MetaDetective - Unleash Metadata Intelligence

Evidence Room

REF: MD-CAP-2.0.6

Exhibit A

Metadata Extraction

Powered by exiftool. 25+ fields extracted from documents, images, and media - authors, software, creation dates, internal hostnames, serial numbers, hyperlinks.

Exhibit B new

HEIC / HEIF Support

iPhone and iPad photos carry sub-meter GPS precision. MetaDetective now reads HEIC and HEIF natively - a direct line to geolocation from a single image file.

Exhibit C

Direct Web Scraping

Crawl target sites directly - unlike Metagoofil, which only surfaces files through Google dorking (rate limits, CAPTCHAs, IP blocks, index-dependent results). No search engine in the middle. Multithreaded, configurable depth, rate-limited, extension-filtered.

Exhibit D

GPS Intelligence

DMS to decimal degrees conversion, Nominatim reverse geocoding with caching, direct map links. Physical location from a single file.

Exhibit E new

Export: HTML / TXT / JSON

HTML for client reports. TXT for archiving. JSON for piping into jq, databases, or custom tooling. Structured. Predictable. Scriptable.

Exhibit F

Selective Parsing

--parse-only Author Creator limits extraction to exactly what you need. Less noise. Faster output. Cleaner downstream pipelines.

Exhibit G new

Summary & Timeline

--summary gives a statistical overview: identities, emails, GPS exposure, tools, date range. --timeline shows a chronological view of document creation and modification. --no-banner for clean pipeline output.

Exhibit H

Tunable Crawler

You set the pace: requests/second (--rate), --threads, crawl --depth, --extensions filters, --follow-extern, and a browser-realistic --user-agent (13 presets or your own).

Exhibit I new

Zero-Friction CLI

Pass a path or a URL, MetaDetective figures out the rest: MetaDetective.py ./loot/ analyzes, MetaDetective.py https://target.com/ scrapes. The classic -d / -s -u flags still work, safeguards intact.

Field Deployment

REF: MD-DEPLOY-2.0.6

One file. Zero Python dependencies. Deploy anywhere Python 3 and exiftool are available.

curl

pip

git clone

docker

field terminal

# Fastest - one curl, no pip, no clone
$ curl -O https://raw.githubusercontent.com/franckferman/MetaDetective/stable/src/MetaDetective/MetaDetective.py
$ python3 MetaDetective.py -h

# Install exiftool if needed
$ sudo apt install libimage-exiftool-perl   # Debian / Ubuntu / Kali
$ sudo pacman -S perl-image-exiftool        # Arch
$ sudo emerge -av media-libs/exiftool       # Gentoo
$ brew install exiftool                     # macOS
$ winget install OliverBetz.ExifTool        # Windows

$ python3 -m venv MetaDetectiveEnv
$ source MetaDetectiveEnv/bin/activate
$ pip install MetaDetective
$ metadetective -h

$ git clone https://github.com/franckferman/MetaDetective.git
$ cd MetaDetective
$ python3 src/MetaDetective/MetaDetective.py -h

$ docker pull franckferman/metadetective
$ docker run --rm -it franckferman/metadetective -h

# Mount a local directory
$ docker run --rm -v $(pwd)/loot:/data franckferman/metadetective -d /data

Investigation Protocols

REF: MD-OPS-2.0.6

protocol_01 :: directory analysis

# Just point at a folder - analysis mode is auto-detected
$ python3 MetaDetective.py ./loot/

# PDF and DOCX only, filter noise
$ python3 MetaDetective.py -d ./loot/ -t pdf docx -i admin anonymous

# Per-file formatted display
$ python3 MetaDetective.py -d ./loot/ --display all --format formatted

protocol_02 :: export + pivot

# JSON, targeted fields only
$ python3 MetaDetective.py -d ./docs/ \
    --parse-only Author Creator \
    -e json -o ~/results/

# Pivot with jq
$ jq '.unique.Author' ~/results/MetaDetective_Export-*.json

protocol_03 :: web recon

# Positional URL = scraping mode. Scan without downloading
$ python3 MetaDetective.py https://target.com/ --scan

# Download (defaults: ./loot/, depth 1), tune depth/threads
$ python3 MetaDetective.py https://target.com/ \
    --extensions pdf docx --depth 2 --threads 8

protocol_04 :: GPS / HEIC

# iPhone photos - extract GPS
$ python3 MetaDetective.py -d ./photos/ \
    -t heic heif jpg \
    --parse-only 'GPS Position' 'Map Link'

# HTML report, coordinates kept off the wire (no Nominatim)
$ python3 MetaDetective.py -f photo.heic -e html --no-geocode

protocol_05 :: try it live

# Scrape this very site - it hides a practice lab
$ python3 MetaDetective.py https://franckferman.github.io/MetaDetective/

# Analyze what you recovered (identities, emails, GPS...)
$ python3 MetaDetective.py ./loot/ --summary

Interrogation Room

REF: MD-QA-2.0.6

Metadata is information embedded inside files - not visible in the document but readable by tools. A PDF can expose the author's real name, the machine it was created on, the software version, when it was last modified. An image can expose GPS coordinates, camera model, serial number. A single leaked document can map an Active Directory or reveal an executive's home address.

Metagoofil surfaces files through Google dorking - unreliable by design: rate limits, CAPTCHAs, IP blocks, and results limited to whatever Google has indexed. It doesn't crawl the target itself, and it dropped native metadata analysis. MetaDetective scrapes target sites directly (no search engine dependency) and, above all, does the part Metagoofil no longer does: it parses, deduplicates, presents and exports the metadata (HTML / TXT / JSON), with selective parsing and HEIC support.

In the field, you don't always have pip access or internet connectivity. A single .py file means one curl command and you're operational. The only dependency is exiftool - preinstalled on Kali and one package away everywhere else (apt, pacman, emerge, brew, winget). This is a deliberate design choice.

It filters extraction at the source. Instead of processing all 25+ fields, --parse-only Author Creator tells MetaDetective to only look for those two fields. Less noise, cleaner output, easier to pipe downstream. Especially effective combined with -e json and jq.

Documents: PDF, DOCX, ODT, XLS, XLSX, PPTX, RTF. Images: JPEG, PNG, TIFF, PSD, SVG, BMP, HEIC, HEIF. Email: EML, MSG, PST. Video: MP4, MOV. If exiftool can parse it, MetaDetective can analyze and present it.

With --display singular: {"unique": {"Author": ["name1", "name2"]}} - deduplicated values per field, ready to pivot. With --display all: {"files": [{...}, ...]} - one object per file. Both include tool version and generation timestamp.

No. Just pass the target: a path runs analysis (MetaDetective.py ./loot/), an http(s) URL runs scraping (MetaDetective.py https://target.com/). The classic -d / -s -u flags still work, and mixing analysis and scraping options is rejected so the safeguards stay intact.

Unleash Metadata Intelligence