Guide to GPS Metadata in Photos (Part 3): How to spoof GPS and other metadata in photos
Table of Contents: Guide to GPS Metadata in Photos
1. Programs for manipulating metainformation in images
2. How to understand, extract and convert geographic coordinates
3. How to spoof GPS and other metadata in photos
3.1 How to find out the coordinates of any place
3.2 Metadata tag names. Tag groups
3.4 How to remove only certain tags in metadata
3.4.1 How to remove only GPS metadata
3.4.2 How to remove only creation date and time
3.4.3 How to delete only camera information
3.4.4 How to delete only comments
3.5 How to change GPS coordinates in a photo
3.5.1 Change location in Geotag
3.5.2 Changing the shooting location in ExifTool
3.5.3 Changing the location in Exiv2
3.6 How to change the shooting date in the photo metadata
3.6.1 Changing the date of the shooting in Geotag
3.6.2 Changing the shooting date in ExifTool
3.6.3 Changing the shooting date in Exiv2
3.7 How to change notes in photo file metadata
3.7.1 Modifying Notes in Geotag
3.7.2 Changing notes in ExifTool
3.8 How to change camera model in snapshot metadata
3.9 How to save metadata to a separate file
3.10 Copying metadata between files
3.11 Processing numerous photos
3.12 Spoofing metadata example
4. How to build motion tracks based on a group of photos
Take a look at the metadata of this image: https://hackware.ru/files/Kremlin.zip
Namely, look at the coordinates, shooting date, camera, notes. Use geolocation services to compare how the location they show differs from the image in the photo.
The file has been archived so that you can also estimate the date of modification.
After reading this manual, you can make fun of those who like to check metadata, as well as services that automatically indicate the location of the shooting (Instagram, Twitter).
How to find out the coordinates of any place
For GPS spoofing, you need to know which geographic coordinates the desired location has. This can be done by opening the map (https://www.google.com/maps), then find the place you need and adjust the view so that it is in the center, if necessary, zoom in. Then look at the address bar of your web browser, it will be something like: https://www.google.com/maps/@14.9684368,98.6656482,10.75z
The first two numbers after “@”, which are separated by commas, are latitude and longitude.
Metadata tag names. Tag groups
If you decide not just to delete meta information, but to manipulate it, then you need to know more details in order not to get into a loophole due to the fact that you forgot about the tag with duplicate data, as a result of which the meta information will become inconsistent or just give out real data.
To manipulate meta information tags (delete, change, show, exclude selected tags), you need to know their name. Tag names are standardized.
Metadata programs usually do not display the correct tag names. Instead, they usually display data in a user-friendly manner, sometimes even translating into the user's language.
The correct tag name can be viewed using the Exiv2 program if you run it with the "-p a" option:
exiv2 -p a PHOTO
The tag name from this output can also be used for ExifTool – you need to take the part of the name after the last period. In Exiv2, you must use the full name.
This method sounds simple, but it is NOT ideal because exiv2 only supports three groups of tags: Exif, IPTC, and XMP. But there are dozens of tag groups (not tags, but GROUPS) – the ExifTool documentation lists the tag groups that this program supports, estimate their quantity.
ExifTool has extensive documentation on tags with their correct names, to see it run the command:
man Image::ExifTool::TagNames
There are many groups of tags, the most popular for .jpg files is Exif. Also common are IPTC, XMP, MakerNotes.
You can see which group the meta-information tag belongs to using exiv2 programs (with the “-p a” option, as shown above, the name of the group comes first, and then the name of the subgroup does, and then the tag itself). As well, you can use exiftool to show tag group if you specify the -G option. You can add the -e option to not display composite (fake, generated for convenience) tags:
exiftool -G -e PHOTO
It is important to know that the same information can be duplicated in different tags belonging to a different group. Moreover, one group may contain tags with similar functions. For example, the Exif group contains DateTime, DateTimeOriginal, and DateTimeDigitized tags — all associated with creation time. Also in this group there are tags Model and Software – the last tag contains the name of the phone's firmware and allows you to uniquely identify the model, like the first tag, which contains the name of the model.
Examples of tags related to time:
[File] File Modification Date/Time : 2020:12:13 11:37:12+03:00 [File] File Access Date/Time : 2020:12:14 07:44:19+03:00 [File] File Inode Change Date/Time : 2020:12:14 07:43:58+03:00 [EXIF] Modify Date : 2019:11:10 16:17:30 [EXIF] Date/Time Original : 2019:11:10 16:17:30 [EXIF] Create Date : 2019:11:10 16:17:30 [EXIF] GPS Time Stamp : 09:17:30 [EXIF] GPS Date Stamp : 2019:11:10 [MakerNotes] Time Stamp : 2019:11:10 12:17:31+03:00
[File] is not really meta information, it is file properties.
Examples of tags that allow you to determine the type and model of a device:
[EXIF] Make : samsung [EXIF] Camera Model Name : SM-J710F [EXIF] Software : J710FXXU6CSE1 [MakerNotes] Device Type : Cell Phone
Note: these are not all possible tags and duplicates. These are the tags that I found in the first photo I came across.
Programs display only the meta information they support. Sometimes meta information cannot be removed completely
Let's count how many lines exiv2 outputs:
exiv2 -p a 20190930_095515.jpg | wc -l 63
And now for exiftool:
exiftool -e 20190930_095515.jpg | wc -l 76
This is because Exiv2 only supports three groups of tags: Exif, IPTC, and XMP. And the ExifTool program supports almost all possible tag groups.
Please be aware that some files do not allow you to completely remove meta information from them. An example of such files is PDF. Changes to PDF files using ExifTool are reversible (by removing the update with “-PDF-update:all=”), since the original information is never removed from the file. Thus, ExifTool alone cannot be used to safely edit metadata in PDF files.
You also need to be careful with MakerNotes. For example, with the command to completely remove MakerNotes, I was still unable to get rid of the timestamped tag in MakerNotes, although all other tags from this group were removed. In RAW (unprocessed) formats, MakerNotes can store important information for post-processing the image, so you need to be careful when removing this group.
How to remove only certain tags in metadata
We already have all the necessary theoretical part to fake location in photo metadata, but let's start by looking at other possibilities that are not available in simple metadata cleaning programs.
Programs like mat and mat2 can clean up all the metadata at once. But ExifTool allows you to remove certain tags or leave certain tags. For example, you can remove only GPS metadata while leaving all other information intact. Let's look at some examples.
You can combine the following methods of removing part of the metadata with each other (for example, removing GPS and camera model). This can be achieved both by sequential execution of the specified commands, or in one command, combining all the necessary options in it for deletion.
How to remove only GPS metadata
To remove all GPS geotags using ExifTool run it with the “-gps:all=” option:
exiftool -gps:all= PHOTO
The original file will be saved and "_original" will be added to its name (after the extension). By the way, the exiv2 command overwrites the existing file without making a backup.
When using the exiftool command, the new file replaces the original one (although it keeps a backup copy), with the -o option you can explicitly specify the location and name of the new file:
exiftool -gps:all= -o NEW_FILE.jpg SOURCE_FILE.jpg
To check the GPS metadata after deletion, use the command:
exiftool -G PHOTO | grep -i 'gps'
How to remove only creation date and time
To remove timestamps, use a command like:
exiftool -Date:all= -Time:all= PHOTO
To check the available time and date metadata:
exiftool -G PHOTO | grep -i -E '(date)|(time)'
Sample metadata before deletion:
[File] File Modification Date/Time : 2020:12:13 11:37:12+03:00 [File] File Access Date/Time : 2020:12:13 11:45:29+03:00 [File] File Inode Change Date/Time : 2020:12:13 11:37:12+03:00 [EXIF] Modify Date : 2019:11:10 16:17:30 [EXIF] Exposure Time : 1/1439 [EXIF] Date/Time Original : 2019:11:10 16:17:30 [EXIF] Create Date : 2019:11:10 16:17:30 [EXIF] Sub Sec Time : 0980 [EXIF] Sub Sec Time Original : 0980 [EXIF] Sub Sec Time Digitized : 0980 [EXIF] GPS Time Stamp : 09:17:30 [EXIF] GPS Date Stamp : 2019:11:10 [MakerNotes] Time Stamp : 2019:11:10 12:17:31+03:00 [Composite] Create Date : 2019:11:10 16:17:30.0980 [Composite] Date/Time Original : 2019:11:10 16:17:30.0980 [Composite] Modify Date : 2019:11:10 16:17:30.0980 [Composite] GPS Date/Time : 2019:11:10 09:17:30Z
Example of metadata after deletion:
[File] File Modification Date/Time : 2020:12:13 11:46:58+03:00 [File] File Access Date/Time : 2020:12:13 11:46:58+03:00 [File] File Inode Change Date/Time : 2020:12:13 11:46:58+03:00 [EXIF] Exposure Time : 1/1439 [MakerNotes] Time Stamp : 2019:11:10 12:17:31+03:00
[File] are timestamps in the file system. They change along with the change in the file, but they can be set to arbitrary (details in the article “How to see and change timestamps in Linux. How to perform timestamps-based searching”.
Also, the creation time of the file is saved in MakerNotes. Typically, MakerNotes tags are considered “Permanent” and can be edited, but cannot be created or deleted individually. This avoids many potential problems, including the inevitable compatibility issues with OEM software, which can be very inflexible about the information one expects to find in the manufacturer's notes.
That is, we can remove the creation date from the MakerNotes, but only if we remove the entire MakerNotes. To do this, you can use a command of the form:
exiftool -Date:all= -Time:all= -MakerNotes:all= PHOTO
For example:
exiftool -Date:all= -Time:all= -MakerNotes:all= 20191110_161731.jpg
Note: With this option, I was still unable to remove the Time Stamp from the MakerNotes in my test image (although all other tags in this group were removed). But you may not have this problem. If it is really necessary, you could remove Time Stamp from MakerNotes using the following algorithm: 1) copying Exif metadata to a file; 2) complete removal of all metadata from the file (with the help of “-all=” the Time Stamp was also removed from MakerNotes); 3) recovering Exif metadata from a file.
How to delete only camera information
Use a command like:
exiftool -Make= -Model= -Software= -makernotes:all= PHOTO
For example:
exiftool -Make= -Model= -Software= -makernotes:all= 20191110_161731.jpg
To check metadata associated with a model:
exiftool -G PHOTO | grep -i -E '(Make )|(Model)|(Software)|(Device)'
Output example:
[EXIF] Make : samsung [EXIF] Camera Model Name : SM-J710F [EXIF] Software : J710FXXU6CSE1 [MakerNotes] Device Type : Cell Phone
After using the cleanup command, the output should be empty when checked.
How to delete only comments
To delete only a comment, run a command like this:
exiftool -UserComment= PHOTO
For example:
exiftool -UserComment= 20191110_161731.jpg
Command to check notes in metadata:
exiftool -G PHOTO | grep -i -E 'Comment'
How to change GPS coordinates in a photo
Change location in Geotag
In Geotag, click on the Latitude or Longitude column of the image for which you want to change coordinates and edit the coordinates for the selected photo. Please note that the decimal point can be either a full stop or a comma (depending on the OS language). That is, if 55.7520263 and 37.6153107 were rounded to 55 and 37, then enter 55,7520263 и 37,6153107 and vice versa.
When everything is ready, right-click on the image and select “Save New Locations”.
Changing the shooting location in ExifTool
In ExifTool, the location is changed with the following tags:
- -GPSLatitude – latitude, the sign of the number is not important
- -GPSLongitude – longitude, the sign of the number is not important
- -GPSLatitudeRef – N or S, that is, north or south
- -GPSLongitudeRef – E or W, that is, east or west
You don't have to use all tags at once.
General command form:
exiftool -GPSLatitude='DECIMAL.NUMBER' -GPSLongitude='DECIMAL.NUMBER' -GPSLatitudeRef='N|S' -GPSLongitudeRef='E|W' PHOTO
Example:
exiftool -GPSLatitude='55.7520263' -GPSLongitude='37.6153107' -GPSLatitudeRef='S' -GPSLongitudeRef='W' ФОТОГРАФИЯ
To check, use the command (the -e option is needed to avoid creating composite tags):
exiftool -G -e PHOTO | grep -i -E 'gps'
Changing the location in Exiv2
This program takes coordinates as three rational numbers. Three is degrees, minutes, seconds. Rational – then indicate additionally “/1”.
The following example sets the latitude to 4 degrees 15 minutes and 33 seconds north. The Exif standard specifies that the GPSLatitude tag consists of three rational numbers for degrees, minutes and seconds of latitude, and GPSLatitudeRef contains either “N” or “S” for north or south latitude, respectively.
exiv2 -M"set Exif.GPSInfo.GPSLatitude 4/1 15/1 33/1" -M"set Exif.GPSInfo.GPSLatitudeRef N" image.jpg
Longitude is set in a similar way.
Tag List:
- Exif.GPSInfo.GPSLatitude
- Exif.GPSInfo.GPSLatitudeRef
- Exif.GPSInfo.GPSLongitude
- Exif.GPSInfo.GPSLongitudeRef
How to change the shooting date in the photo metadata
Changing the date of the shooting in Geotag
In Geotag for images you can see:
- GPS time
- Offset (time zone)
- Camera time
To change, right-click on the snapshot whose creation time you want to change and select “Set snapshot time”.
Then select your desired date and time and time zone.
But for me this function worked somehow strange – only the “GPS Time” has changed, I do not understand how to change the “Camera Time”.
Changing the shooting date in ExifTool
The names of the tags that I found in my test photo (so it is quite possible that this is an incomplete list):
- DateTime
- DateTimeOriginal
- DateTimeDigitized
- ModifyDate
- CreateDate
- GPSTimeStamp
- GPSDateStamp
To change time tags, first look at which date and time tags are present in your snapshot, for example, with the following command:
exiftool -G PHOTO | grep -i -E '(date)|(time)'
Also, the timestamp can be present in MakerNotes – you cannot change it there, you can only completely delete MakerNotes (option “-MakerNotes:all=”).
Do not forget that apart from meta information, time stamps are present in the file properties.
In ExifTool you can set a new date and time, for example:
exiftool -DateTimeOriginal='2021:04:02 07:41:12' 20191110_161731.jpg exiftool -GPSDateStamp='2039:04:02' -GPSTimeStamp='22:41:12' 20191110_161731.jpg
Moreover, if the data is impossible, for example, the 29th hour, then they are still stored:
exiftool -GPSDateStamp='2039:04:02' -GPSTimeStamp='29:41:12' 20191110_161731.jpg
You can use "+=" and "-=" to increase or decrease date and time.
The following command will refine the original date/time for all images in the DIRECTORY directory by subtracting one hour and 30 minutes. This is equivalent to “-DateTimeOriginal-=1.5”:
exiftool -DateTimeOriginal-='0:0:0 1:30:0' DIRECTORY
Add 3 hours to the CreateDate and ModifyDate time stamps of two images.
exiftool -createdate+=3 -modifydate+=3 a.jpg b.jpg
Changing the shooting date in Exiv2
Tag name with timestamps:
- Exif.Image.DateTime
- Exif.Image.DateTimeOriginal
- Exif.Photo.DateTimeOriginal
- Exif.Photo.DateTimeDigitized
- Exif.GPSInfo.GPSTimeStamp
- Exif.GPSInfo.GPSDateStamp
An example of a command that changes three tags at once:
exiv2 -M"set Exif.Image.DateTime 2021:04:02 07:41:12" -M"set Exif.Photo.DateTimeOriginal 2021:04:02 07:41:12" -M"set Exif.Photo.DateTimeDigitized 2021:04:02 07:41:12" 20191110_161731.jpg
The following options allow you to add and subtract years/months/days/hours/minutes/seconds.
-a TIME
Time change, format [-]HH[:MM[:SS]].
-Y YEAR
Time adjustment for positive or negative years.
-O MONTH
Time adjustment for positive or negative months.
-D DAY
Time adjustments for positive or negative days.
To make it clear, let's look at a couple of examples.
Add two years to a date:
exiv2 -Y 2 20191110_161731.jpg
Subtract ten years, add two months and ten days, and subtract three hours:
exiv2 -Y -10 -O 02 -D 10 -a '-03:00:0' 20191110_161731.jpg
How to change notes in photo file metadata
Modifying Notes in Geotag
Notes can be changed in the image table. The string from “Description” will be placed in the Exif.Photo.UserComment tag.
If it is an Ascii string (English letters), then most programs will be able to display it. Letters of national alphabets can be used and they will be correctly saved in UTF8 encoding, but not all simple programs will be able to display it.
Tags from other columns of the table are saved to the IPTC metadata group (if it does not exist, then it is created).
Another tag that is not used in Geotag, but which you can set or change in ExifTool and Exiv2 is Exif.GPSInfo.GPSAreaInformation.
When everything is ready, right-click on the image and select “Save New Locations” (this item is used for any saves – places, comments, times.
Changing notes in ExifTool
The Exif comment is changed with the following command:
exiftool -UserComment='COMMENT HERE' PHOTO
Of course, if you like, you can use the above IPTC tags to store geographic notes.
Name of IPTC tags for storing location notes:
- LocationName
- Sub-location
- City
- Province-State
- Country-PrimaryLocationCode
- Country-PrimaryLocationName
Changing notes in Exiv2
The following command sets an Exif comment to an ASCII string:
exiv2 -M"set Exif.Photo.UserComment charset=Ascii New Exif comment" PHOTO
Example:
exiv2 -M"set Exif.Photo.UserComment charset=Ascii Made for HackWare.ru" 20191110_161731.jpg
Actually "charset=Ascii" string can be skipped, usually programs will correctly recognize the encoding, especially Ascii.
Of course, if you like, you can use IPTC tags to store notes about geographic locations.
Name of IPTC tags for storing location notes:
- Iptc.Application2.LocationName
- Iptc.Application2.SubLocation
- Iptc.Application2.City
- Iptc.Application2.ProvinceState
- Iptc.Application2.CountryName
For example:
exiv2 -M"set Iptc.Application2.LocationName Yebenya" 20191110_161731.jpg
How to change camera model in snapshot metadata
Only the ExifTool program can handle this task.
Use a command like:
exiftool -Make='MANUFACTURER' -Model='MODEL' -Software='SOFTWARE' -makernotes:all= PHOTO
For example:
exiftool -Make='samsung' -Model='Galaxy s40 Ultra' -Software='G988BXXU5CTKG' -makernotes:all= 20191110_161731.jpg
To check metadata associated with a model:
exiftool -G PHOTO | grep -i -E '(Make )|(Model)|(Software)|(Device)'
How to save metadata to a separate file
You can save all metadata or individual tags to a file. To do this, use the -TagsFromFile option:
To save all metadata to a file, run a command like this:
exiftool -a -TagsFromFile IMAGE META_FILE
The following command will copy all the meta information from the "a.jpg" snapshot to the XMP data file. If the XMP data file "out.xmp" already exists, it will be updated with the new information. Otherwise, an XMP data file will be created. This way you can create files containing only metadata (files containing images can be edited, but not created).
exiftool -Tagsfromfile a.jpg out.xmp
To write metadata from a file to an image, you need to swap the files, that is, you get the following command:
exiftool -a -TagsFromFile META_FILE IMAGE
You can still use tag names and tag groups to store only the data you need.
More command examples in the article “How to recover metadata in processed photos”.
Copying metadata between files
The following examples simply cover the capabilities of the -TagsFromFile option and the flexibility of exiftool.
Copy the values of all writable tags from "src.jpg" to "dst.jpg", keeping the original tag groups.
exiftool -TagsFromFile src.jpg -all:all dst.jpg
Remove all meta information from the "dst.jpg" image, then copy the EXIF tags from "src.jpg".
exiftool -all= -tagsfromfile src.jpg -exif:all dst.jpg
Copy ICC_Profile from one image to another.
exiftool -TagsFromFile src.jpg -icc_profile dst.jpg
Copy all meta information from "a.jpg" to "b.jpg" removing all XMP information and thumbnail image from destination.
exiftool -tagsFromFile a.jpg -XMP:All= -ThumbnailImage= -m b.jpg
Copy the title from one image to another and set the new author name.
exiftool -TagsFromFile src.jpg -title -author=Phil dst.jpg
Copy ISO from one image and comment from another image to target image.
exiftool -TagsFromFile a.jpg -ISO -TagsFromFile b.jpg -comment dst.jpg
Copy only EXIF information from one image to another, excluding SubIFD tags.
exiftool -tagsfromfile src.jpg -exif:all --subifd:all dst.jpg
Processing numerous photos
You can process many files at once.
This example removes GPS tags from all JPG images in the current directory, writing the modified images to a new directory.
exiftool -gps:all= -o NEW_DIRECTORY -ext jpg .
In this command:
- . (dot) means all files in the current directory
- -ext jpg means to process only jpg files
- -o NEW_DIRECTORY specifies the folder to save the received new files
Spoofing metadata example
All shown actions for deleting and editing metadata can be combined with each other.
As an example, I'll show you how I made the file, the link to which is given at the beginning of the article.
We save the existing metadata to the meta.exif file. This is done in order to completely remove MakerNotes with a timestamp – I only succeed when removing all metadata at all. But I want to keep all the Exif tags so that the resulting set of metadata looks more natural, they will have a lot of tags with shooting conditions and so on, which is not important to us.
exiftool -a -TagsFromFile Kremlin.jpg meta.exif
You can add the “-exif:all” option to this command to copy only Exif metadata.
By the way, you can see exactly which tags are present in the file, which is the storage of metadata:
exiftool -G -e meta.exif
Remove all metadata from the file (due to a problem with MakerNotes):
exiftool -all= Kremlin.jpg
Let’s check:
exiftool -G -e Kremlin.jpg
Recovering metadata:
exiftool -a -TagsFromFile meta.exif Kremlin.jpg
We set new values for a number of tags:
exiftool -GPSLatitude='55.7520263' -GPSLongitude='37.6153107' -GPSLatitudeRef='N' -GPSLongitudeRef='E' -DateTime='2038:07:02 09:41:12' -DateTimeOriginal='2038:07:02 09:41:12' -DateTimeDigitized='2038:07:02 09:41:12' -ModifyDate='2038:07:02 09:41:12' -CreateDate='2038:07:02 09:41:12' -GPSTimeStamp='09:41:12' -GPSDateStamp='2038:07:02' -UserComment='Holidays' -LocationName='Kremlin' -Sub-location='Downtown Area' -City='Moscow' -Province-State='MSK' -Country-PrimaryLocationName='Russia' -Make='samsung' -Model='Galaxy s40 Ultra' -Software='G988BXXU5CTKG' Kremlin.jpg
Let’s check:
exiftool -G -e Kremlin.jpg
The XMP and MakerNotes groups appeared (but without the timestamp!), So we delete them with the following command:
exiftool -XMP= -MakerNotes= Kremlin.jpg
We change the time of creation, last modification and access in the file properties (for example, they are saved when transferring files in archives):
touch -t '203807020941.12' Kremlin.jpg
Related article: How to see and change timestamps in Linux. How to perform timestamps-based searching
Let’s pack in the archive:
zip Kremlin.zip Kremlin.jpg
File link: https://hackware.ru/files/Kremlin.zip
Related articles:
- Guide to GPS Metadata in Photos (100%)
- How to extract, delete and edit metadata in LibreOffice files (58%)
- How to install Tor and create Tor hidden service on Windows (50.4%)
- How to make proxy with Tor in Windows (50.4%)
- How to see and change timestamps in Linux. How to perform timestamps-based searching (50.4%)
- How to use Android phone as GPS sensor in Linux (RANDOM - 3.1%)