Lesson 4.3
Image Analysis & Geolocation
Learning Objectives
- After this, students can run a reverse image search across multiple engines and interpret the results.
- After this, students can extract and read EXIF metadata with
exiftool, including GPS coordinates. - After this, students can geolocate a photo by reasoning from visual clues and confirm it with mapping tools.
- After this, students can estimate when a photo was taken (chronolocation) using shadows and SunCalc, and verify their answer.
The Four Questions of an Image
Every photo can be interrogated with four questions:
- Where did this come from? (reverse image search — has it appeared elsewhere?)
- What does the file itself say? (metadata — EXIF)
- Where was it taken? (geolocation)
- When was it taken? (chronolocation)
You do not always get all four, and you should never trust just one. Metadata can be stripped or forged; a reverse search can mislead; a visual guess can be wrong. Strong image analysis triangulates — the where you reason from a street sign should agree with the GPS in the EXIF and the shadow direction. Verification is the whole subject of Module 7; keep it in mind throughout.
Reverse Image Search
Reverse image search asks an engine “where else does this image, or something like it, appear?” It answers questions like: is this profile photo stolen from a stock site (a fake account)? where was this “breaking news” photo actually first published? what product/building/landmark is this?
No single engine wins, so run several — they use different matching and index different regions:
- Google Lens / Google Images — strongest for objects, products, landmarks, and text in the image.
- Yandex Images — widely regarded as the best for faces and for places in Eastern Europe and Central Asia; often finds matches others miss.
- Bing Visual Search — a genuinely separate index; good for a second opinion.
- TinEye — specializes in finding exact copies and edits of an image and where it has appeared, and can sort results (including by oldest, to find the earliest appearance — verify the exact sort labels in class, TinEye adjusts its UI). Excellent for “where did this originate?”
Workflow tips:
- Crop before you search. Isolate the distinctive part (a logo, a sign, a building) and search that; the full image often carries too much noise.
- Try the image and crops of it across engines — results differ dramatically.
- Follow the oldest copy. For provenance (“is this really from last week?”), the earliest-dated appearance matters more than the most popular one.
- Faces: face-matching engines exist (e.g. PimEyes) but raise serious privacy and legal issues and are out of scope for class labs — mention for awareness only, per Module 2.
EXIF Metadata with exiftool
Digital photos embed EXIF (Exchangeable Image File Format) metadata: camera or phone model, timestamps, exposure settings, editing software, and — critically — GPS coordinates if location services were on. exiftool (by Phil Harvey) is the standard cross-platform tool for reading it.
Important caveat first: most large social platforms (Instagram, Facebook, X, TikTok) strip EXIF on upload, so a photo pulled from a social feed usually has no GPS left. Original files still carry it — images on personal websites, forums, file shares, email attachments, and messaging apps that send “as a file” rather than “as a photo.” That gap is exactly what makes finding an original worthwhile.
Read all metadata:
exiftool photo.jpg
Group the output by category so it’s readable:
exiftool -G photo.jpg
Pull just the GPS tags:
exiftool -gpslatitude -gpslongitude -gpsposition photo.jpg
Get coordinates as plain decimal degrees you can paste into a map (-n disables the pretty formatting; -c sets a coordinate format):
exiftool -n -gpslatitude -gpslongitude photo.jpg
exiftool -c "%.6f" -gpsposition photo.jpg
Process an entire folder, recursively, into a spreadsheet:
exiftool -r -csv -gpslatitude -gpslongitude -createdate ./photos/ > photos.csv
Show duplicate and unknown tags (occasionally hides useful data):
exiftool -a -u -G photo.jpg
If GPS is present, exiftool may also give you a ready-made maps link (GPS Position), or you can drop the decimal coordinates straight into OpenStreetMap or Google Maps.
Defender note: the flip side is sanitizing your own images. exiftool -all= photo.jpg strips metadata (it keeps a photo.jpg_original backup by default; add -overwrite_original to skip the backup). This belongs to the defensive discussion in Module 9, and the same command reappears in 4.4-document-metadata.md for documents.
Geolocation Methodology
When there is no GPS in the file, you geolocate by reasoning from what’s visible. This is a craft; the method is what matters:
- Inventory the clues. List everything identifying in the frame: text/signs (and their language and alphabet), business names, road markings and sign styles (they vary by country), architecture, vehicles and license-plate colors, vegetation and terrain, the sun’s position, power/utility poles, flags.
- Establish the big region first. Use the strongest clues (language, plate style, driving side, architecture, climate) to narrow to a country or region before you hunt for the exact spot. Don’t start by guessing the street.
- Search the specifics. Feed business names, phone-number formats, or unusual signs into a search engine. A single readable storefront name often collapses the search instantly.
- Confirm on the map. Move to satellite and street-level imagery (Google Street View and its historical dates, Bing Streetside, Apple Look Around, Mapillary’s crowdsourced imagery, Yandex Maps for Russia). Match roof shapes, road layout, and landmarks from above and at street level.
- Query the map data directly when you can describe the relationship between features but not the place. OpenStreetMap’s Overpass Turbo (overpass-turbo.eu) lets you search for combinations of mapped features. Example — find a place of worship within 100 m of a fuel station inside a bounding box:
[out:json][timeout:25]; nwr["amenity"="place_of_worship"]({{bbox}})->.worship; nwr["amenity"="fuel"](around.worship:100)->.fuel; nwr.worship(around.fuel:100); out center;
Overpass Turbo’s{{bbox}}shortcut inserts your current map view automatically, and its query wizard turns plain phrases (“restaurant”) into tag filters (amenity=restaurant) if you don’t know the tag names.
Satellite imagery (Google Earth Pro, with its historical-imagery slider, and the free Copernicus Browser for Sentinel imagery) helps confirm large features and how a site changed over time.
Chronolocation: Estimating When
Sometimes you need the time, not just the place — to confirm a photo really is “from today” or to place an event on a timeline. Two independent signals help:
- Shadows. A shadow’s direction points away from the sun, and its length depends on the sun’s altitude. Given a known location and date, the shadow tells you the approximate time; given a known time, an impossible shadow tells you the photo is misdated or misplaced.
- SunCalc (suncalc.org) models exactly this. It shows the sun’s path for any location and date, the sunrise/culmination/sunset times, and can compute shadow length for an object of a given height. Drag its time slider until the modeled sun direction matches the shadows in the photo — that time is your estimate.
Cross-check with weather. Historical weather records (e.g. Weather Underground) tell you whether the clear sky or fresh snow in the photo matches the claimed date. Agreement across shadow, sun model, and weather is strong corroboration; a contradiction is a red flag.
Verifying Your Answer
A geolocation is a hypothesis until it survives independent checks. Before you commit an answer to a report:
- Do at least two independent lines agree? (e.g. a readable sign found via search and a Street View match of the building.)
- Does the EXIF GPS (if any) land where your visual reasoning did?
- Do the shadows/SunCalc time and the claimed time agree?
- Have you ruled out the obvious trap — a similar location elsewhere (a chain store looks the same in a hundred cities)?
State your confidence honestly (confirmed / likely / possible), exactly as Module 7 requires. A wrong geolocation presented as fact can send an investigation — or worse — to the wrong place or person.
Key Terms
- EXIF: metadata embedded in image files (camera, timestamps, settings, sometimes GPS).
- Reverse image search: finding where an image (or a match/edit of it) appears online.
- Geolocation: determining where a photo was taken.
- Chronolocation: determining when a photo was taken.
- Overpass Turbo: a web tool for querying OpenStreetMap data by combinations of features.
Key Takeaways
- Interrogate every image with four questions: where from, what’s in the file, where taken, when taken — and never trust just one.
- Social platforms strip EXIF; an original file is what still carries GPS.
exiftool -gpsposition photo.jpg(add-nfor plain decimals) pulls coordinates in seconds.- Geolocate by narrowing region first (language, plates, architecture), then confirm with satellite and street-level imagery.
- Overpass Turbo searches OpenStreetMap for relationships between features when you can’t name the place.
- Shadows + SunCalc estimate the time; weather records corroborate the date.
References
Free to use, copy, change and teach. Security For the Folks dedicates this course to the public domain under CC0 1.0 Universal: no permission or credit needed. Quoted material and the sources it links to belong to their own authors.