Skip to content
Lesson 6 of 8

Geolocation and Imagery

7 min read

Images as a Source of Intelligence

Images are one of the richest and, at the same time, most demanding sources of OSINT. A single photograph can reveal where it was taken, when, with what device, and what was around it. The discipline of extracting geographic intelligence from images and other sources is known as GEOINT (geospatial intelligence), and although in its professional form it involves satellites and complex systems, its fundamentals are accessible to any OSINT investigator.

Image analysis combines two paths. The first is the extraction of embedded data, mainly metadata. The second is the analysis of the visual content: what is seen in the image itself — buildings, signs, vegetation, shadows — and that allows you to deduce location, time, and context. Both complement each other, and a good analyst uses them together.

The rise of games like GeoGuessr has popularized these techniques and created a community that meticulously documents the visual clues of every region of the world. That collective knowledge is a valuable resource: many public guides explain how to distinguish countries by the style of their electrical poles, license plates, or road markings.

EXIF Metadata

Digital cameras and phones embed a block of metadata called EXIF (Exchangeable Image File Format) in each photo. This block can contain the device's make and model, the exact date and time of capture, the camera parameters, and, crucially, GPS coordinates if geolocation was enabled. A single photograph with intact EXIF can reveal the precise place and moment it was taken.

Extracting this metadata is simple with ExifTool, the de facto standard, which reads and displays all the fields of a file:

# View all of an image's metadata
exiftool photo.jpg

# Extract just the most revealing fields: device, date, and GPS coordinates
exiftool -Model -DateTimeOriginal -GPSLatitude -GPSLongitude photo.jpg

# Batch-process a folder of published documents (footprinting)
exiftool -Author -Creator -Software -GPSPosition *.pdf *.jpg

In document footprinting, extracting the metadata of PDFs and photos published by an organization can reveal internal usernames, software used, and file paths. There is an important limitation to keep in mind: many platforms (Facebook, Instagram, X) strip EXIF metadata when images are uploaded, precisely to protect privacy. That is why finding intact EXIF usually depends on images obtained from sites that do not process them, such as certain forums, storage services, or documents downloaded directly. The absence of EXIF is not a failure of the technique, but a protection worth knowing about.

Geolocation by Visual Content

When an image has no location metadata, analyzing the visual content often allows you to deduce where it was taken. It is detective work: you look for identifiable elements — the name of a business, a license plate, a traffic sign, a monument, the architectural style, the language on signs, the type of vegetation. Each clue narrows the universe of possible locations until it converges on a specific place.

An orderly method helps you not get lost. The analysis community usually follows a progression like this:

  1. Inventory of clues. Note everything legible: language, signs, phone prefixes, plug types, driving side, climate, and vegetation.
  2. Country and region. Each clue rules out options: left-side driving, a particular alphabet, or a license-plate style narrows things enormously.
  3. City and street. A business name searched on a map, a distinctive building, or the road layout leads to a specific area.
  4. Confirmation. The scene is compared with real views of the terrain.

Mapping tools are the natural ally of this technique. Google Maps, Street View, Google Earth, and platforms like Mapillary let you compare the scene of a photo with real views of the terrain to confirm a location hypothesis. Reverse image search (Google Lens, Yandex Images, TinEye) helps identify landmarks or find other appearances of the same image online.

Chronolocation by Shadows

Shadows and lighting add a temporal dimension. The direction and length of a shadow, combined with the location's latitude, allow estimating the approximate time and date using solar calculation tools like SunCalc. The reasoning is direct: if we know the location from the visual analysis, the sun's position in the photo (deduced from the shadows) is only compatible with certain hours and dates of the year.

# Chronolocation method (SunCalc / solar calculator)
1. Fix the location on the map (obtained by visual content).
2. Measure the DIRECTION of the shadows in the image → sun's azimuth.
3. Estimate the sun's ELEVATION from the shadow length relative to the object height.
4. In SunCalc, find the dates/times when the sun had that azimuth and elevation at that point.

This technique, chronolocation, was key in public investigations to verify when an image was actually taken, contrasting the time deduced from the sun with the date someone claimed.

Mini-case: Verifying an "Exclusive" Image

A verification collective receives a photo presented as recent. The convergence method:

  • Reverse search (Yandex, TinEye) → the image was already published two years earlier. First alarm: it is neither exclusive nor recent.
  • Visual content → a business sign locates the street in a specific city via Street View.
  • Shadows + SunCalc → the sun's elevation is consistent with a winter morning, not the season claimed.
  • Historical weather for that date and place → confirms or dismantles the hypothesis.

Four independent sources pointing in the same direction turn a suspicion into a defensible conclusion. None, on its own, would have sufficed.

Protect Your Own Imagery

Just as in earlier lessons, understanding the technique serves to defend against it:

# Strip ALL metadata before publishing a photo
exiftool -all= photo.jpg
  • Clean the metadata of photos and documents before sharing them publicly.
  • Remember that visual content also gives you away: backgrounds, license plates, views through a window, or uniforms reveal location.
  • Disable your phone camera's geotagging if you do not need it.

Verification and OPSEC

Verification is the heart of image analysis, especially in a world full of disinformation and manipulated or AI-generated images. Before accepting an image as genuine, confirm it has not been taken out of context, that it has not been altered, and that its context is coherent. Reverse search is the first defense: if an "exclusive" image was published years earlier, something does not add up.

As for OPSEC: EXIF analysis and reverse search are passive, but opening an image hosted on the target's server can log your IP. Work on downloaded copies and, if stealth matters, use a separate network and identity. As throughout the course, image geolocation is powerful for verifying information or auditing one's own exposure; applied to tracking a person without their consent, it becomes illegitimate surveillance. The technique is neutral; the ethics and legality of its use are the investigator's responsibility.

Geolocation Checklist

  • [ ] Metadata extracted with ExifTool (device, date, GPS) when present.
  • [ ] Inventory of visual clues before jumping to a location conclusion.
  • [ ] Location hypothesis confirmed with Street View / Mapillary.
  • [ ] Timeline cross-checked via shadows (SunCalc) and weather data.
  • [ ] Reverse search done to rule out reuse or decontextualization.
  • [ ] Use limited to legitimate verification or one's own audit; never non-consensual surveillance.