Image and geolocation OSINT basics

A photo carries more than what it shows. Its metadata can hold the camera, the time and sometimes GPS. The image itself holds clues: signs, architecture, the angle of the sun, a licence plate. Image and geolocation OSINT reads both. For a scope you own, that means a product photo on your own site, a leaked internal screenshot, or an image a program marked in scope. You do not geolocate private people for sport. You work the images your scope covers.

#Read the metadata

exiftool dumps every tag an image carries, grouped by family.

exiftool -a -G1 photo.jpg

Filter to the fields that matter, such as GPS coordinates and timestamps.

exiftool -gpslatitude -gpslongitude -createdate photo.jpg

Most images posted to social platforms have had this stripped on upload, so metadata pays off most on files you got directly: an email attachment, a document, a file server. A GPS tag is a shortcut, but its absence proves nothing.

#Reverse image search

If the photo appeared elsewhere, reverse search finds it. Run the same image through more than one engine, because they index different corners of the web. Google Lens, Bing Visual Search, Yandex and TinEye each catch what the others miss. Yandex is strong on places and faces, and TinEye is strong on exact copies and first-seen dates, so a first-seen date can anchor when an image entered circulation.

Keep the full frame and a tight crop around any unique detail, and search both. A logo, a shopfront or a distinctive roofline often matches when the whole scene does not, and the reverse engines rank crops differently from the full image. Save the first result page from each engine so you can compare later without re-running the search. Note the date and the engine next to each hit, the same as you would for any other source.

#Geolocate from the picture

When there is no metadata, the image is the evidence. Work it in order: read the text first, then identify the architecture and vegetation, then place the sun. The sun's position with a timestamp gives you a direction and a rough latitude, and SunCalc models it. Cross-check candidate spots on OpenStreetMap and street-level imagery, and the Bellingcat toolkit lists tools for each step.

#Reason through it with the chat

Paste your observations, not the image, into the NotHoly chat and let it reason over the clues.

From one photo I can read: a sign in Portuguese, a tram line,
mountains to the north, late-afternoon shadows pointing east,
licence plate format AA-00-AA. Give me candidate regions and
the next three checks to narrow it. Rank by confidence.

The model reasons over the clues you describe and proposes regions and next checks. It cannot see the image or search for it, so it is a thinking partner, not a lookup. You confirm every candidate on a map yourself.

#Scope and privacy

Geolocation is powerful and easy to misuse. Keep it to images in your scope, avoid publishing anyone's personal metadata, and never locate a private individual's home or movements. When you remove metadata from your own images before sharing, mat2 does it cleanly. Treat faces and plates in a found image as personal data, and blur them in anything you pass on.

#Frequently asked questions

#Do photos still contain GPS?

Sometimes. Phones embed it when location is on, but major platforms strip it on upload. Files shared directly, by email or on a file server, often keep it, which is why you check rather than assume.

#Which reverse-search engine is best?

None alone. Yandex is strong on places and faces, TinEye on exact matches and dates, Google and Bing on broad coverage. Run the image through several and compare.

Images close out the collection sources. Now bring it together and organise everything in organising OSINT findings. Back to people and company OSINT basics.