Forensics Matters 🕵️

Practical notes on digital forensics and incident response

Extract GPS data from JPEG images with imago

·

Many photos carry GPS coordinates in their EXIF metadata. Phones add them to remember where a picture was taken, and social networks use them to suggest a location.

In an investigation the same data can tell you a lot about where a picture was shot. With imago, an open-source Python tool I wrote, extracting GPS data from a large set of JPEG files is quick and easy.

1. Install imago

Follow the setup instructions on the GitHub page. I suggest installing it with pip.

2. Run imago with the GPS option

imago -i exif-samples/jpg/gps/ -g
  • -i — input directory with the JPEG images
  • -g — extract GPS data

If you don’t have images with GPS data at hand, you can use the samples in the exif-samples GitHub repository, as I did for this example.

While it runs, imago shows the progress of the extraction:

imago running in a terminal
imago running

3. Read the results

When it finishes, imago writes a CSV file (imago.csv) in the directory where you ran it, with all the information extracted from the images. For GPS, the columns to look at are Parsed_GPS_Latitude and Parsed_GPS_Longitude: latitude and longitude in decimal degrees.

These are the coordinates extracted from the exif-samples images:

File nameGPS latitudeGPS longitude
DSCN0042.jpg43.46445511.8814783333
DSCN0027.jpg43.468441666711.881515
DSCN0025.jpg43.46836511.881635
DSCN0010.jpg43.467448333311.8851266667
DSCN0040.jpg43.466011666611.8791116666
DSCN0012.jpg43.467156666711.885395
DSCN0038.jpg43.46725511.8792133333
DSCN0021.jpg43.467081666711.8845383333
DSCN0029.jpg43.468243333311.8801716666

With these coordinates it’s easy to plot on a map the places where the pictures were taken:

Extracted GPS coordinates plotted on a map
The extracted coordinates plotted on a map

4. From coordinates to places

imago also tries to translate the coordinates into a readable address (city, country, postcode…). When this works, you’ll find extra columns in the CSV. For example, for DSCN0021.jpg imago returns:

  • city: Arezzo
  • residential: Arezzo
  • county: AR
  • suburb: La Torre
  • state: Tos
  • postcode: 52100
  • country_code: it
  • country: Italia
  • pedestrian: Piazza del Duomo
  • place_of_worship: Duomo di Arezzo

Questions about imago or GPS extraction? Leave a comment below.

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.