Extending WebCacheImageInfo (kinda just a bit)

Near the end of November 2013,  Nir Sofer announced release of a brand new toy utility, WebCacheImageInfo.

• New utility that shows EXIF information of .jpg images stored in the cache of your Web browser - NirBlog

Pulling EXIF data out of image files is nothing new to almost anyone, but Nir’s new tool did make it much easier to harvest that information when found in images that are related to web-browsing.

From the WebCacheImageInfo tool page:

• This utility works in any version of Windows, starting from Windows XP and up to Windows 8. Both 32-bit and 64-bit systems are supported.
• The following Web browsers are supported: Internet Explorer, Mozilla Firefox, SeaMonkey, and Google Chrome. Opera is not supported because it stores the JPEG images in Webp format.
• WebCacheImageInfo won't work if you configure your Web browser to clear the cache after closing it.
• It's recommended to close all windows of your Web browser before using WebCacheImageInfo, to ensure that all cache files are saved to the disk.
• Be aware that WebCacheImageInfo only displays JPEG images with EXIF information stored in them. It doesn't display other images stored in the cache of your Web browsers.

However, unless you are a real geo-navigating pro, trying to figure out the “where-in-the-world” did Waldo take that photo using just the raw EXIF data can be a bit daunting.

Luckily there are some very nice and full-featured freeware applications that can help out and place the photo’s geo-data on a map (assuming the data hasn’t been spoofed/falsified of course!).

GeoSetter - This is one of my favorite tools for the purpose. Written by Friedemann Schmidt, it has an amazing GUI and is super-easy to use. It supports JPEG/TIFF and many common RAW file formats. Note it does use the ExifTool by Phil Harvey and download of the application is offered both in an EXE installer package as well as a Zip file.

Speaking of the ExifTool by Phil Harvey, there is also a nice ExifToolGUI maintained by Bogdan Hrastnik that also contains support for mapping of geodata in GoogleMap. It doesn’t look like it has been updated in quite a while but still is pretty useful.

See this additional list of tools that use Phil’s ExifTool engine: ExifTool Utility List.

Since we are on the subject, these might be interesting posts.

• JPEG Files Used For Targeted Attack Malware - Security Intelligence Blog | Trend Micro
• Geo-tag Forensics - Forensic Focus
• Location Data within JPGs - Forensics from the Sausage Factory blog

Regardless of the purpose you might need this tool and information for, it again stands a great reminder just how much personal information can potentially leak out when folks upload/post/share digital photos on the World-Wide Intertube network without sanitizing the EXIF data first. Just saying..

Cheers,

--Claus V.