ExifTool

v12.76Phil Harvey

Prints the full tag set for a carrier — dimensions, encoder, timestamps, GPS, comments — with JSON, CSV, grouped and single-tag output. Flags and clues often hide in metadata before anyone touches a bit plane.

Category: Data decoding, cryptanalysis & analysis
Package: libimage-exiftool-perl
Runs on: Linux · Windows
Commands: exiftool, exiftool.exe

Tags come from the authored artifact metadata and the deterministic carrier model. No file is parsed with a real metadata library.

Install it

The scripts below install the real Phil Harvey package on your own machine — read them first, and run them somewhere you are allowed to change. Inside the range, one press puts the simulated package on your next machine.

Linux installer (shell script)

install-exiftool.sh

Windows installer (PowerShell)

Install-exiftool.ps1

On a range machine

Add it to your kit and every machine you launch comes with it.

On Linux

Debian, Ubuntu, Kali (apt)

Refresh the package lists
```
sudo apt update
```

Install ExifTool

sudo apt install -y libimage-exiftool-perl

RHEL, Fedora (dnf)

Install ExifTool
```
sudo dnf install -y libimage-exiftool-perl
```
Package names drift between distributions; search first if this one misses.

Arch (pacman)

Install ExifTool

sudo pacman -S --noconfirm libimage-exiftool-perl

Alpine (apk)

Install ExifTool
```
sudo apk add libimage-exiftool-perl
```
Package names drift between distributions; search first if this one misses.

Check it worked

Confirm it landed on PATH
```
which exiftool
```
Check the version
```
exiftool --version
```
The range reports 12.76.

Remove it

Take it off again

sudo apt remove --purge libimage-exiftool-perl

On Windows

Windows Package Manager (winget)

Search the catalog
```
winget search libimage-exiftool-perl
```
Install ExifTool
```
winget install --id libimage-exiftool-perl -e
```
Package names drift between distributions; search first if this one misses.

Chocolatey (choco)

Install ExifTool
```
choco install libimage-exiftool-perl -y
```
Run the shell as administrator.

Check it worked

Confirm it resolves
```
where exiftool
```
Check the version
```
exiftool --version
```
The range reports 12.76.

Remove it

Take it off again

winget uninstall --id libimage-exiftool-perl

Inside the range

Tick it on the launch screen
Under ExifTool's category on the advanced tool shelf. A lab that depends on it locks the toggle on and says why.
Or install it from a range terminal
```
sudo apt install -y libimage-exiftool-perl
```
The simulated package manager seeds the same binaries, config and receipt the shelf toggle does.
Everything here is simulated
No software is downloaded and nothing executes — the range answers from authored fixtures.

Labs that use ExifTool

No lab locks this one on yet — tick it on the launch screen and take it into any scenario.