Forensicon Tutorial and Walkthrough
Extracting GPS metadata from Mac OSX Terminal Command Line using MDLS command
Forensicon’s President, Lee Neubecker provides an overview of how anyone can use the Macintosh OSX terminal native command line to extract embedded metadata contained within photos or videos. The “mdls” command extracts the following fields from photos where such information exists. Smart phones having location services turned on will often include the GPS data, including, longitude, latitude, and altitude.
Sample iPhone 5 Smartphone Embedded Metadata within JPG Photos
List of fields extracted from the command: mdls <targetfilename>, or in this case: mdls IMG_0001.JPG <carriage return>
|Field Name||Sample output from iPhone|
|kMDItemContentCreationDate||2013-12-23 19:01:40 +0000|
|kMDItemContentModificationDate||2013-12-23 19:01:40 +0000|
|kMDItemContentTypeTree||(“public.jpeg”, “public.image”, “public.data”,”public.item”, “public.content”)|
|kMDItemDateAdded||2014-11-11 15:18:32 +0000|
|kMDItemFSContentChangeDate||2013-12-23 19:01:40 +0000|
|kMDItemFSCreationDate||2013-12-23 19:01:40 +0000|
|kMDItemLastUsedDate||2014-11-11 15:35:37 +0000|
|kMDItemUsedDates||“2014-11-11 06:00:00 +0000”|
- To perform the metadata analysis, the user must first copy the image to the Mac OSX.
- Then, launch the terminal program.
- After that, use the Change Directory command “cd” and the list commands “ls” to verify the terminal is in the same location as the photo filename copied.
- After that, the user simply types the command: mdls <filename.ext> which will output the file’s metadata contents similar to that above and as shown in the video tutorial.
- This information can be useful, especially if an inappropriate photo was taken on a smartphone, or if someone is harassing a person via social media smartphone applications.
- Staff Recognized for Departing Employee Investigations - The first issue of Corporate Counsel Business Journal, CCBJ, includes an interview with our Director of Digital Forensics, Yaniv Schiff, and Solutions Architect, Curtis Collette, on the evolution of departing employee investigations. Departing Employee: When Do Investigations Become Necessary? appeared in the print publication, online edition, and on CCBJ’s In-House Tech website. For Increasing Numbers of Employers, Departing Employee Investigations[...Read More]
- Chicago Office Food Drive – The Results Are In - QDiscovery’s Chicago Office collected nearly 1,000 containers of food for the local food bank this Holiday Season! Our office competed with sister offices in Indiana and Connecticut. Alas, we came in third. Our sister offices each collected nearly 2,000 containers for their local food banks. Relatively new to the company-wide food drive, the Forensics Division[...Read More]
- QDiscovery Forensics Team Develops Award Winning App! - QDiscovery is winner of a 2017 Relativity Innovation Award. Presented at Relativity Fest, the award celebrates organizations that create apps or integrations that extend the functionality of Relativity’s eDiscovery software. Our development team created an application that makes the analysis of mobile collections much more manageable. Relativity users can now produce and review mobile device data[...Read More]
- Moving and Changing - Acquired by Connecticut-based QDiscovery in 2016, Forensicon’s capabilities multiplied overnight, both in forensics brain power and eDiscovery expertise. As part of a leading provider of end to end litigation support, moving to larger offices that are more central to the Chicago legal community was inevitable.
- QDiscovery Named One of the Top 20 Providers of Legal Services! - Leading industry publication, CIO Magazine, has named Forensicon’s parent company, QDiscovery, to it’s Top 20 Providers of Legal Services. The annual listing includes 20 companies that are at the forefront of providing legal solutions and impacting the marketplace. Read the whole article here. Featured in the publication alongside QDiscovery President, Dave Barrett, is Director of Digital Forensics, Yaniv[...Read More]