> [!info] > Input: [[Social Media Account|personal account]] > Output: [[Name|full name]], [[Geolocation|location]], [[Photo|photo]], [[Personal Information (PI)|personal information]], time of creation/edition of content > > Types: [[Technical Weakness|technical]] > Weakness: [[SOWEL-3. Creating Content]] > Functionality: [[SOFL-1. Communications]] ### Explanation Files that users upload — photos, videos, audio, documents, PDFs — carry embedded metadata far beyond what the visible content shows. Cameras stamp GPS coordinates and device serials; editors record the author's real name and the editing timeline; office documents store the original author and a list of everyone who later touched the file. Most users never strip this metadata, and platforms remove it inconsistently — some only from images, some only on certain upload paths. Download the file in its original form rather than a re-encoded thumbnail and run a metadata extractor. ExifTool is the de-facto standard, reading EXIF, XMP, IPTC and dozens of other formats from images, video, audio and documents alike. In practice the majority of social media platforms and messengers (Facebook, Instagram, WhatsApp, Twitter/X, Signal) re-encode uploaded images on the server and strip EXIF as a side effect of the compression — the standard "save image" path on these platforms returns nothing useful. Several deliberate exceptions are worth memorising. Audio files are almost universally passed through untouched, so ID3 tags on voice messages, podcast clips and shared music often carry the recording app, device and creation timestamp. Telegram's "send as file" mode bypasses image compression entirely and delivers the original with full EXIF — a posted screenshot may be scrubbed, but the same screenshot sent as a file is not. Image hosts and CDN attachments (Imgur, Discord, parts of Reddit) keep originals; email attachments are never re-encoded. Always check whether the platform exposes an original-quality path before assuming there's nothing there. Pay particular attention to GPS coordinates, original capture time, device identifiers, and author/creator fields — each is a direct pivot to another investigation thread. ### Examples - [How To Find Timestamps For Verification](https://nixintel.info/osint/how-to-find-timestamps-for-verification/) ### Tools - [ExifTool](https://github.com/exiftool/exiftool) — de-facto standard CLI/library for reading EXIF, XMP, IPTC and other metadata from images, video, audio and documents ### See also - [[SOTL-3.10. Analyze Content Tags]] - [[SOTL-3.11. Search Accounts by Biometric Data]] - [[SOTL-3.13. Analyse Cultural Background]]