Free Download

Inspect File Metadata Without ExifTool's Command Line. Free.

Sherlock Forensics Metadata Inspector reads ten format families, states where an image came from and accounts for every byte of the file. It reasons from what the file records, and it shows its reasoning.

Sherlock Forensics Metadata Inspector is a free Windows and Linux tool that reads ten format families and states where an image came from, from camera original to screen capture, listing the findings behind every verdict. It recovers prior metadata, encoder fingerprints that survive a metadata wipe and embedded content a tag list never shows.

Compare to ExifTool

Linux requires: libgtk-3, libfontconfig1, libxkbcommon. See install instructions.

Provenance

Every image gets a provenance assessment

The headline is a stated conclusion, not a tag dump. Each image is assessed as one of camera original, camera processed, screen capture, no camera evidence or no metadata, and every verdict lists the findings it rests on. The rule is simple and defensible: a camera recording an original photograph writes the exposure it made, the aperture, shutter, ISO, focal length and lens. A screenshot, a re-encode or a wiped file records none of it. You see the reasoning, never just the label.

One line we hold to, because it is the easiest thing here to over-read: "no camera evidence" and "no metadata" are statements about what the file does not contain, not accusations. They are what an ordinary screenshot looks like too. The assessment reports the absence and the reasoning behind it. It does not call a file fake, edited or fabricated on the strength of what is missing.

Format Detection

It reads the format, not the file name

The correct reader is chosen by file signature, not by extension, so a file whose name has been changed to hide what it is gets read as what it actually is, and the mismatch is reported as a finding. In testing this surfaced an AVIF file wearing a .jpg name. Ten format families are covered:

  • JPEG
  • PNG
  • HEIF, including HEIC and AVIF
  • TIFF
  • Camera raw: DNG, CR2, NEF, ARW, ORF, RW2
  • WebP
  • MP4 and MOV
  • OOXML Office: DOCX, XLSX, PPTX
  • Legacy Office: DOC, XLS, PPT, MSG
  • PDF

A family is a container structure and the variants built on it, which is why HEIC and AVIF sit under HEIF and why the raw formats are one line.

Encoder Fingerprints

What survives a metadata wipe

Stripping the tags does not strip the evidence. Three properties identify the writing software even when every tag is gone, because the image cannot be decoded without them:

  • Quantization tables, stock library tables at a recoverable quality or custom ones
  • Huffman tables, standard specification tables or ones computed for the image
  • Container structure, the segment order, field types and entry ordering

These are measurements. The tool reports the fingerprint it observed and, where reference files exist, what that value has been seen on. It does not put a brand name on a file it cannot prove wrote it. In a corpus of roughly 6,000 files, one Huffman fingerprint turned up across an iPhone, an iPhone 5 and a Google Nexus 10, so a fingerprint-to-product claim would be wrong across manufacturers.

See how quantization fingerprints identify the writer after a metadata wipe.

Beyond the Tag List

What a tag list never shows you

  • Prior metadata left inside the file when a writer extended an EXIF block in place, recovered and read. An orphaned block is not tampering on its own. The tool compares it against the live values and only flags a conflict when the two disagree
  • Embedded video carried by a motion photo, where a viewer shows only the still, extractable from the toolbar
  • Prior PDF revisions, because a PDF is saved by appending, so earlier versions are still in the file to carve out
  • AI generation, read from C2PA Content Credentials including the IPTC trainedAlgorithmicMedia declaration. Content Credentials are reported as what the file declares about itself, not as a verified signature, and their absence proves nothing because the manifest strips out trivially
  • Deleted stream names in legacy Office documents
  • Thumbnail mismatch, the embedded preview compared against the image it claims to represent. See why a matching thumbnail is not a clean bill of health
  • The Android device model, decoded out of the Software tag

Output

Output built for a report

A court-ready HTML report that prints to PDF, with JSON and CSV alongside it. Batch folder mode gives one summary row per file. File comparison states the relationship between two files, most usefully "same image, different metadata," which is exactly what a stripped copy passed off as a new file looks like.

Compare

Cost Comparison

SolutionPriceInterfaceNotes
ExifTool (Phil Harvey)FreeCLI onlyDefinitive metadata library, no GUI, no court-ready report
Metashield Protector$199+ / yearGUI (Windows)Annual subscription, narrower format coverage
Online metadata viewersFree (with upload)Browser (upload required)Sends sensitive files to a third-party server
Sherlock Forensics Metadata InspectorFreeDesktop GUI + browser versionImages and Office documents. Local processing. Strips metadata. CSV export.

Why a GUI Matters in Forensic Work

ExifTool is the gold standard library and Sherlock Forensics Metadata Inspector uses the same parsing approach. The difference is the workflow. Forensic examiners, legal staff and HR investigators often do not work from a command line. They need a tool that displays metadata in a readable layout, supports batch processing without scripting and exports findings to CSV for inclusion in case files. Sherlock Forensics Metadata Inspector packages that workflow into a single executable on Windows and Linux. The browser-based viewer at sherlockforensics.com/pages/metadata-viewer.html processes files entirely client-side so sensitive evidence never leaves the examiner workstation.

Privacy

The Hidden Risks of File Metadata

Every file you create or share carries invisible data that can expose sensitive information. Most users are unaware of what their files reveal to anyone who knows where to look.

EXIF GPS Data in Photos

Smartphone cameras embed GPS coordinates in every photo by default. A single image posted online can reveal your home address, your child's school location or the exact position of a secure facility. Stalkers, burglars and social engineers exploit this data routinely. The SANS Institute documents these risks in their digital forensics curriculum (sans.org).

Office Document Metadata

Legal documents frequently contain the author's full name, organization, computer username and complete revision history. Law firms have inadvertently disclosed privileged information through document metadata in court filings. The metadata may reveal who drafted a document, how many revisions occurred and what software was used.

Forensic Value of Metadata

In forensic investigations, metadata is evidence. EXIF timestamps establish when a photo was taken. GPS coordinates place a subject at a specific location. Document revision history reveals editing patterns. Camera serial numbers link photos across cases. Sherlock Forensics Metadata Inspector extracts all of this data for forensic analysis or removes it for privacy protection.

Use Cases

Who Uses Sherlock Forensics Metadata Inspector

Forensic Analysis

Extract EXIF data from evidence photos to establish location, time and device. Identify camera serial numbers across image sets. Document metadata findings for forensic investigation reports as a chain of custody contribution.

Privacy Protection

Strip GPS coordinates, author names and edit history from files before sharing publicly. Protect personal safety by removing location data from photos posted to social media or sent to untrusted parties.

Legal / Litigation Support

Inspect court filings, exhibits and produced documents for unintended metadata exposure before service. Identify author names, organization, computer username, revision counts and hidden comments that have privileged or work-product implications. Litigation support teams use the CSV export to log metadata findings across discovery sets for review. Pair with our expert witness services when metadata becomes the evidence.

OSINT Investigations

Extract metadata from publicly available images and documents during open source intelligence gathering. Camera serial numbers, GPS coordinates and timestamps provide investigative leads that are invisible to casual observers.

Corporate Compliance

Enforce metadata stripping policies before external document distribution. Prevent employee names, internal network paths and software versions from leaking through shared files. Audit documents for compliance with data protection regulations.

Journalism

Strip metadata from source documents and whistleblower materials to protect identities. Verify the authenticity of submitted photos by examining EXIF data for consistency with claimed circumstances.

On the Limits

On the limits, plainly

A forensic tool earns trust by what it refuses to claim. Encoder fingerprints are measurements, not brand names, and we report them that way. Content Credentials are what a file says about itself, not proof. And error level analysis, the bright-pixel picture you have seen used to "prove" tampering, is not a manipulation detector. In Metadata Inspector it is gated behind an acknowledgement, kept out of the provenance assessment entirely and its output is labelled NOT EVIDENCE, because an examiner is better served by the caveat than by a confident wrong answer. Read why error level analysis is not evidence.

Download

Get Sherlock Forensics Metadata Inspector

Version 0.2.0 for Windows 10/11 (64-bit). Single executable with no dependencies.

File
sherlock-metadata-inspector-0.2.0.exe
SHA256
d251ae7e745ab32ab66562ebf783b59d82fa8bdf1216bf4a3b4f0067fb083a98
Version
0.2.0
Platform
Windows 10/11 (64-bit), Linux x64
Use Web Version

Questions

Metadata Inspector FAQ

What is file metadata?
File metadata is information embedded within a file that describes its properties beyond the visible content. Photos contain EXIF data including camera model, GPS coordinates and timestamps. Office documents store author, organization, revision count and total editing time.
Can photos reveal my location?
Yes. Most smartphone cameras embed GPS coordinates in photo EXIF data by default. These coordinates pinpoint exactly where the photo was taken. Sharing photos online without stripping EXIF data can reveal your home address, workplace or other sensitive locations. Sherlock Forensics Metadata Inspector displays and strips GPS data before sharing.
Where does Sherlock handle PDF metadata?
PDF metadata extraction is handled by Sherlock Forensics PDF Viewer + Editor. For PDF metadata workflows, see the PDF Editor.
Is Sherlock Forensics Metadata Inspector free?
Yes. Sherlock Forensics Metadata Inspector is completely free with no trial period and no feature restrictions. Both viewing and stripping metadata are available at no cost for all supported file types.
What file types are supported?
Sherlock Forensics Metadata Inspector reads ten format families: JPEG, PNG, HEIF (HEIC and AVIF), TIFF, camera raw (DNG, CR2, NEF, ARW, ORF, RW2), WebP, MP4 and MOV, OOXML Office (DOCX, XLSX, PPTX), legacy Office (DOC, XLS, PPT, MSG) and PDF. The correct reader is chosen by file signature, not by extension.
Does stripping metadata modify the original file?
Sherlock Forensics Metadata Inspector creates a clean copy with metadata removed. The original file is preserved unchanged. For forensic work, always hash the original before any processing to maintain chain of custody.
Is there a web-based version?
Yes. Sherlock Forensics offers a browser-based metadata viewer at sherlockforensics.com/pages/metadata-viewer.html that extracts EXIF data entirely in your browser with no file uploads. The desktop version adds metadata stripping, batch processing and support for Office formats.
Does Sherlock Forensics Metadata Inspector work on Linux?
Yes. Sherlock Forensics Metadata Inspector is available as a native Linux x64 binary. Download the .tar.gz archive, extract and run. Requires libgtk-3, libfontconfig1 and libxkbcommon.
Are metadata findings from this tool admissible in court?
Yes when paired with proper procedure. Sherlock Forensics Metadata Inspector uses the same parsing approach as ExifTool, the de facto reference library for EXIF and document metadata. Findings can be exported to CSV alongside the original file hashes for inclusion in forensic reports. The tool is built by CISSP, ISSAP and ISSMP certified examiners with 20 years of Canadian courtroom experience. Always hash the original file before any processing to maintain chain of custody.
Are my files sent anywhere when I use Sherlock Forensics Metadata Inspector?
No. The desktop version processes all files locally. No telemetry, no cloud upload, no phone-home. The browser-based viewer at sherlockforensics.com/pages/metadata-viewer.html parses files entirely client-side in your browser with no file upload. Sensitive evidence and privileged documents never leave your workstation.
Is Sherlock Forensics Metadata Inspector an EXIF viewer?
Yes. Sherlock Forensics Metadata Inspector is a full EXIF viewer for JPEG, TIFF, HEIF and RAW image formats. As an EXIF viewer it surfaces camera make and model, exposure settings, lens identification, capture timestamps and GPS metadata coordinates. It also reads IPTC and XMP layers alongside EXIF and Word document metadata, Excel and PowerPoint metadata on the document side. For users who need a GUI EXIF viewer without the ExifTool command-line learning curve, this is the practical fit.
Is Sherlock Forensics Metadata Inspector an ExifTool alternative?
Yes, for the GUI-on-Windows buyer. ExifTool is the dominant open-source command-line metadata extraction tool written in Perl; it reads more rare formats than any commercial alternative. Sherlock is an ExifTool alternative for the GUI buyer who wants metadata extraction without Perl installation, command-line flag memorization or scripting around CLI output. The ExifTool alternative argument is workflow-fit: rare-format breadth wins ExifTool, GUI workflow + audit-trail output wins Sherlock. Pick by use case.
Can I extract GPS coordinates from photos with Sherlock Forensics Metadata Inspector?
Yes. GPS metadata extraction is a primary EXIF viewer feature. Sherlock surfaces GPS latitude, longitude, altitude, GPS timestamp and GPS direction from the EXIF GPS subgroup in decimal-degrees and the source-EXIF representation. GPS metadata extraction supports geolocation forensics workflows: where-and-when reconstruction for civil litigation, photo evidence chain of custody, internal investigation photo evidence. Map-plotting tools and review platforms ingest the decimal-degrees output directly.
What is forensic metadata and why does it matter for evidence?
Forensic metadata is the metadata baseline captured at first-contact with digital evidence (image, document, PDF, file) so any post-acquisition modifications are detectable. Forensic metadata work matters because defense experts routinely challenge digital-evidence integrity by pointing to metadata inconsistencies. Capturing the forensic metadata baseline at acquisition (EXIF state, file modification timestamps, document author and revision history) contributes to the chain of custody record. Sherlock Forensics Metadata Inspector handles the capture side; for the full court-ready forensic posture pair with our PDF Editor for PDF metadata workflows and our OCR Reader for scanned-document metadata work.
Can Sherlock detect photo or document tampering via metadata?
Sherlock surfaces the metadata signals that indicate tampering. Common tampering signals: photo modification timestamp earlier than capture timestamp, EXIF GPS metadata stripped while other EXIF fields intact (selective removal), Word document metadata with revision count higher than visible page count. The EXIF viewer and Word document metadata coverage gives the examiner the surface to identify these signals. Sherlock provides the metadata findings, the examiner interprets the tampering signals; for the photo forensics deep dive the EXIF viewer baseline is the starting point.
Does Sherlock Forensics Metadata Inspector strip metadata from documents for privacy?
Yes. The metadata stripper workflow is built in. The metadata stripper removes EXIF from images and document properties from Office files (Word document metadata, Excel metadata, PowerPoint metadata authorship + revision data). The metadata stripper preserves the original file unmodified and writes a stripped copy, so the original chain of custody for forensic work stays intact while the privacy-cleaned version is what gets published. This metadata stripper workflow covers GDPR, HIPAA, FERPA and SOX privacy auditing use cases on documents and images leaving the organization.

Related Sherlock Tool

Sherlock Forensics iPhone and iPad Analyzer at $599 one-time handles iOS logical acquisition alongside the sibling Sherlock tools. Logical MobileBackup2 acquisition with RFC 3394 keybag decryption, iMessage and SMS chat.db reconstruction with attribution timeline, WhatsApp and Signal conversations, photo library with EXIF and geotag artifacts, browser history and application data. Windows 10/11. Court-ready chain of custody documentation.

See Sherlock Forensics iPhone and iPad Analyzer

Get Started

Inspect and Protect Your File Metadata

Free metadata viewer and stripper for forensic professionals, privacy-conscious users and legal teams. Built by the same team that delivers expert witness testimony in Canadian courts.

Since 2006CISSP, ISSAP, ISSMP certified888.883.4550
Use Web Version

Linux requires: libgtk-3, libfontconfig1, libxkbcommon. See install instructions.

Sherlock Forensics Metadata Inspector is provided for lawful use. Terms of Service

Download

Your email is optional. If you provide it, we send 3 product introduction emails over the next 2 weeks. No long-term marketing. No data sharing. Skip the field and download directly.

While you are here, make us your preferred source in Google:

Sherlock Forensics Metadata Inspector - Free