Forensics Wiki - User contributions [en]

Document Metadata Extraction

2010-10-25T18:39:20Z

Hypertex: /* Images */ added Exiftool

Here are tools that will extract metadata from document files.

=Office Files=

; [[antiword]]
: http://www.winfield.demon.nl/

; [[catdoc]]
: http://www.45.free.net/~vitus/software/catdoc/

; [[laola]]
: http://user.cs.tu-berlin.de/~schwartz/pmh/index.html

; [[word2x]]
: http://word2x.sourceforge.net/

; [[wvWare]]
: http://wvware.sourceforge.net/
: Extracts metadata from various [[Microsoft]] Word files ([[doc]]). Can also convert doc files to other formats such as HTML or plain text.

; [[Outside In]]
: http://www.oracle.com/technology/products/content-management/oit/oit_all.html
: Originally developed by Stellant, supports hundreds of file types.

; [[FI Tools]]
: http://forensicinnovations.com/
: More than 100 file types.

=PDF Files=

; [[xpdf]]
: http://www.foolabs.com/xpdf/
: [[pdfinfo]] (part of the [[xpdf]] package) displays some metadata of [[PDF]] files.

(See [[PDF]])

=Images=

; [[Exiftool]]
: http://www.sno.phy.queensu.ca/~phil/exiftool/
: Free, cross-platform tool to extract metadata from many different file formats. Also supports writing

; [[jhead]]
: http://www.sentex.net/~mwandel/jhead/
: Displays or modifies [[Exif]] data in [[JPEG]] files.

; [[vinetto]]
: http://vinetto.sourceforge.net/
: Examines [[Thumbs.db]] files.

;[[libexif]]
: http://sourceforge.net/projects/libexif EXIF tag Parsing Library

; [[Adroit Photo Forensics]]
: http://digital-assembly.com/products/adroit-photo-forensics/
: Displays meta data and uses date and camera meta-data for grouping, timelines etc.

; Exif Viewer
: http://araskin.webs.com/exif/exif.html
: Add-on for Firefox and Thunderbird that displays various [[JPEG]]/JPG metadata in local and remote images.

; exiftags
: http://johnst.org/sw/exiftags/
: open source utility to parse and edit [[exif]] data in [[JPEG]] images. Found in many Debian based distributions.

; exifprobe
: http://www.virtual-cafe.com/~dhh/tools.d/exifprobe.d/exifprobe.html
: Open source utility that reads [[exif]] data in [[JPEG]] and some "RAW" image formats. Found in many Debian based distributions.

; Exiv2
: http://www.exiv2.org
: Open source C++ library and command line tool for reading and writing metadata in various image formats. Found in almost every GNU/Linux distribution

; pngtools
: http://www.stillhq.com/pngtools/
: Open source suite of commands (pnginfo, pngchunks, pngchunksdesc) that reads metadata found in [[PNG]] files. Found in many Debian based distributions.

; pngmeta
: http://sourceforge.net/projects/pmt/files/
: Open source command line tool that extracts metadata from [[PNG]] images. Found in many Debian based distributions.

=General=
These general-purpose programs frequently work when the special-purpose programs fail, but they generally provide less detailed information.

; [[Metadata Extraction Tool]]
: "Developed by the National Library of New Zealand to programmatically extract preservation metadata from a range of file formats like PDF documents, image files, sound files Microsoft office documents, and many others."
: http://meta-extractor.sourceforge.net/

; [[Metadata Assistant]]
: http://www.payneconsulting.com/products/metadataent/

; [[hachoir|hachoir-metadata]]
: Extraction tool, part of '''[[Hachoir]]''' project

; [[file]]
: The UNIX '''file''' program can extract some metadata

; [[GNU libextractor]]
: http://gnunet.org/libextractor/ The libextractor library is a plugable system for extracting metadata

; [[Directory Lister Pro]]
: Directory Lister Pro is a Windows tool which creates listings of files from selected directories on hard disks, CD-ROMs, DVD-ROMs, floppies, USB storages and network shares. Listing can be in HTML, text or CSV format (for easy import to Excel). Listing can contain standard file information like file name, extension, type, owner and date created, but especially for forensic analysis file meta data can be extracted from various formats: 1) executable file information (EXE, DLL, OCX) like file version, description, company, product name. 2) multimedia properties (MP3, AVI, WAV, JPG, GIF, BMP, MKV, MKA, MPEG) like track, title, artist, album, genre, video format, bits per pixel, frames per second, audio format, bits per channel. 3) Microsoft Office files (DOC, DOCX, XLS, XLSX, PPT, PPTX) like document title, author, keywords, word count. For each file and folder it is also possible to obtain its CRC32, MD5, SHA-1 and Whirlpool hash sum. Extensive number of options allows to completely customize the visual look of the output. Filter on file name, date, size or attributes can be applied so it is possible to limit the files listed.
: http://www.krksoft.com

[[Category:Tools]]

Exiftool

2010-10-25T18:36:54Z

Hypertex: Created page

{{Infobox_Software |
name = Exiftool |
maintainer = Phil Harvey |
os = {{Cross-platform}} |
genre = {{Analysis}} |
license = multiple |
website = [http://www.sno.phy.queensu.ca/~phil/exiftool/] |
}}

Exiftool is a Perl library and a command-line tool that can be used for reading and writing metadata in files. In addition to exif images, Exiftool also supports many other file formats, such as video and audio files as well as Word documents. Note that Exiftool does not support writing metadata to some formats. While Exiftool can be helpful in a forensic analysis, it is not a forensic tool, nor is it an anti-forensic tool.

=License=
Exiftool is free and open source release under the same terms as Perl.
=Supported Files=
The Exiftool [http://www.sno.phy.queensu.ca/~phil/exiftool/#supported website] has a comprehensive list of the supported file types, and indicates if Exiftool supports reading, writing, and/or creating metadata for each file type.
Exiftool's specialty is image file formats. It can extract exif and gps metadata and it can extract Maker Notes from several popular manufacturers.

Open Document Format

2010-04-14T00:40:47Z

Hypertex: /* Metadata */ added info about annotations and tracked changes

'''Open Document Format''' (ODF) is an open, XML-based file format standard for word processing documents, spreadsheets, charts, and presentations. The specification was originally developed by Sun Microsystems, but has been standardized by the Organization for the Advancement of Structured Information Standards (OASIS). ODF version 1.0 has been standardized as ISO/IEC 26300:2006. ODF is the primary format for the OpenOffice.org office suite.

=File Extensions=
The main file extensions for ODF documents are
* .odt for word processing documents
* .ods for spreadsheet documents
* .odp for presentation documents
* .odb for database documents
* .odg for graphical documents
* .odf for mathematical formulae

ODF also supports template files for each type of document. The 'd' in file extension is replaced by a 't' for template files.

=File Structure=
An ODF document can be as simple as a single XML file. However, this is rarely practical. The standard specifies that an ODF file can also be stored as a collection of several subdocuments. The latter is the most common implementation.

A packaged ODF file will contain, at a minimum, six files and two directories archived into a modified ZIP file. The structure of the basic package is as follows

|-- META-INF
| `-- manifest.xml
|-- Thumbnails
| `-- thumbnail.png
|-- content.xml
|-- meta.xml
|-- mimetype
|-- settings.xml
`-- styles.xml

Again, this represents a minimal ODF file. The structure can become much more complicated as directories can be added that contain embedded images, macros, and the like.

An important caveat in the structure of the ZIP file is that the first file must be the "mimetype" file and it must not be compressed. [http://www.jejik.com/articles/2010/03/how_to_correctly_create_odf_documents_using_zip/] The string "mimetype" should appear at position 30 and the actual MIME type at position 38. This adaptation makes it possible for operating systems to determine the MIME type of a file without relying on the file extension.

==Main Sub-Files==

The '''manifest.xml''' file contains a list of all files in the packages, as well as their media type, path, and any information required for decryption. The '''content.xml''' file contains the content of the document (e.g., the text in a word processing document), while the '''styles.xml''' file contains the information on how the content is to be styled. The '''settings.xml''' file is self-explanatory.

==Metadata==

Because ODF files are basically ZIP files, the files contain the same meta-information about each file as that of a standard ZIP archive, namely the name and size of each sub-file, compression information, and creation date of each sub-file. In addition, much metadata is contained within the xml files themselves. The '''meta.xml''' file contains metadata for the entire document. The types of metadata contained in the file can comprise pre-defined metadata, user defined metadata, as well as custom metadata:

* which version of ODF is used by the document
* the document generator, that is, the user-agent software that generated or last modified the ODF document. This string is similar to the HTTP user agent string as described in RFC-2616. This can contains the name and version of the software as well as the name of the operating system.
* document title
* document description
* document subject
* keywords
* initial creator
* Creator (person who last modified the document)
* printed by
* creation date/time
* modification date/time
* print date/time
* document template, the path of the document template if one was used to generate the current document
* automatic reload
* hyperlink behavior
* language
* number of editing cycles stored as a string. The number is incremented each time the document is saved.
* editing duration -- amount of time spent editing the document. The specification is not clear as to how this value is to be calculated.
* document statistics -- this field varies by file type, but includes information such as page count, object count, paragraph count, cell count, etc.
* user-defined metadata -- allowable types: string, integer, float, boolean

Conforming applications are permitted to store non-standard fields in this file, and the software should preserve any custom fields.

Not all metadata is stored in the meta.xml file. The content.xml file can contain meta-information such as annotations and tracked changes, as well as the creator and creation date time of those annotations or tracked changes.

=External Links=
[http://docs.oasis-open.org/office/v1.1/OS/OpenDocument-v1.1-html/OpenDocument-v1.1.html ODF specification]

[[Category:File Formats]]

Open Document Format

2010-04-14T00:36:35Z

Hypertex: Expanded information; added sections: file structure, metadata

'''Open Document Format''' (ODF) is an open, XML-based file format standard for word processing documents, spreadsheets, charts, and presentations. The specification was originally developed by Sun Microsystems, but has been standardized by the Organization for the Advancement of Structured Information Standards (OASIS). ODF version 1.0 has been standardized as ISO/IEC 26300:2006. ODF is the primary format for the OpenOffice.org office suite.

=File Extensions=
The main file extensions for ODF documents are
* .odt for word processing documents
* .ods for spreadsheet documents
* .odp for presentation documents
* .odb for database documents
* .odg for graphical documents
* .odf for mathematical formulae

ODF also supports template files for each type of document. The 'd' in file extension is replaced by a 't' for template files.

=File Structure=
An ODF document can be as simple as a single XML file. However, this is rarely practical. The standard specifies that an ODF file can also be stored as a collection of several subdocuments. The latter is the most common implementation.

A packaged ODF file will contain, at a minimum, six files and two directories archived into a modified ZIP file. The structure of the basic package is as follows

|-- META-INF
| `-- manifest.xml
|-- Thumbnails
| `-- thumbnail.png
|-- content.xml
|-- meta.xml
|-- mimetype
|-- settings.xml
`-- styles.xml

Again, this represents a minimal ODF file. The structure can become much more complicated as directories can be added that contain embedded images, macros, and the like.

An important caveat in the structure of the ZIP file is that the first file must be the "mimetype" file and it must not be compressed. [http://www.jejik.com/articles/2010/03/how_to_correctly_create_odf_documents_using_zip/] The string "mimetype" should appear at position 30 and the actual MIME type at position 38. This adaptation makes it possible for operating systems to determine the MIME type of a file without relying on the file extension.

==Main Sub-Files==

The '''manifest.xml''' file contains a list of all files in the packages, as well as their media type, path, and any information required for decryption. The '''content.xml''' file contains the content of the document (e.g., the text in a word processing document), while the '''styles.xml''' file contains the information on how the content is to be styled. The '''settings.xml''' file is self-explanatory.

==Metadata==

Because ODF files are basically ZIP files, the files contain the same meta-information about each file as that of a standard ZIP archive, namely the name and size of each sub-file, compression information, and creation date of each sub-file. In addition, much metadata is contained within the xml files themselves. The '''meta.xml''' file contains metadata for the entire document. The types of metadata contained in the file can comprise pre-defined metadata, user defined metadata, as well as custom metadata:

* which version of ODF is used by the document
* the document generator, that is, the user-agent software that generated or last modified the ODF document. This string is similar to the HTTP user agent string as described in RFC-2616. This can contains the name and version of the software as well as the name of the operating system.
* document title
* document description
* document subject
* keywords
* initial creator
* Creator (person who last modified the document)
* printed by
* creation date/time
* modification date/time
* print date/time
* document template, the path of the document template if one was used to generate the current document
* automatic reload
* hyperlink behavior
* language
* number of editing cycles stored as a string. The number is incremented each time the document is saved.
* editing duration -- amount of time spent editing the document. The specification is not clear as to how this value is to be calculated.
* document statistics -- this field varies by file type, but includes information such as page count, object count, paragraph count, cell count, etc.
* user-defined metadata -- allowable types: string, integer, float, boolean

Conforming applications are permitted to store non-standard fields in this file, and the software should preserve any custom fields.

=External Links=
[http://docs.oasis-open.org/office/v1.1/OS/OpenDocument-v1.1-html/OpenDocument-v1.1.html ODF specification]

[[Category:File Formats]]

Open Document Format

2010-04-13T22:45:04Z

Hypertex: Created ODF page, more to come.

Word Document (DOCX)

2010-04-13T21:36:46Z

Hypertex: /* Relationship to OOXML */

DOCX is the file format for Microsoft Office 2007 and later.

DOCX should not be confused with [[DOC]], the format used by earlier versions of Microsoft Office.

= Container Format =

DOCX is written in an XML format, which consists of a [[ZIP archive]] file containing [[XML]] and binaries. Content can be analysed without modification by unzipping the file (e.g. in WinZIP) and analysing the contents of the archive.

The file _rels/.rels contains information about the structure of the document. It contains paths to the metadata information as well as the main XML document that contains the content of the document itself.

Metadata information are usually stored in the folder docProps. Two or more XML files are stored inside that folder, app.xml that stores metadata information extracted from the Word application itself and core.xml that stores metadata from the document itself, such as the author name, last time it was printed, etc.

Another folder contains the actual content of the document, in a Word document, or an .docx document the folder's name is word. A XML file called document.xml is the main document, containing most of the content of the document itself.

= Relationship to OOXML =

Office Open XML is an open XML standard developed by Microsoft for word processing documents, spreadsheets, presentations and charts. The OOXML standard was submitted to the ISO for approval. After initially being rejected over technical concerns, the ISO approved a modified version as ISO/IEC 29500:2008. Microsoft intended to use the OOXML standard for its Office suite. However, Office does not support the standard that the ISO approved, it only supports the standard that was originally rejected by the ISO[http://arstechnica.com/microsoft/news/2010/04/iso-ooxml-convener-microsofts-format-heading-for-failure.ars]. As of Office 2010, Microsoft has still not brought its software into compliance with the standard.

For most purposes OOXML may be considered a subset of DOCX (DOCX contains additional features, like OLE serialization).

Documentation on OOXML may provide a guide to analysing a DOCX file.

= External Links =

* [http://msdn.microsoft.com/en-us/library/aa338205.aspx Information from Microsoft about the structure of OpenXML documents]

* [http://www.simson.net/clips/academic/2009.IEEE.DOCX.pdf The new XML Office Document Files: Implications For Forensics], [[Simson L. Garfinkel]] and James Migletz

* [http://blog.kiddaland.net/2009/07/antiword-for-office-2007/ Perl script that displays the content of a Docx document, similar to Antiword]

* [http://blog.kiddaland.net/2009/06/office-2007-metadata/ Perl script that displays metadata information that is extracted from an OpenXML document]
[[Category:File Formats]]

Word Document (DOCX)

2010-04-13T21:20:03Z

Hypertex: /* Relationship to OOXML */ expanded information about OOXML

DOCX is the file format for Microsoft Office 2007 and later.

DOCX should not be confused with [[DOC]], the format used by earlier versions of Microsoft Office.

= Container Format =

DOCX is written in an XML format, which consists of a [[ZIP archive]] file containing [[XML]] and binaries. Content can be analysed without modification by unzipping the file (e.g. in WinZIP) and analysing the contents of the archive.

The file _rels/.rels contains information about the structure of the document. It contains paths to the metadata information as well as the main XML document that contains the content of the document itself.

Metadata information are usually stored in the folder docProps. Two or more XML files are stored inside that folder, app.xml that stores metadata information extracted from the Word application itself and core.xml that stores metadata from the document itself, such as the author name, last time it was printed, etc.

Another folder contains the actual content of the document, in a Word document, or an .docx document the folder's name is word. A XML file called document.xml is the main document, containing most of the content of the document itself.

= Relationship to OOXML =

Office Open XML is an open XML standard developed by Microsoft for word processing documents, spreadsheets, presentations and charts. The OOXML standard was submitted to the ISO for approval. After initially being rejected over technical concerns, the ISO approved a modified version as ISO/IEC 29500:2008. Microsoft intended to use the OOXML standard for its Office suite. However, Office does not support the standard that the ISO approved, it only supports the standard that was originally [http://arstechnica.com/microsoft/news/2010/04/iso-ooxml-convener-microsofts-format-heading-for-failure.ars rejected] by the ISO. As of Office 2010, Microsoft has still not brought its software into compliance with the standard.

For most purposes OOXML may be considered a subset of DOCX (DOCX contains additional features, like OLE serialization).

Documentation on OOXML may provide a guide to analysing a DOCX file.

= External Links =

* [http://msdn.microsoft.com/en-us/library/aa338205.aspx Information from Microsoft about the structure of OpenXML documents]

* [http://www.simson.net/clips/academic/2009.IEEE.DOCX.pdf The new XML Office Document Files: Implications For Forensics], [[Simson L. Garfinkel]] and James Migletz

* [http://blog.kiddaland.net/2009/07/antiword-for-office-2007/ Perl script that displays the content of a Docx document, similar to Antiword]

* [http://blog.kiddaland.net/2009/06/office-2007-metadata/ Perl script that displays metadata information that is extracted from an OpenXML document]
[[Category:File Formats]]

Word Document (DOCX)

2010-04-13T20:58:56Z

Hypertex: /* Container Format */

DOCX is the file format for Microsoft Office 2007 and later.

DOCX should not be confused with [[DOC]], the format used by earlier versions of Microsoft Office.

= Container Format =

DOCX is written in an XML format, which consists of a [[ZIP archive]] file containing [[XML]] and binaries. Content can be analysed without modification by unzipping the file (e.g. in WinZIP) and analysing the contents of the archive.

The file _rels/.rels contains information about the structure of the document. It contains paths to the metadata information as well as the main XML document that contains the content of the document itself.

Metadata information are usually stored in the folder docProps. Two or more XML files are stored inside that folder, app.xml that stores metadata information extracted from the Word application itself and core.xml that stores metadata from the document itself, such as the author name, last time it was printed, etc.

Another folder contains the actual content of the document, in a Word document, or an .docx document the folder's name is word. A XML file called document.xml is the main document, containing most of the content of the document itself.

= Relationship to OOXML =

For most purposes OOXML may be considered a subset of DOCX (DOCX contains additional features, like OLE serialization).

Documentation on OOXML may provide a guide to analysing a DOCX file.

= External Links =

* [http://msdn.microsoft.com/en-us/library/aa338205.aspx Information from Microsoft about the structure of OpenXML documents]

* [http://www.simson.net/clips/academic/2009.IEEE.DOCX.pdf The new XML Office Document Files: Implications For Forensics], [[Simson L. Garfinkel]] and James Migletz

* [http://blog.kiddaland.net/2009/07/antiword-for-office-2007/ Perl script that displays the content of a Docx document, similar to Antiword]

* [http://blog.kiddaland.net/2009/06/office-2007-metadata/ Perl script that displays metadata information that is extracted from an OpenXML document]
[[Category:File Formats]]

Metadata

2010-04-13T17:33:03Z

Hypertex:

'''Metadata''' is data about data. Metadata plays a number of important roles in [[computer forensics]]:
* It can provide corroborating information about the document data itself.
* It can reveal information that someone tried to hide, delete, or obscure.
* It can be used to automatically correlate documents from different sources.

Since metadata is fundamentally data, it suffers all of the data quality and pedigre issues as any other form of data. Nevertheless, because metadata isn't generally visible unless you use a special tool, more skill is required to alter or otherwise manipulate it.

==Kinds of Metadata==
Some kinds of metadata that are interesting in computer forensics:
* [[File system]] metadata (e.g. [[MAC times]], [[access control lists]], etc.)
* Digital image metadata. Although information such as the image size and number of colors are technically metadata, [[JPEG]] and other file formats store additional data about the photo or the device that acquired it.
* Document metadata, such as the creator of a document, it's last print time, etc.

==File types that support metadata and extraction tools==

Below are some common data and metadata formats, the files in which they are found, and a collection of tools that can be used to extract information.

; [[EXIF]] ([[JPEG]] and [[TIFF]] image files; Music Files)
: The [[Exchangeable Image File]] format describes a format for a block of data that can be embedded into JPEG and TIFF image files, as well as [[RIFF WAVE]] audio files. Information includes date and time information, camera settings, location information, textual descriptions, and copyright information.
:* [http://pel.sourceforge.net/ PEL: PHP Exif Library]
:* [http://libexif.sourceforge.net/ LibExif] (C)
:* [http://www.drewnoakes.com/code/exif/ Metadata extraction in Java]
:* [http://digital-assembly.com/products/adroit-photo-forensics/ Adroit Photo Forensics]

; [[ID3]] ([[MP3]] files)
: Implemented as a small block of data stored at the end of MP3 files. [[ID3v1]] is a 128-byte block in a specified format allowing 30 bytes for song, artist and album, 4 bytes for year, 30 bytes for comment, and 1 byte for genre. [[ID3v1.1]] adds a track number. [[ID3v2]] is a general container structure. For more information, see [http://www.id3.org/].
:* [http://id3lib.sourceforge.net/ id3lib], a widely-used open source C/C++ ID3 implementation.
:* [http://www.vdheide.de/projects.html Java library MP3]
:* [http://search.cpan.org/dist/MP3-Info/ MP3::Info] (Perl)
:* [http://search.cpan.org/dist/MPEG-ID3v2Tag/ MPEG::ID3v2Tag] (Perl)

; [[Microsoft]] [[OLE Compound File]]
: Microsoft Office document files contain a huge amount of metadata. They are created as OLE Compound Files and mainly stored in the so called property set streams. Here are some tools for processing them:
:* [http://jakarta.apache.org/poi/index.html Jakarta POI] Open Source implementation in Java.
:* [http://www.payneconsulting.com/ Payne Consulting] Metadata Analysis and cleanup.
:* [http://www.inforenz.com/software/forager.html Inforenz Forager] Inforenz Forager

; [[TIFF]]
: The [[Tagged Image File Format]] allows one or more images to be bundled in a single file. Multiple [[compression]] formats are supported. [[EXIF]] files can be stored inside TIFFs.
:* [http://www.remotesensing.org/libtiff/ LibTIFF]
:* [http://www.awaresystems.be/imaging/tiff/faq.html TIFF FAQ]

=See Also=
[[Document_Metadata_Extraction]]

=External links=
* [http://en.wikipedia.org/wiki/Metadata Wikipedia: Metadata]
* [http://theses.nps.navy.mil/08Jun_Migletz.pdf Automated Metadata Extraction],James Migletz, Master's Thesis, Naval Postgraduate School, June 2008

Document Metadata Extraction

2010-04-13T17:23:52Z

Hypertex: /* Images */

Here are tools that will extract metadata from document files.

=Office Files=

; [[antiword]]
: http://www.winfield.demon.nl/

; [[catdoc]]
: http://www.45.free.net/~vitus/software/catdoc/

; [[laola]]
: http://user.cs.tu-berlin.de/~schwartz/pmh/index.html

; [[word2x]]
: http://word2x.sourceforge.net/

; [[wvWare]]
: http://wvware.sourceforge.net/
: Extracts metadata from various [[Microsoft]] Word files ([[doc]]). Can also convert doc files to other formats such as HTML or plain text.

; [[Outside In]]
: http://www.oracle.com/technology/products/content-management/oit/oit_all.html
: Originally developed by Stellant, supports hundreds of file types.

; [[FI Tools]]
: http://forensicinnovations.com/
: More than 100 file types.

=PDF Files=

; [[xpdf]]
: http://www.foolabs.com/xpdf/
: [[pdfinfo]] (part of the [[xpdf]] package) displays some metadata of [[PDF]] files.

(See [[PDF]])

=Images=

; [[jhead]]
: http://www.sentex.net/~mwandel/jhead/
: Displays or modifies [[Exif]] data in [[JPEG]] files.

; [[vinetto]]
: http://vinetto.sourceforge.net/
: Examines [[Thumbs.db]] files.

;[[libexif]]
: http://sourceforge.net/projects/libexif EXIF tag Parsing Library

; [[Adroit Photo Forensics]]
: http://digital-assembly.com/products/adroit-photo-forensics/
: Displays meta data and uses date and camera meta-data for grouping, timelines etc.

; Exif Viewer
: http://araskin.webs.com/exif/exif.html
: Add-on for Firefox and Thunderbird that displays various [[JPEG]]/JPG metadata in local and remote images.

; exiftags
: http://johnst.org/sw/exiftags/
: open source utility to parse and edit [[exif]] data in [[JPEG]] images. Found in many Debian based distributions.

; exifprobe
: http://www.virtual-cafe.com/~dhh/tools.d/exifprobe.d/exifprobe.html
: Open source utility that reads [[exif]] data in [[JPEG]] and some "RAW" image formats. Found in many Debian based distributions.

; Exiv2
: http://www.exiv2.org
: Open source C++ library and command line tool for reading and writing metadata in various image formats. Found in almost every GNU/Linux distribution

; pngtools
: http://www.stillhq.com/pngtools/
: Open source suite of commands (pnginfo, pngchunks, pngchunksdesc) that reads metadata found in [[PNG]] files. Found in many Debian based distributions.

; pngmeta
: http://sourceforge.net/projects/pmt/files/
: Open source command line tool that extracts metadata from [[PNG]] images. Found in many Debian based distributions.

=General=
These general-purpose programs frequently work when the special-purpose programs fail, but they generally provide less detailed information.

; [[Metadata Extraction Tool]]
: "Developed by the National Library of New Zealand to programmatically extract preservation metadata from a range of file formats like PDF documents, image files, sound files Microsoft office documents, and many others."
: http://meta-extractor.sourceforge.net/

; [[Metadata Assistant]]
: http://www.payneconsulting.com/products/metadataent/

; [[hachoir|hachoir-metadata]]
: Extraction tool, part of '''[[Hachoir]]''' project

; [[file]]
: The UNIX '''file''' program can extract some metadata

; [[GNU libextractor]]
: http://gnunet.org/libextractor/ The libextractor library is a plugable system for extracting metadata

; [[Directory Lister Pro]]
: Directory Lister Pro is a Windows tool which creates listings of files from selected directories on hard disks, CD-ROMs, DVD-ROMs, floppies, USB storages and network shares. Listing can be in HTML, text or CSV format (for easy import to Excel). Listing can contain standard file information like file name, extension, type, owner and date created, but especially for forensic analysis file meta data can be extracted from various formats: 1) executable file information (EXE, DLL, OCX) like file version, description, company, product name. 2) multimedia properties (MP3, AVI, WAV, JPG, GIF, BMP, MKV, MKA, MPEG) like track, title, artist, album, genre, video format, bits per pixel, frames per second, audio format, bits per channel. 3) Microsoft Office files (DOC, DOCX, XLS, XLSX, PPT, PPTX) like document title, author, keywords, word count. For each file and folder it is also possible to obtain its CRC32, MD5, SHA-1 and Whirlpool hash sum. Extensive number of options allows to completely customize the visual look of the output. Filter on file name, date, size or attributes can be applied so it is possible to limit the files listed.
: http://www.krksoft.com

[[Category:Tools]]

Portable Network Graphics (PNG)

2010-04-09T18:45:26Z

Hypertex:

'''Portable Network Graphics''' (aka PNG) is an image file format developed to replace GIF images on the web. It uses lossless compression and is thus not ideal for photographs. The types of images ideally suited for PNG are line-art, text, other graphics that have sharp transitions.

=Format=
A PNG file comprises "chunks" of data, some of which are mandatory and others of which are ancillary. Some ancillary chunks can contain metadata text or timestamps, but does not contain nearly as much metadata as [[exif]] images. All PNG files begin with an 8-byte signature: <tt>89 50 4E 47 0D 0A 1A 0A</tt> (hexadecimal).

=See Also=
* [http://www.forensicswiki.org/wiki/Tools:Document_Metadata_Extraction#Images Tools for extracting image metadata]

=External Links=
* [http://en.wikipedia.org/wiki/Portable_Network_Graphics Wikipedia article]
* [http://www.w3.org/TR/2003/REC-PNG-20031110/ W3C Recommendation]

[[Category:File Formats]]

PDF

2010-04-09T18:43:59Z

Hypertex:

The '''Portable Document Format''' ('''PDF''') is a document format from [[Adobe]] Inc. It is widely available on the web. Originally developed as a propriety format, version 1.7 was released as an open standard in 2008. The standard is published as ISO/IEC 32000-1:2008. Although an open standard, Adobe still owns patents and copyrights related to the PDF standard. Adobe has granted a worldwide royalty-free license to produce PDF software, but only if the software complies with the PDF standard.

== Format ==

It is a common misconception that PDF files are simply a collection of images, one per page. Certainly a PDF can be formed that way (which is typical of document scanners), but in reality the document structure is much more complex. A PDF file can contain text streams (which cam be encoded and/or compressed in dozens of ways), vector and raster images, fonts, and various interactive elements.
A PDF file comprises sections called "objects." Each object is numbered and can represent a page, a font, a data stream, etc. Each file begins with the string <tt>%PDF</tt>. Each file ends with the letters <tt>%%EOF</tt>, but there can be multiple <tt>EOF</tt>'s in a single file (this often confuses programs like [[foremost]] that search for footers).

Adobe's Acrobat software supports "incremental updates." The standard allows this so that modifications can simply be appended to the file, leaving the original data intact. Any new or altered object is simply appended to the end of the original file. Deleted objects are left intact and simply marked deleted. This can potentially cause inadvertent disclosure of sensitive information.

== Metadata ==

PDF metadata can be stored in a document information dictionary or as a metadata stream, sometimes both. A metadata stream can describe the entire document or an individual component of a document. Thus, multiple metadata streams may exist in a single document, making it difficult to find all of it. Metadata streams are stored in Adobe's XML based XMP (Extensible Metadata Platform) format. Even if a PDF document is encrypted, the accompanying metadata is not required to be, and often is not, encrypted.

The metadata (or parts of it) can be extracted with [[pdfinfo]], a utility which is part of the [[xpdf]] package.

== Embedded Objects==

The PDF standard supports embedding many types of files such as images. Embedded files may contain their own metadata. You can use [[pdfimages]], part of the [[xpdf]], to extract all of the images out of a PDF file and put each in its own file.

== Subformats ==

Several related standards exist that contain subsets or supersets of the PDF standard features. These standards include

* PDF/A a simpler set of features for archiving documents, allowing for long-term reproducibility. Some scanning software saves documents in PDF/A by default.
* PDF/X for graphic arts.
* PDF/UA for universal accessibility.
* PDF/E for engineering drawings.

==PDF Software==

Due to the popularity of the PDF format, there is much software available for viewing and creating PDF documents. However, Adobe maintains a de facto monopoly on software capable of editing PDF documents. There are quite a few tools that merge or split pdf documents, but few that can make meaningful edits. Software such as OpenOffice.org and Inkscape can import PDF files into their native formats, where the documents can be edited and then exported back to PDF. Unfortunately, this option can be quite cumbersome.

=== PDF Tools ===

; Origami
: http://security-labs.org/origami/
: A powerful open source framework and GUI written in Ruby. It allows for parsing and exploring pdf files and graphically browsing its contents.

; PDF Tools
: [http://blog.didierstevens.com/programs/pdf-tools/]
: Didier Stevens' pdf-parse and pdfid, written in Python

; pdfresurrect
: http://www.757labs.com/projects/pdfresurrect/#downloads
: Retrieves previous versions of PDF files that have changes appended with "incremental updates"

; QPDF
: http://sourceforge.net/projects/qpdf/
: Open source, cross-platform library and set of programs to inspect and manipulate PDF files. Packaged in recent Debian based distributions.

== External Links ==

* [http://partners.adobe.com/public/developer/pdf/index_reference.html Adobe PDF Reference]
* [http://en.wikipedia.org/wiki/PDF Wikipedia: PDF]
* [http://www.mactech.com/articles/mactech/Vol.15/15.09/PDFIntro/ Portable Document Format: An Introduction for Programmers], MacTech Magazine, Volume 15, (1999), Issue 9
* [http://www.iso.org/iso/iso_catalogue/catalogue_tc/catalogue_detail.htm?csnumber=51502 ISO Standard]
* [http://partners.adobe.com/public/developer/support/topic_legal_notices.html Patent Licenses]

=See Also=
* [[Arabic PDFs]]
* [[Tools:Document Metadata Extraction]]

[[Category:File Formats]]

PDF

2010-04-09T18:43:16Z

Hypertex: Added additional information about metadata and file format; inserted list of pdf tools

PDF

2010-04-09T15:40:17Z

Hypertex: Updated format info--open standard.

The '''Portable Document Format''' ('''PDF''') is a document format from [[Adobe]] Inc. It is widely available on the web. Originally developed as a propriety format, it was released as an open standard in 2008. The standard is published as ISO/IEC 32000-1:2008.

== Format ==

Each file begins with the string <tt>%PDF</tt>. Each block ends with the letters <tt>EOF</tt>, but there can be multiple <tt>EOF</tt>'s in a single file (this often confuses programs like [[foremost]] that search for footers).

== Metadata ==

The metadata (or parts of it) can be extracted with [[pdfinfo]], a utility which is part of the [[xpdf]] package.

== Embedded Objects==

You can use [[pdfimages]], part of the [[xpdf]], to extract all of the images out of a PDF file and put each in its own file.

== External Links ==

* [http://partners.adobe.com/public/developer/pdf/index_reference.html Adobe PDF Reference]
* [http://en.wikipedia.org/wiki/PDF Wikipedia: PDF]
* [http://www.mactech.com/articles/mactech/Vol.15/15.09/PDFIntro/ Portable Document Format: An Introduction for Programmers], MacTech Magazine, Volume 15, (1999), Issue 9

=See Also=
* [[Arabic PDFs]]
* [[Tools:Document Metadata Extraction]]
* [[Category:File Formats]]

Portable Network Graphics (PNG)

2010-04-09T14:58:38Z

Hypertex: Created page

'''Portable Network Graphics''' (aka PNG) is an image file format developed to replace GIF images on the web. It uses lossless compression and is thus not ideal for photographs. The types of images ideally suited for PNG are line-art, text, other graphics that have sharp transitions.

=Format=
A PNG file comprises "chunks" of data, some of which are mandatory and others of which are ancillary. Some ancillary chunks can contain metadata text or timestamps, but does not contain nearly as much metadata as [[exif]] images. All PNG files begin with an 8-byte signature: <tt>89 50 4E 47 0D 0A 1A 0A</tt> (hexadecimaml).

=See Also=
* [http://www.forensicswiki.org/wiki/Tools:Document_Metadata_Extraction#Images Tools for extracting image metadata]

=External Links=
* [http://en.wikipedia.org/wiki/Portable_Network_Graphics Wikipedia article]
* [http://www.w3.org/TR/2003/REC-PNG-20031110/ W3C Recommendation]

[[Category:File Formats]]

Document Metadata Extraction

2010-04-09T14:40:25Z

Hypertex: /* Images */

Here are tools that will extract metadata from document files.

=Office Files=

; [[antiword]]
: http://www.winfield.demon.nl/

; [[catdoc]]
: http://www.45.free.net/~vitus/software/catdoc/

; [[laola]]
: http://user.cs.tu-berlin.de/~schwartz/pmh/index.html

; [[word2x]]
: http://word2x.sourceforge.net/

; [[wvWare]]
: http://wvware.sourceforge.net/
: Extracts metadata from various [[Microsoft]] Word files ([[doc]]). Can also convert doc files to other formats such as HTML or plain text.

; [[Outside In]]
: http://www.oracle.com/technology/products/content-management/oit/oit_all.html
: Originally developed by Stellant, supports hundreds of file types.

; [[FI Tools]]
: http://forensicinnovations.com/
: More than 100 file types.

=PDF Files=

; [[xpdf]]
: http://www.foolabs.com/xpdf/
: [[pdfinfo]] (part of the [[xpdf]] package) displays some metadata of [[PDF]] files.

(See [[PDF]])

=Images=

; [[jhead]]
: http://www.sentex.net/~mwandel/jhead/
: Displays or modifies [[Exif]] data in [[JPEG]] files.

; [[vinetto]]
: http://vinetto.sourceforge.net/
: Examines [[Thumbs.db]] files.

;[[libexif]]
: http://sourceforge.net/projects/libexif EXIF tag Parsing Library

; [[Adroit Photo Forensics]]
: http://digital-assembly.com/products/adroit-photo-forensics/
: Displays meta data and uses date and camera meta-data for grouping, timelines etc.

; Exif Viewer
: http://araskin.webs.com/exif/exif.html
: Add-on for Firefox and Thunderbird that displays various [[JPEG]]/JPG metadata in local and remote images.

; exiftags
: http://johnst.org/sw/exiftags/
: open source utility to parse and edit [[exif]] data in [[JPEG]] images. Found in many Debian based distributions.

; exifprobe
: http://www.virtual-cafe.com/~dhh/tools.d/exifprobe.d/exifprobe.html
: Open source utility that reads [[exif]] data in [[JPEG]] and some "RAW" image formats. Found in many Debian based distributions.

; pngtools
: http://www.stillhq.com/pngtools/
: Open source suite of commands (pnginfo, pngchunks, pngchunksdesc) that reads metadata found in [[PNG]] files. Found in many Debian based distributions.

; pngmeta
: http://sourceforge.net/projects/pmt/files/
: Open source command line tool that extracts metadata from [[PNG]] images. Found in many Debian based distributions.

=General=
These general-purpose programs frequently work when the special-purpose programs fail, but they generally provide less detailed information.

; [[Metadata Extraction Tool]]
: "Developed by the National Library of New Zealand to programmatically extract preservation metadata from a range of file formats like PDF documents, image files, sound files Microsoft office documents, and many others."
: http://meta-extractor.sourceforge.net/

; [[Metadata Assistant]]
: http://www.payneconsulting.com/products/metadataent/

; [[hachoir|hachoir-metadata]]
: Extraction tool, part of '''[[Hachoir]]''' project

; [[file]]
: The UNIX '''file''' program can extract some metadata

; [[GNU libextractor]]
: http://gnunet.org/libextractor/ The libextractor library is a plugable system for extracting metadata

; [[Directory Lister Pro]]
: Directory Lister Pro is a Windows tool which creates listings of files from selected directories on hard disks, CD-ROMs, DVD-ROMs, floppies, USB storages and network shares. Listing can be in HTML, text or CSV format (for easy import to Excel). Listing can contain standard file information like file name, extension, type, owner and date created, but especially for forensic analysis file meta data can be extracted from various formats: 1) executable file information (EXE, DLL, OCX) like file version, description, company, product name. 2) multimedia properties (MP3, AVI, WAV, JPG, GIF, BMP, MKV, MKA, MPEG) like track, title, artist, album, genre, video format, bits per pixel, frames per second, audio format, bits per channel. 3) Microsoft Office files (DOC, DOCX, XLS, XLSX, PPT, PPTX) like document title, author, keywords, word count. For each file and folder it is also possible to obtain its CRC32, MD5, SHA-1 and Whirlpool hash sum. Extensive number of options allows to completely customize the visual look of the output. Filter on file name, date, size or attributes can be applied so it is possible to limit the files listed.
: http://www.krksoft.com

[[Category:Tools]]

Document Metadata Extraction

2010-04-09T14:23:21Z

Hypertex: /* Images */

Here are tools that will extract metadata from document files.

=Office Files=

; [[antiword]]
: http://www.winfield.demon.nl/

; [[catdoc]]
: http://www.45.free.net/~vitus/software/catdoc/

; [[laola]]
: http://user.cs.tu-berlin.de/~schwartz/pmh/index.html

; [[word2x]]
: http://word2x.sourceforge.net/

; [[wvWare]]
: http://wvware.sourceforge.net/
: Extracts metadata from various [[Microsoft]] Word files ([[doc]]). Can also convert doc files to other formats such as HTML or plain text.

; [[Outside In]]
: http://www.oracle.com/technology/products/content-management/oit/oit_all.html
: Originally developed by Stellant, supports hundreds of file types.

; [[FI Tools]]
: http://forensicinnovations.com/
: More than 100 file types.

=PDF Files=

; [[xpdf]]
: http://www.foolabs.com/xpdf/
: [[pdfinfo]] (part of the [[xpdf]] package) displays some metadata of [[PDF]] files.

(See [[PDF]])

=Images=

; [[jhead]]
: http://www.sentex.net/~mwandel/jhead/
: Displays or modifies [[Exif]] data in [[JPEG]] files.

; [[vinetto]]
: http://vinetto.sourceforge.net/
: Examines [[Thumbs.db]] files.

;[[libexif]]
: http://sourceforge.net/projects/libexif EXIF tag Parsing Library

; [[Adroit Photo Forensics]]
: http://digital-assembly.com/products/adroit-photo-forensics/
: Displays meta data and uses date and camera meta-data for grouping, timelines etc.

; Exif Viewer
: http://araskin.webs.com/exif/exif.html
: Add-on for Firefox and Thunderbird that displays various [[JPEG]]/JPG metadata in local and remote images.

; exiftags
: http://johnst.org/sw/exiftags/
: open source utility to parse and edit [[exif]] data in [[JPEG]] images. Found in many Debian based distributions.

; exifprobe
: http://www.virtual-cafe.com/~dhh/tools.d/exifprobe.d/exifprobe.html
: Open source utility that reads [[exif]] data in [[JPEG]] and some "RAW" image formats. Found in many Debian based distributions.

=General=
These general-purpose programs frequently work when the special-purpose programs fail, but they generally provide less detailed information.

; [[Metadata Extraction Tool]]
: "Developed by the National Library of New Zealand to programmatically extract preservation metadata from a range of file formats like PDF documents, image files, sound files Microsoft office documents, and many others."
: http://meta-extractor.sourceforge.net/

; [[Metadata Assistant]]
: http://www.payneconsulting.com/products/metadataent/

; [[hachoir|hachoir-metadata]]
: Extraction tool, part of '''[[Hachoir]]''' project

; [[file]]
: The UNIX '''file''' program can extract some metadata

; [[GNU libextractor]]
: http://gnunet.org/libextractor/ The libextractor library is a plugable system for extracting metadata

; [[Directory Lister Pro]]
: Directory Lister Pro is a Windows tool which creates listings of files from selected directories on hard disks, CD-ROMs, DVD-ROMs, floppies, USB storages and network shares. Listing can be in HTML, text or CSV format (for easy import to Excel). Listing can contain standard file information like file name, extension, type, owner and date created, but especially for forensic analysis file meta data can be extracted from various formats: 1) executable file information (EXE, DLL, OCX) like file version, description, company, product name. 2) multimedia properties (MP3, AVI, WAV, JPG, GIF, BMP, MKV, MKA, MPEG) like track, title, artist, album, genre, video format, bits per pixel, frames per second, audio format, bits per channel. 3) Microsoft Office files (DOC, DOCX, XLS, XLSX, PPT, PPTX) like document title, author, keywords, word count. For each file and folder it is also possible to obtain its CRC32, MD5, SHA-1 and Whirlpool hash sum. Extensive number of options allows to completely customize the visual look of the output. Filter on file name, date, size or attributes can be applied so it is possible to limit the files listed.
: http://www.krksoft.com

[[Category:Tools]]

Document Metadata Extraction

2010-04-09T13:43:35Z

Hypertex: /* Images */

Here are tools that will extract metadata from document files.

=Office Files=

; [[antiword]]
: http://www.winfield.demon.nl/

; [[catdoc]]
: http://www.45.free.net/~vitus/software/catdoc/

; [[laola]]
: http://user.cs.tu-berlin.de/~schwartz/pmh/index.html

; [[word2x]]
: http://word2x.sourceforge.net/

; [[wvWare]]
: http://wvware.sourceforge.net/
: Extracts metadata from various [[Microsoft]] Word files ([[doc]]). Can also convert doc files to other formats such as HTML or plain text.

; [[Outside In]]
: http://www.oracle.com/technology/products/content-management/oit/oit_all.html
: Originally developed by Stellant, supports hundreds of file types.

; [[FI Tools]]
: http://forensicinnovations.com/
: More than 100 file types.

=PDF Files=

; [[xpdf]]
: http://www.foolabs.com/xpdf/
: [[pdfinfo]] (part of the [[xpdf]] package) displays some metadata of [[PDF]] files.

(See [[PDF]])

=Images=

; [[jhead]]
: http://www.sentex.net/~mwandel/jhead/
: Displays or modifies [[Exif]] data in [[JPEG]] files.

; [[vinetto]]
: http://vinetto.sourceforge.net/
: Examines [[Thumbs.db]] files.

;[[libexif]]
: http://sourceforge.net/projects/libexif EXIF tag Parsing Library

; [[Adroit Photo Forensics]]
: http://digital-assembly.com/products/adroit-photo-forensics/
: Displays meta data and uses date and camera meta-data for grouping, timelines etc.

; Exif Viewer
: http://araskin.webs.com/exif/exif.html
: Add-on for Firefox and Thunderbird that displays various [[JPEG]]/JPG metadata in local and remote images.

=General=
These general-purpose programs frequently work when the special-purpose programs fail, but they generally provide less detailed information.

; [[Metadata Extraction Tool]]
: "Developed by the National Library of New Zealand to programmatically extract preservation metadata from a range of file formats like PDF documents, image files, sound files Microsoft office documents, and many others."
: http://meta-extractor.sourceforge.net/

; [[Metadata Assistant]]
: http://www.payneconsulting.com/products/metadataent/

; [[hachoir|hachoir-metadata]]
: Extraction tool, part of '''[[Hachoir]]''' project

; [[file]]
: The UNIX '''file''' program can extract some metadata

; [[GNU libextractor]]
: http://gnunet.org/libextractor/ The libextractor library is a plugable system for extracting metadata

; [[Directory Lister Pro]]
: Directory Lister Pro is a Windows tool which creates listings of files from selected directories on hard disks, CD-ROMs, DVD-ROMs, floppies, USB storages and network shares. Listing can be in HTML, text or CSV format (for easy import to Excel). Listing can contain standard file information like file name, extension, type, owner and date created, but especially for forensic analysis file meta data can be extracted from various formats: 1) executable file information (EXE, DLL, OCX) like file version, description, company, product name. 2) multimedia properties (MP3, AVI, WAV, JPG, GIF, BMP, MKV, MKA, MPEG) like track, title, artist, album, genre, video format, bits per pixel, frames per second, audio format, bits per channel. 3) Microsoft Office files (DOC, DOCX, XLS, XLSX, PPT, PPTX) like document title, author, keywords, word count. For each file and folder it is also possible to obtain its CRC32, MD5, SHA-1 and Whirlpool hash sum. Extensive number of options allows to completely customize the visual look of the output. Filter on file name, date, size or attributes can be applied so it is possible to limit the files listed.
: http://www.krksoft.com

[[Category:Tools]]

Document Metadata Extraction

2010-04-09T12:28:20Z

Hypertex: /* Images */

Here are tools that will extract metadata from document files.

=Office Files=

; [[antiword]]
: http://www.winfield.demon.nl/

; [[catdoc]]
: http://www.45.free.net/~vitus/software/catdoc/

; [[laola]]
: http://user.cs.tu-berlin.de/~schwartz/pmh/index.html

; [[word2x]]
: http://word2x.sourceforge.net/

; [[wvWare]]
: http://wvware.sourceforge.net/
: Extracts metadata from various [[Microsoft]] Word files ([[doc]]). Can also convert doc files to other formats such as HTML or plain text.

; [[Outside In]]
: http://www.oracle.com/technology/products/content-management/oit/oit_all.html
: Originally developed by Stellant, supports hundreds of file types.

; [[FI Tools]]
: http://forensicinnovations.com/
: More than 100 file types.

=PDF Files=

; [[xpdf]]
: http://www.foolabs.com/xpdf/
: [[pdfinfo]] (part of the [[xpdf]] package) displays some metadata of [[PDF]] files.

(See [[PDF]])

=Images=

; [[jhead]]
: http://www.sentex.net/~mwandel/jhead/
: Displays or modifies [[Exif]] data in [[JPEG]] files.

; [[vinetto]]
: http://vinetto.sourceforge.net/
: Examines [[Thumbs.db]] files.

;[[libexif]]
: http://sourceforge.net/projects/libexif EXIF tag Parsing Library

; [[Adroit Photo Forensics]]
: http://digital-assembly.com/products/adroit-photo-forensics/
: Displays meta data and uses date and camera meta-data for grouping, timelines etc.

; Exif Viewer
: http://araskin.webs.com/exif/exif.html
: Add-on for Firefox and Thunderbird that displays various JPEG/JPG metadata in local and remote images.

=General=
These general-purpose programs frequently work when the special-purpose programs fail, but they generally provide less detailed information.

; [[Metadata Extraction Tool]]
: "Developed by the National Library of New Zealand to programmatically extract preservation metadata from a range of file formats like PDF documents, image files, sound files Microsoft office documents, and many others."
: http://meta-extractor.sourceforge.net/

; [[Metadata Assistant]]
: http://www.payneconsulting.com/products/metadataent/

; [[hachoir|hachoir-metadata]]
: Extraction tool, part of '''[[Hachoir]]''' project

; [[file]]
: The UNIX '''file''' program can extract some metadata

; [[GNU libextractor]]
: http://gnunet.org/libextractor/ The libextractor library is a plugable system for extracting metadata

; [[Directory Lister Pro]]
: Directory Lister Pro is a Windows tool which creates listings of files from selected directories on hard disks, CD-ROMs, DVD-ROMs, floppies, USB storages and network shares. Listing can be in HTML, text or CSV format (for easy import to Excel). Listing can contain standard file information like file name, extension, type, owner and date created, but especially for forensic analysis file meta data can be extracted from various formats: 1) executable file information (EXE, DLL, OCX) like file version, description, company, product name. 2) multimedia properties (MP3, AVI, WAV, JPG, GIF, BMP, MKV, MKA, MPEG) like track, title, artist, album, genre, video format, bits per pixel, frames per second, audio format, bits per channel. 3) Microsoft Office files (DOC, DOCX, XLS, XLSX, PPT, PPTX) like document title, author, keywords, word count. For each file and folder it is also possible to obtain its CRC32, MD5, SHA-1 and Whirlpool hash sum. Extensive number of options allows to completely customize the visual look of the output. Filter on file name, date, size or attributes can be applied so it is possible to limit the files listed.
: http://www.krksoft.com

[[Category:Tools]]

Libexif

2010-04-08T18:16:41Z

Hypertex: Created page; added basic info, a few examples and links

{{Infobox_Software |
name = Xpdf |
maintainer = Mueller, Patera, Ulrich, Figuiere |
os = Posix, Win32 |
genre = [[Document Metadata Extraction]] |
license = {{LGPL}} |
website = [http://libexif.sourceforge.net/ libexif.sourceforge.net/] |
}}

'''libexif''' is an [[open source]] library for reading and editing [[Exif]] metadata, commonly found in digital pictures. It is written in C and released under the [[LGPL]]. The library runs under GNU/Linux, BSD, Mac OS X, and Win32. The library is developed by the "libexif project." The project also includes command-line and graphical front-ends.

==Examples==

The use of the command-line front end is typical of many Unix or Linux commands.
exif example.jpg

This command will write all tags and values contained in the file to standard output. It will also indicate if the file contains an embedded thumbnail.

Other common options for the exif command:

* -e extracts the thumbnail. You can use the --output option to a specified file
* -r removed the thumbnail from the image. Will write a new image. You can specify the file with the --output option
* -l lists all known tags
* --remove removes a specified tag or entire IFD (Image File Directory) is no tag is given

==External Links==

* [http://libexif.sourceforge.net/docs.html libexif project documentation]
* [http://libexif.sourceforge.net/man/exif.html man page for exif command line tool]

Hachoir

2010-04-07T18:16:51Z

Hypertex: updated website; updated release info

{{Infobox_Software |
name = Hachoir |
maintainer = Victor Stinner |
os = {{Cross-platform}} |
genre = {{Analysis}} |
license = {{GPL}} |
website = [http://bitbucket.org/haypo/hachoir/wiki/Home] |
}}

'''Hachoir''' is a generic framework for binary file manipulation. Written in Python, it's operating system independent and has many text/graphic user interfaces (ncurses, wxWidget, Gtk+). Although it contains a few functions to modify files, it is generally intended for examining existing files. Hachoir currently supports more than sixty file formats. File format recognition is based on the headers and footers in a disk image of file. It has a fault tolerant parser designed to handle truncated or buggy files. The framework also automatically adjusts for endian or character set issues. The framework can be scripted and extended.

The package includes several sample programs based on the core framework and parser:

* hachoir-metadata: extract metadata
* hachoir-strip: remove metadata and other "useless" informations
* hachoir-grep: find substring in a binary file (using hachoir parsers: so search is Unicode aware)
* hachoir-subfile: find all subfiles in a file

The current version of hachoir-core is 1.3.4 and was released in February 2010. Precompiled packages are available for the Debian, Gentoo, Mandriva, and Arch [[Linux]] distributions along with FreeBSD'''.

== External Links ==

* [http://bitbucket.org/haypo/hachoir/wiki/Home/ Official website]

[[Category:Metadata]]
[[Category:Windows]]
[[Category:Linux]]
[[Category:FreeBSD]]

Hachoir

2010-04-07T18:07:57Z

Hypertex: /* External Links */

{{Infobox_Software |
name = Hachoir |
maintainer = Victor Stinner |
os = {{Cross-platform}} |
genre = {{Analysis}} |
license = {{GPL}} |
website = [http://hachoir.org/ hachoir.org] |
}}

'''Hachoir''' is a generic framework for binary file manipulation. Written in Python, it's operating system independent and has many text/graphic user interfaces (ncurses, wxWidget, Gtk+). Although it contains a few functions to modify files, it is generally intended for examining existing files. Hachoir currently supports more than sixty file formats. File format recognition is based on the headers and footers in a disk image of file. It has a fault tolerant parser designed to handle truncated or buggy files. The framework also automatically adjusts for endian or character set issues. The framework can be scripted and extended.

The package includes several sample programs based on the core framework and parser:

* hachoir-metadata: extract metadata
* hachoir-strip: remove metadata and other "useless" informations
* hachoir-grep: find substring in a binary file (using hachoir parsers: so search is Unicode aware)
* hachoir-subfile: find all subfiles in a file

The current version is 1.2 and was released on September 2008. Precompiled packages are available for the Debian, Gentoo, Mandriva, and Arch [[Linux]] distributions along with FreeBSD'''.

== External Links ==

* [http://bitbucket.org/haypo/hachoir/wiki/Home/ Official website]

[[Category:Metadata]]
[[Category:Windows]]
[[Category:Linux]]
[[Category:FreeBSD]]