secrets-in-file-metadata

Compare original and translation side by side

🇺🇸

Original

English

🇨🇳

Translation

Chinese

Secrets in file metadata

文件元数据中的隐藏信息

The fastest lead in an investigation is often already inside the file: GPS to six decimal places, a camera serial that ties four "unrelated" images to one body, a document author who is a real employee, a template path containing a corporate share name.

Two things beginners get wrong. Absent metadata is not suspicious — it is the normal state of anything that passed through a social platform. And present metadata is not proof: every tag is a claim written by whatever software touched the file last, and all of it is editable with one command.

调查中最快捷的线索往往早已存在于文件内部：精确到小数点后六位的GPS坐标、能将四张“无关”图片关联到同一设备的相机序列号、真实存在的文档作者、包含企业共享名称的模板路径。

新手常犯两个错误。缺失元数据并非可疑——任何经过社交平台的文件，其元数据缺失都是正常状态。而存在元数据也不代表确凿证据：每个标签都是最后处理该文件的软件所写入的声明，并且所有标签都可以通过一条命令修改。

Where to look first, given what you have

根据你手中的文件，优先查看哪些内容

You have	Reach for	Because
A photo downloaded from a social platform	Expect nothing	Delivery pipelines re-encode. Use `find-the-original-image` to reach an un-stripped upstream copy.
A photo from a forum, CMS, or direct file link	Full exiftool dump	These serve your bytes back. GPS survives here more often than people expect.
A messaging attachment	Full dump, and note how it was sent	Sent-as-photo is usually re-encoded; sent-as-file usually is not.
A folder from one source	`exiftool -r -csv` triage	You want the outlier, and the tags shared across files.
A DOCX/XLSX/PPTX	exiftool, then unzip the container	Tracked changes, comment authors, revision identifiers and embedded images with intact EXIF are not surfaced by exiftool.
A PDF	exiftool, then a structural parser	Producer strings, incremental revisions, embedded files and images with their own metadata.
A press or agency photo	IPTC and XMP blocks specifically	Newsroom workflows write caption, credit, named persons and location there, and it often survives when EXIF does not.
A RAW or HEIC straight off a device	Full dump including MakerNotes	The richest case: serials, shutter counts, lens data, sub-second timing.
A video	exiftool plus `ffprobe`	Container creation time, encoder string, per-track metadata, embedded GPS tracks.

你拥有的文件类型	优先使用的方法	原因
从社交平台下载的照片	不要抱有期待	分发管道会重新编码。使用 `find-the-original-image` 获取未被剥离元数据的上游原始副本。
来自论坛、CMS或直接文件链接的照片	完整的exiftool输出	这些平台会原样返回文件字节。GPS信息留存的概率比人们预期的更高。
通讯工具中的附件	完整输出，并记录发送方式	以照片形式发送通常会被重新编码；以文件形式发送通常不会。
来自同一来源的文件夹	`exiftool -r -csv` 分类排查	你需要找出异常文件，以及文件间共享的标签信息。
DOCX/XLSX/PPTX文件	先用exiftool，再解压容器	修订记录、评论作者、修订标识和保留完整EXIF的嵌入图片不会被exiftool显示出来。
PDF文件	先用exiftool，再用结构解析器	生成器字符串、增量修订、嵌入文件以及带有自身元数据的图片。
通讯社或机构提供的照片	重点查看IPTC和XMP块	新闻编辑流程会在其中写入说明、版权、人物姓名和地点信息，而且这些信息往往比EXIF更易留存。
直接从设备导出的RAW或HEIC文件	包含MakerNotes的完整输出	最丰富的场景：序列号、快门次数、镜头数据、亚秒级时间戳。
视频文件	exiftool搭配 `ffprobe`	容器创建时间、编码器字符串、轨道级元数据、嵌入的GPS轨迹。

exiftool, properly

正确使用exiftool

bash

exiftool -G1 -a -u -g1 file.jpg        # everything, grouped into sections — best for reading
exiftool -G -a -u -s file.jpg          # everything, one line per tag, real tag names
exiftool -time:all -G1 -a -s file.jpg  # every timestamp anywhere in the file
exiftool -gps:all -n file.jpg          # GPS as raw signed decimals, ready to paste into a map

Why the defaults lose evidence:

-G
/
-G1
prefixes each tag with its group (
```
[EXIF]
```
,
```
[XMP]
```
,
```
[IPTC]
```
,
```
[MakerNotes]
```
,
```
[File]
```
,
```
[Composite]
```
). Without it you cannot distinguish a tag the device wrote from a
```
Composite
```
value exiftool calculated, or an EXIF timestamp from a filesystem one.
```
-G1
```
gives the finer group.
-a
keeps duplicate tags instead of showing only the last. Inconsistencies live here: the same timestamp with two different values in two blocks means two programs disagreed, which means the file was edited.
-u
shows tags exiftool has no name for. Vendor blocks are often the point.
-n
disables pretty-printing — signed decimal degrees instead of
```
52 deg 22' 8.40" N
```
.
-s
prints tag names rather than descriptions, so you can query them again.
-ee
extracts embedded data, including GPS tracks inside video streams.

Bulk triage, then sort the CSV looking for which files carry GPS at all, a recurring

SerialNumber

, timestamps outside the claimed window, and the one file whose

Software

differs:

bash

exiftool -r -csv -filename -createdate -datetimeoriginal -modifydate \
  -make -model -serialnumber -gpslatitude -gpslongitude -software DIR > triage.csv
exiftool -r -if '$gpslatitude' -p '$directory/$filename  $gpsposition' DIR

Full command patterns: reference/exiftool-cookbook.md.

bash

exiftool -G1 -a -u -g1 file.jpg        # 显示所有信息，按分组归类——最适合读取

exiftool -G -a -u -s file.jpg          # 显示所有信息，每行一个标签，显示真实标签名

exiftool -time:all -G1 -a -s file.jpg  # 显示文件中所有时间戳
exiftool -gps:all -n file.jpg          # 以原始带符号十进制格式显示GPS坐标，可直接粘贴到地图中

默认设置会遗漏证据的原因：

-G
/
-G1
为每个标签添加分组前缀（如
```
[EXIF]
```
、
```
[XMP]
```
、
```
[IPTC]
```
、
```
[MakerNotes]
```
、
```
[File]
```
、
```
[Composite]
```
）。没有它，你无法区分设备写入的标签与exiftool计算的
```
Composite
```
值，也无法区分EXIF时间戳与文件系统时间戳。
```
-G1
```
会显示更细致的分组。
-a
保留重复标签，而非仅显示最后一个。不一致信息就藏在这里：同一时间戳在两个块中有不同值，意味着文件被两个程序编辑过。
-u
显示exiftool未命名的标签。厂商自定义块往往是关键所在。
-n
禁用格式化输出——显示带符号的十进制度数，而非
```
52 deg 22' 8.40" N
```
这样的格式。
-s
显示标签名而非描述，方便你再次查询。
-ee
提取嵌入数据，包括视频流中的GPS轨迹。

批量排查，然后对CSV文件排序，找出带有GPS信息的文件、重复出现的

SerialNumber

、超出声明时间范围的时间戳，以及

Software

字段与众不同的文件：

bash

exiftool -r -csv -filename -createdate -datetimeoriginal -modifydate \
  -make -model -serialnumber -gpslatitude -gpslongitude -software DIR > triage.csv
exiftool -r -if '$gpslatitude' -p '$directory/$filename  $gpsposition' DIR

完整命令模板：reference/exiftool-cookbook.md。

Reading the high-value fields

高价值字段解读

GPS. Position comes from

GPSLatitude

GPSLongitude

and their

Ref

tags, height from

GPSAltitude

plus

GPSAltitudeRef

. The forgotten ones matter more:

GPSImgDirection

is the compass bearing the camera was pointed, which places the photographer and orients the view — decisive when matching street-level imagery.

GPSDestBearing

is the bearing to the subject.

GPSHPositioningError

is the device's own accuracy estimate in metres and is the honest radius for your finding.

GPSDateStamp

GPSTimeStamp

are UTC, making them the only trustworthy clock in the file.

Device fingerprint.

Make

and

Model

give a device type.

SerialNumber

BodySerialNumber

InternalSerialNumber

CameraSerialNumber

identify one physical body — the highest-value tag in the file for link analysis, tying images across accounts, platforms and years to a single camera.

LensSerialNumber

does the same for glass, and a body/lens pair is tighter still. Vendor shutter-count and image-number tags let you order a device's output and estimate how much shooting happened between two frames.

OwnerName

CameraOwnerName

and

Artist

are user-set and frequently hold a real name.

Timestamps.

DateTimeOriginal

is when the shutter fired.

CreateDate

is when this digital file was created — identical on a camera, different on a scan, export or re-encode.

ModifyDate

is when it was last written; later than

DateTimeOriginal

means processing. The trap: EXIF datetimes carry no timezone. They are local device time unless

OffsetTime

OffsetTimeOriginal

OffsetTimeDigitized

is present, which many devices omit. So reconcile against the UTC

GPSDateTime

to derive the device's offset — which itself tells you what longitude band the device was set for. Never quote

FileModifyDate

as evidence about a photograph; it belongs to the filesystem you are looking at and changes on copy.

Thumbnail versus image. Sloppy editors update the main image and leave the embedded preview alone, so the preview can show the scene before the crop or retouch.

bash

exiftool -b -ThumbnailImage file.jpg > thumb.jpg
exiftool -b -PreviewImage   file.jpg > preview.jpg
exiftool -ee -b -JpgFromRaw file.cr2 > embedded.jpg

A different aspect ratio proves a crop. Different content is the whole case.

Editing chain.

Software

ProcessingSoftware

HostComputer

and XMP's

CreatorTool

name what touched the file. XMP media-management tags go further:

DocumentID

OriginalDocumentID

InstanceID

and

DerivedFrom

link an exported derivative back to a source file you have never seen, and to sibling derivatives of that same source.

IPTC/XMP on press images.

By-line

Credit

Source

Caption-Abstract

Headline

DateCreated

City

Country-PrimaryLocationName

, plus XMP's person-in-image and location-created structures. On a wire photo this is a complete human-written answer to who, where and when — written by an editor, so treat it as a sourced claim, not a sensor reading.

Documents.

Author

and

LastModifiedBy

are the two names.

Company

and

Manager

come from the Office install.

Template

can contain a full UNC path exposing an internal server and department.

RevisionNumber

and

TotalEditTime

show whether a document was worked on or produced in one pass to look official.

LastPrinted

proves a physical copy existed. Then open the container, because per-author identities in tracked changes are not exposed by exiftool:

bash

unzip -o report.docx -d report_x

GPS信息。位置来自

GPSLatitude

GPSLongitude

及其

Ref

标签，高度来自

GPSAltitude

和

GPSAltitudeRef

。容易被忽略的字段更重要：

GPSImgDirection

是相机的罗盘方位角，能确定拍摄者的位置和拍摄方向——在匹配街景图像时至关重要。

GPSDestBearing

是指向拍摄主体的方位角。

GPSHPositioningError

是设备自身估算的精度（以米为单位），是你结论的可信半径。

GPSDateStamp

GPSTimeStamp

采用UTC时间，是文件中唯一可靠的时间戳。

设备指纹。

Make

和

Model

表示设备类型。

SerialNumber

、

BodySerialNumber

、

InternalSerialNumber

或

CameraSerialNumber

可识别具体的物理设备——这是文件中用于关联分析的最高价值标签，能将不同账号、平台、年份的图片关联到同一台相机。

LensSerialNumber

则对应镜头，机身+镜头的组合关联度更高。厂商的快门次数和图像编号标签可以帮你整理设备的输出顺序，估算两张照片之间的拍摄量。

OwnerName

、

CameraOwnerName

和

Artist

是用户设置的字段，通常包含真实姓名。

时间戳。

DateTimeOriginal

是快门按下的时间。

CreateDate

是该数字文件创建的时间——在相机上与前者一致，但在扫描、导出或重新编码时会不同。

ModifyDate

是文件最后被修改的时间；晚于

DateTimeOriginal

意味着文件被处理过。陷阱：EXIF时间戳不包含时区信息。除非存在

OffsetTime

、

OffsetTimeOriginal

或

OffsetTimeDigitized

字段（很多设备不会提供），否则它们都是设备本地时间。因此需要结合UTC格式的

GPSDateTime

来推导设备的时区偏移——这本身就能告诉你设备所在的经度范围。切勿将

FileModifyDate

作为照片相关的证据；它属于你当前查看的文件系统，复制时会发生变化。

缩略图与原图。粗心的编辑者会更新主图但保留嵌入的预览图，因此预览图可能显示裁剪或修图之前的场景。

bash

exiftool -b -ThumbnailImage file.jpg > thumb.jpg
exiftool -b -PreviewImage   file.jpg > preview.jpg
exiftool -ee -b -JpgFromRaw file.cr2 > embedded.jpg

不同的宽高比证明图片被裁剪过。内容不同则直接说明问题。

编辑链。

Software

、

ProcessingSoftware

、

HostComputer

和XMP的

CreatorTool

记录了处理过文件的工具。XMP媒体管理标签更深入：

DocumentID

、

OriginalDocumentID

、

InstanceID

和

DerivedFrom

可以将导出的衍生文件关联到你从未见过的源文件，以及该源文件的其他衍生文件。

通讯社照片的IPTC/XMP信息。

By-line

、

Credit

、

Source

、

Caption-Abstract

、

Headline

、

DateCreated

、

City

、

Country-PrimaryLocationName

，以及XMP中的人物和拍摄位置结构。对于通讯社照片，这些是完整的人工录入信息，回答了谁、在哪里、何时拍摄——由编辑录入，因此应视为有来源的声明，而非传感器读取的数据。

文档文件。

Author

和

LastModifiedBy

是两个关键姓名。

Company

和

Manager

来自Office安装设置。

Template

可能包含完整的UNC路径，暴露内部服务器和部门信息。

RevisionNumber

和

TotalEditTime

可以显示文档是经过多次修改还是一次性生成以显得正式。

LastPrinted

证明存在实体副本。然后解压容器，因为exiftool不会显示修订记录中的作者身份：

bash

unzip -o report.docx -d report_x

docProps/core.xml, docProps/app.xml — properties

docProps/core.xml, docProps/app.xml — 属性信息

word/document.xml — w:ins / w:del carry w:author and w:date

word/document.xml — w:ins / w:del 包含w:author和w:date

word/comments.xml — comment authors and initials

word/comments.xml — 评论作者和缩写

word/settings.xml — revision identifiers, a document-lineage fingerprint

word/settings.xml — 修订标识，文档谱系指纹

word/media/ — embedded images, each with its own intact EXIF

word/media/ — 嵌入图片，每张都保留完整EXIF

word/_rels/, xl/externalLinks/ — links to internal paths and other documents

word/_rels/, xl/externalLinks/ — 指向内部路径和其他文档的链接


Embedded images are the most-missed source of GPS in practice: the document was
scrubbed, the photograph pasted into page four was not.

**PDF.** `Producer` names the library or driver that wrote the file and is a strong
tell — a "scanned" document produced by a word processor was never scanned.
`Creator` names the authoring application. PDF dates, unlike EXIF, do carry a
timezone offset. PDFs support incremental updates, so earlier revisions of the
content can still be inside the file, and they can carry attachments and images
retaining their own metadata. Enumerate with `pdfimages -list` and
`pdfdetach -list`, and expand the structure with `qpdf --qdf` before reading it.

Per-format tag catalogue: [reference/tag-catalogue.md](reference/tag-catalogue.md).


嵌入图片是实际中最容易被忽略的GPS信息来源：文档被清理过，但粘贴到第四页的照片却没有。

**PDF文件**。`Producer`记录了生成文件的库或驱动程序，是重要线索——由文字处理软件生成的“扫描件”从未被扫描过。`Creator`记录了创作应用程序。与EXIF不同，PDF时间戳包含时区偏移。PDF支持增量更新，因此内容的早期版本可能仍在文件中，还可能包含附件和保留自身元数据的图片。使用`pdfimages -list`和`pdfdetach -list`枚举，在读取前用`qpdf --qdf`展开结构。

各格式标签目录：[reference/tag-catalogue.md](reference/tag-catalogue.md)。

Where this goes wrong

常见误区

Stripping happens on the way in. The mechanism: a host that re-encodes to generate delivery renditions discards EXIF; a host that serves your original bytes keeps it. Large social platforms re-encode. Many forums, self-hosted CMSes, object-storage buckets, photo-community sites and mail attachments do not. CMSes are the interesting middle case — the resized image on the page is stripped while the original upload in the media directory is intact, so try to reach the original path.
Absence proves nothing. Not that a file was scrubbed, not that it is fake, not that the uploader was careful. Write "no EXIF present", never "EXIF removed", unless you can show a copy that had it.
Presence proves only that someone wrote a value. Corroborate location visually with
```
geolocate-from-pixels
```
and timing with sun position before relying on either.
The clock is probably wrong. Camera clocks drift, stay on the wrong timezone after travel, and ignore DST. A bare EXIF datetime is ±hours until anchored against
```
GPSDateTime
```
or a dated event visible in frame.
Composite tags are exiftool's arithmetic, not the file's content.
```
GPSPosition
```
,
```
ImageSize
```
and
```
LensID
```
are derived. Without
```
-G
```
you will quote a calculated value as though the device wrote it.
Screenshots carry the screenshotting device's metadata, not the photograph's. Check whether
```
Model
```
is a phone before building a theory on it.
Editing before extracting is unrecoverable. Rotating, cropping, or even opening in some editors rewrites tags. Hash and copy first.
Online metadata viewers mean uploading your evidence to a stranger. Install exiftool; it is one Perl distribution and runs offline. A browser-local tool beats a server-side one, and neither is acceptable for material under a protective order, an NDA, or a live criminal matter. Assume anything uploaded is retained and may be indexed.

元数据在上传时被剥离。机制：重新编码以生成分发版本的平台会丢弃EXIF；原样返回原始字节的平台则会保留。大型社交平台会重新编码。许多论坛、自托管CMS、对象存储桶、摄影社区网站和邮件附件则不会。CMS是特殊情况——页面上的调整大小后的图片元数据被剥离，但媒体目录中的原始上传文件是完整的，因此尝试获取原始路径。
缺失元数据不能证明任何事。不能证明文件被清理过，不能证明是伪造的，也不能证明上传者很谨慎。应记录“无EXIF信息”，而非“EXIF被移除”，除非你能出示带有EXIF的副本。
存在元数据仅说明有人写入了某个值。在依赖GPS或时间信息之前，先用
```
geolocate-from-pixels
```
进行视觉地理位置验证，结合太阳位置确认时间。
时钟很可能不准确。相机时钟会漂移，旅行后未调整时区，还会忽略夏令时。未锚定到
```
GPSDateTime
```
或画面中可见的已标注事件的EXIF时间戳误差可达数小时。
复合标签是exiftool计算的结果，而非文件内容。
```
GPSPosition
```
、
```
ImageSize
```
和
```
LensID
```
都是推导出来的。如果不加
```
-G
```
，你会把计算值当成设备写入的值引用。
截图携带的是截图设备的元数据，而非原照片的。在基于
```
Model
```
构建结论前，先确认它是否是手机。
提取前编辑元数据会导致无法恢复。旋转、裁剪甚至在某些编辑器中打开都会重写标签。先哈希并复制文件。
在线元数据查看器意味着将你的证据上传给陌生人。安装exiftool；它是一个Perl程序包，可以离线运行。本地浏览器工具优于服务器端工具，但对于受保护令、NDA或正在进行的刑事案件的材料，两者都不可接受。假设任何上传的内容都会被保留并可能被索引。

Confidence grading

可信度分级

Confirmed — a metadata claim corroborated by non-metadata evidence: GPS that matches an independent visual geolocation of the same frame; a camera serial appearing in files from two unconnected sources; a document author matching a known employee found via
```
find-anyone
```
.
Probable — internally consistent metadata from a plausible device, in a file from a host that does not strip, with timestamps agreeing across EXIF, XMP and the embedded thumbnail, and no editor in the chain.
Unconfirmed — a single tag with nothing to check it against. Every GPS coordinate you have not visually verified sits here. That is fine, if labelled.
Contradicted — timestamps that disagree, a thumbnail showing a different scene, GPS the visual evidence rules out, or an editing tool the source denied using. A contradiction is a finding in its own right, often better than the original tag would have been.

已确认——元数据声明得到非元数据证据的佐证：GPS坐标与同一画面的独立视觉地理位置匹配；相机序列号出现在两个无关联来源的文件中；文档作者与通过
```
find-anyone
```
找到的已知员工匹配。
大概率可信——来自合理设备的内部一致的元数据，文件来自不剥离元数据的平台，EXIF、XMP和嵌入缩略图的时间戳一致，且编辑链中无编辑工具记录。
未确认——单个标签，无其他信息可验证。所有未经过视觉验证的GPS坐标都属于此类。只要标注清楚，这是可以接受的。
矛盾——时间戳不一致、缩略图显示不同场景、GPS信息被视觉证据否定，或存在来源方否认使用过的编辑工具。矛盾本身就是一个发现，往往比原始标签更有价值。

Worked example

实战案例

Verify a PDF "site inspection report" attached to an insurance claim, allegedly written on site on a stated date.

exiftool -G1 -a -u -g1 report.pdf

Producer

is a word-processor export, not a scanner driver.

CreationDate

and

ModDate

are eleven minutes apart, both with an offset three hours from the site's zone.

Author

is an initial and surname.

pdfimages -list

shows four embedded photographs. Extract them and run exiftool — nothing. They were re-encoded on insertion. Dead end, and a common one.

The claim email also carried a DOCX. Unzip it:

docProps/app.xml

gives a

TotalEditTime

under four minutes and a

Template

UNC path whose hostname belongs to a third-party firm, not the insured.

word/document.xml

has tracked insertions under a second author.

word/media/image2.jpeg

still has intact EXIF —

DateTimeOriginal

two months before the claimed inspection, GPS present,

Model

a phone,

GPSHPositioningError

nine metres.

Author names probable, to be corroborated against the firm via

x-ray-a-company

. Photo capture date contradicted against the report's claimed date. Photo location unconfirmed, handed to

geolocate-from-pixels

with a nine-metre stated radius.

验证一份附在保险索赔中的PDF“现场检查报告”，据称是在指定日期现场撰写的。

exiftool -G1 -a -u -g1 report.pdf

：

Producer

显示为文字处理器导出，而非扫描仪驱动。

CreationDate

和

ModDate

相差11分钟，两者的时区偏移量与现场所在时区相差3小时。

Author

是首字母加姓氏。

pdfimages -list

显示有四张嵌入照片。提取后运行exiftool——无任何信息。它们在插入时被重新编码了。这是一个常见的死胡同。

索赔邮件还附带了一份DOCX文件。解压后：

docProps/app.xml

显示

TotalEditTime

不到4分钟，

Template

的UNC路径主机名属于第三方公司，而非投保人。

word/document.xml

有来自第二位作者的跟踪插入记录。

word/media/image2.jpeg

仍保留完整EXIF——

DateTimeOriginal

比声称的检查日期早两个月，存在GPS信息，

Model

是手机，

GPSHPositioningError

为9米。

作者姓名大概率可信，需通过

x-ray-a-company

与该公司核实。照片拍摄日期与报告声称日期矛盾。照片位置未确认，已提交给

geolocate-from-pixels

，并标注了9米的误差半径。

Pivots

延伸操作

What you got	Send to
GPS coordinates, camera bearing	`where-was-this-taken` , `geolocate-from-pixels`
Author, owner, artist, comment author	`find-anyone`
Company, template UNC path, internal share names	`x-ray-a-company` , `recon-a-domain-passively`
Camera or lens serial linking multiple files	`graph-the-network`
Software chain suggesting manipulation	`is-this-photo-real`
Editing username resembling a handle	`hunt-a-handle`
Need for an un-stripped original	`find-the-original-image` , `read-deleted-pages`

你获得的信息	可进行的操作
GPS坐标、相机方位角	`where-was-this-taken` , `geolocate-from-pixels`
作者、所有者、艺术家、评论作者	`find-anyone`
公司、模板UNC路径、内部共享名称	`x-ray-a-company` , `recon-a-domain-passively`
关联多个文件的相机或镜头序列号	`graph-the-network`
暗示文件被篡改的软件链	`is-this-photo-real`
类似用户名的编辑者名称	`hunt-a-handle`
需要获取未被剥离元数据的原始文件	`find-the-original-image` , `read-deleted-pages`

Legal notes

法律说明

Metadata in a file you lawfully hold is yours to read. Two constraints bite. Names, precise location and device identifiers in metadata are personal data under GDPR and comparable regimes whatever file they sit in, so minimisation, retention and purpose limits apply — collect the tags the objective needs, and do not keep a full dump of a subject's photo library because it was easy. And precise historical location data about an identifiable person is the most sensitive material in this skill: legitimate in due diligence, fraud and authorized investigation, and the raw material of stalking. If the only outcome of extracting a GPS tag is knowing where a private individual sleeps, stop. See ../../ETHICS.md.

你合法持有的文件中的元数据，你有权读取。有两个限制需要注意。元数据中的姓名、精确位置和设备标识符属于GDPR及类似法规下的个人数据，无论它们存在于哪种文件中，因此适用最小化收集、保留期限和使用目的限制——只收集目标所需的标签，不要因为容易就保留主体照片库的完整输出。此外，可识别个人的精确历史位置数据是本技能中最敏感的材料：在尽职调查、欺诈调查和授权调查中是合法的，但也可能成为跟踪的素材。如果提取GPS标签的唯一结果是知道私人个体的居住地点，请停止操作。详见../../ETHICS.md。