Releases

I’ve been relatively quiet for the last few months, and that’s because I’ve been working on a completely new tool for analysing images. This aims to be a much leaner, lightweight tool for those that just need to quickly analyse an image for obvious manipulation.

Get it here:

Windows: Image Interrogator v0.1 (hosted on Github)

The main features of Image Interrogator are as follows:

1. Error Level Analysis
2. Image adjustments (sharpening, contrast, edge detection etc.)
3. Basic Metadata Analysis
4. Completely offline.

There were a few reasons behind creating this tool;
First and foremost was that a number of customer verification and counter-fraud teams that I’ve worked with have expressed a need for a really quick tool to be able to do some basic (primarily visual) analysis before diving into the metadata/further checks. Their main tool seems to currently be Paint, so anything is an upgrade at that point.

Secondly, whilst there are some great online tools for conducting visual analysis methodologies like Error Level Analysis (a prime example being Forensically), it’s difficult to find offline tools that do the same thing. Using online tools can be risky, and (serious time) in Europe you need to make sure you have a data processing agreement with each online service you use to analyse images (https://gdpr.eu/what-is-data-processing-agreement/) so it’s important to have an offline option. This software doesn’t phone home at all, and feel free to block it in firewalls (as you should do with all software that doesn’t specifically need to use the internet!).

Finally, I’ve been using the fantastic Nuitka in creation of this tool – for those non-techy people, it basically just turns the code into a much faster, smaller program. Metadata Interrogator will be using this shortly to make it run faster (and a slightly smaller file size, much to the delight of those with 90’s HDs), but it’s a lot of work due to the third party libraries MI uses, so Image Interrogator is a way to get to grips with Nuitka before making the big change over.

As always, let me know your thoughts, comments, prophecies and predictions.

It’s been a while but here’s a new release!

I’ve added in a new passport MRZ resolver as it’s been quite a requested function – most of the ones available are online only and whilst I’m sure they don’t scrape any data, it’s always good to be careful.

IPTC and PDF metadata was a little bit lacking previously – it was getting the main fields but getting stuck on some of the (admittedly less useful) fields. It should gather it all now. I’ve also made MI a lot better at grabbing creation type dates (still be careful with this!)

v0.7 – Callahan

• Passport MRZ resolver. This is extremely alpha, but was requested by a few companies using MI as most tools for that are online.
• Formatting/display improvements.
• IPTC metadata now displays properly.
• All fields added/calculated by MI (and not part of the metadata) now start with a *
• MI tries harder to find a creation date – still be careful with this.
• More metadata from PDF files, and removed some useless values.
• ‘Select Folder’ now works again.

Get it here: https://github.com/globalcrimadmin/metadata/releases/download/v0.7/Metadata.Interrogator.v07.exe

This release is a particularly big one (like the last) and has some major changes in it. Firstly, I’m now using matplotlib for the analysis timeline, so it looks much, much better and allows for things like colour coding. Whilst it does bring with it a small performance drop, I’ll be using it for more analysis graphics in the future so I think it’s worth while. I’ve also made a lot of improvements to the data set analysis and match analysis functions.

This will probably be the last incremental release for a while – I’ll be publishing a road map shortly which shows what’s next on the agenda, but I feel it’s in a state now where Metadata Interrogator fulfils all of my original needs.

Change Log:

• Migrated the timeline to MatPlotLib – this slightly slows down the loading time, but I think it’s well worth it and will be used for more analysis graphics in the future.
• The timeline has been drastically improved, with a much better layout and ability to handle high numbers of files.
• Colour coding for different file types has been implemented on the timeline .
• The data set analysis function has been improved, and now lists file types in the set.
• The file comparison function has been improved to more accurately show differences.
• Minor performance improvements across the board, especially in analysis times.

Get it here: https://github.com/globalcrimadmin/metadata/releases/download/v0.6/Metadata.Interrogator.v06.exe

This release of Metadata Interrogator is a bit of a turning point – it’s a lot more stable now and I feel that most of the bugs have been ironed out. I’ve also started on the ‘Data set analysis’ feature – this analyses all the files currently in the data table and looks for things of interest. At the moment it’s very basic, but I’ll be expanding it soon.

As always, if you have any requests for features in this exif and metadata analyser, I’d be very interested to hear them and then complain about how difficult it would be to implement them.

Change Log:

• Basic Data Set Analysis; currently extremely basic, but it’s being worked on.
• The only good bug is a dead bug, and I’ve squashed a lot of bugs.
• New fancy icons.
• MI should throw up more errors if you try to do something…erroneous.
• Some very minor performance improvements.

Get it here: https://github.com/globalcrimadmin/metadata/releases/download/v0.5/Metadata.Interrogator.v05.exe

v0.4.1 – Walker

This release of Metadata Interrogator is mostly bug fixes and performance related – take note of the decision to remove the ‘default’ date that appears on some files (mostly Microsoft Office ones). This was skewing a lot of timelines and added nothing to the analysis – if there’s demand for it, I’ll add in an option to keep them.

Change Log:

• Fixed files with no date information crashing timeline.
• Removed files from timeline with Microsoft ‘default’ date (1980-01-01 00:00:00)
• Added error messages for failed files.
• Cleaned up code for slight performance increase.

Get it here: https://github.com/globalcrimadmin/metadata/releases/download/v0.4.1/Metadata.Interrogator.v041.exe

This release includes basic timeline functionality – it’s useful in a number of scenarios, but mostly to highlight if there were lengthy gaps between two files being created. This version also includes much better match analysis – hopefully it’s of more use now, as it analyses more exif fields and gives you a better comparison. I’ll keep improving both of these functions in the coming weeks.

Change Log:

• Basic Timeline Analysis!
• Much improved Match Analysis.
• User feedback when processing files (so you know it hasn’t frozen!).
• GUI bug fixes.

Get it here: https://github.com/globalcrimadmin/metadata/releases/download/v0.4/Metadata.Interrogator.v04.exe

Ho, Ho, Ho,
Now I have a machi…Happy Christmas ! The best Christmas present of all has come:

Version 0.3 (named McClane – obviously) is released with two new, major features!

First and foremost, I’ve added in the Hachoir metadata libraries – these drag out even more metadata on a wider variety of files. Pretty much every major file type is now supported, with metadata on EXE’s, Videos and Audio files as well as all the previous ones. There may be some duplication in fields, which I’ll whittle down in future releases.

The second feature is basic comparison functionality to see what the differences are between two files. I hope to improve on this substantially in future releases, but it’s a start.

I’ve also cleaned up the UI substantially now that we know we’re sticking to the Pandastable version (see Trimming Down the Metadata Interrogator) and now that I’m happier with how it’s going I’ve laid the groundwork for easier expansion.

Change Log:

• Added Hachoir parsing!
• Rudimentary file comparison
• Added Settings panel to help adjust the layout better.
• Squashed a lot of bugs.
• GUI resizing works properly now.
• A few more (hopefully descriptive) error messages instead of it just quietly not working.
• Complete separation of GUI and analysis in the code.

Get it here: https://github.com/globalcrimadmin/metadata/releases/download/McClane/Metadata.Interrogator.v03.exe