Reverse image search and photo metadata

A photo carries two kinds of information. One sits inside the file: the metadata written by the camera or by whatever software edited it. The other sits outside: copies of the same image published elsewhere, sometimes years earlier. Both help you verify content, spot fake profiles and understand what an image you published yourself gives away.

Legitimate uses

• Verification. Is a photo circulating today actually from today, and was it taken where it claims?
• Fraud. Profiles with stolen photos; rental or sales listings with images copied from somewhere else.
• Organisational security. Photos and documents published with metadata that reveals more than intended: author, software, location.
• Self-audit. Checking whether your photos appear where you did not put them.

What is inside a photo

Image formats can hold several blocks of metadata:

• EXIF. Written by the camera or phone: make and model, lens, date and time of capture, exposure settings, orientation, sometimes a serial number and, if location was switched on, GPS coordinates and altitude.
• XMP and IPTC. Added by editing software and agencies: author, copyright, caption, edit history.
• Software. Many photos record the program that processed them, which tells you whether an image went through an editor.

Two caveats. The EXIF date comes from the device clock, which may be wrong, and it often carries no time zone: offset fields were added in version 2.31 of the standard, but not every device fills them in. And metadata is easy to edit or forge, so treat it as a lead, not as proof.

The usual tool for reading metadata is ExifTool, which recognises thousands of tags. Documents work the same way: a PDF or an Office file usually stores author, organisation, software and dates.

In Pandora, the paperclip on the home screen uploads a photo or document and reads its metadata: device, date, software, author and, where present, the coordinates, which are plotted on the map. From a document it extracts the author, last editor, organisation, software and dates.

Why social networks strip metadata

Download a photo from a major social network and it will usually have no EXIF. Platforms remove metadata on upload, location above all, for privacy reasons: coordinates in a photo can reveal where someone lives. They also recompress the image and generate their own versions.

What that means for an investigation:

• A photo downloaded from a social network will rarely tell you where it was taken or with what.
• The original file may still have it: one sent as a document, hosted on a personal website or posted on some photography platforms.
• Missing metadata proves nothing, neither that a photo is fake nor that it is genuine.

Reverse image search: where else the image appears

Reverse image search engines compare an image against their index and return pages where the same or a similar image appears. The best known are Google Lens, Bing Visual Search, Yandex Images and TinEye. Each has a different index and algorithm, so it pays to try several.

• TinEye looks for exact or modified copies of the same image and lets you sort by age, which helps you find the earliest known appearance.
• Lens and Bing also return visually similar images and recognise objects. Similar is not the same: two photos that look alike are not the same photo.

A method that works:

1. Use the highest-quality version you have.
2. If the full image returns nothing, crop to the meaningful part: a building, a sign, an object.
3. Try a mirrored version too; some copies are published flipped.
4. Sort by date and find the oldest copy. Read the context it first appeared in.
5. Save the URL and date of every match, and archive the pages that matter.

How to read the results

• The date a search engine shows is when it crawled the page, not when the image was published. The oldest copy you find is the oldest that engine saw, not necessarily the original.
• The highest-resolution version is usually closest to the original. Copies shrink and get recompressed every time someone re-uploads them.
• Look for context, not just the image. A stock library, a news agency or a photographer's portfolio tells you who took the photo and, often, when and where.
• If you find a higher-quality copy, read its metadata again. It sometimes keeps what the others lost.
• No results does not prove a photo is original. It may simply not have been indexed yet.

Pandora opens the image in Google Lens, Yandex, Bing and TinEye with one click. It can also query Google Cloud Vision's web detection through the official API, which returns pages containing the exact image or a cropped version; those that are profile pages are added to the graph as accounts. Images that merely look similar are discarded, and the image is sent to Google to run the lookup.

Perceptual hashing: the same photo, even after changes

A cryptographic hash such as SHA-256 changes completely if a single pixel changes, so it cannot find resized or recompressed copies. A perceptual hash summarises the visual structure of an image instead. The pHash technique, for example, reduces the photo to greyscale and keeps its low frequencies. Two versions of the same image produce nearly identical hashes, which are compared by counting how many bits differ.

It has limits: a large crop, a rotation, a mirror image or overlaid text can break it, and very simple images can match without being the same.

Its most practical use in OSINT is corroboration: two accounts using the same profile picture are probably related, even under different handles. Pandora computes the hash of every image in a case, links the accounts that share a photo and flags it in the Dossier as strong corroboration. Generic avatars do not link accounts.

Why we do not use facial recognition

Some search engines take a face and find other photos of the same person. Pandora does not, for several reasons:

• It is biometric data. Processing facial features to identify a person is a special category of data under Article 9 of the GDPR, prohibited except in narrowly defined cases.
• It enables stalking. From a photo taken in the street, a face search engine can lead to the profile, workplace and social circle of someone who never consented.
• It makes mistakes. False matches can point at innocent people, and in an investigation that has consequences.
• Regulation restricts it. The EU AI Act prohibits creating or expanding facial recognition databases through the untargeted scraping of facial images from the internet.

Pandora compares images, not faces: it looks for the same photo, not the same person. The Google Vision lookup also searches for the same image and discards lookalikes.

A workflow for verifying a photo

1. Keep the original file unmodified and note where you got it.
2. Read the metadata, and note what is missing as well.
3. Run reverse searches on several engines and find the oldest copy.
4. Compare versions using a perceptual hash.
5. Check the content against the claimed context: place, date, weather.
6. Write up your conclusion with its confidence level and the alternatives you ruled out.

If what you need is where the photo was taken and it has no coordinates, the next step is geolocation from what can be seen in the scene.

Legal and ethical note

A photo showing a person is personal data, and GPS coordinates can reveal a home address. Process only what your purpose requires, do not publish locations that put anyone at risk, and respect the copyright of any images you reproduce.

This article is not legal advice.