLatitudeRef='N' -GPSLongitudeRef='E' -DateTime='2038:07:02 09:41:12' -DateTimeOriginal='2038:07:02 09:41:12' -DateTimeDigitized='2038:07:02 09:41:12' -ModifyDate='2038:07:02 09:41:12' -CreateDate='2038:07:02 09:41:12' -GPSTimeStamp='09:41:12' -GPSDateStamp='2038:07:02' -UserComment='Holidays' -LocationName='Kremlin' -Sub-location='Downtown Area' -City='Moscow' -Province-State='MSK' -Country-PrimaryLocationName='Russia' -Make='samsung' -Model='Galaxy s40 Ultra' -Software='G988BXXU5CTKG' Kremlin.jpg

Let’s check:

exiftool -G -e Kremlin.jpg

The XMP and MakerNotes groups appeared (but without the timestamp!), So we delete them with the following command:

exiftool -XMP= -MakerNotes= Kremlin.jpg

We change the time of creation, last modification and access in the file properties (for example, they are saved when transferring files in archives):

touch -t '203807020941.12' Kremlin.jpg

Related article: How to see and change timestamps in Linux. How to perform timestamps-based searching

Let’s pack in the archive:

zip Kremlin.zip Kremlin.jpg

File link: https://hackware.ru/files/Kremlin.zip

Recommended for you:

Leave a Reply

Your email address will not be published.