Learning Python for Forensics

Parsing EXIF metadata – exif_parser.py

The exif_parser plugin is the first we will develop and is relatively simple due to our reliance on the PIL module. There are three functions within this script: exifParser(), getTags(), and dmsToDecimal(). The exifParser() function, on line 14, is the entry point into this plugin and takes a string representing a filename as its only input. This function primarily serves as coordinating logic for the plugin.

The getTags() function on line 30 is responsible for parsing the EXIF tags from our input file. Finally, the dmsToDecimal() function on line 117 is a small helper function responsible for converting GPS coordinates into decimal format. Take a look at the following code:

001 from datetime import datetime ...