AFFLIB

Producing an EXIF csv

November 13, 2010

This page shows how to use bulk_extractor’s post_process_exif.py script to make a CSV file that you can load into Excel with all of the EXIFs on a disk image.

Start by running bulk_extractor on a disk image:

$ bulk_extractor -o exifdemo /corp/drives/nps/nps-2009-ubnist1/ubnist1.gen3.raw
0: Phase 1.
0: Input file: /corp/drives/nps/nps-2009-ubnist1/ubnist1.gen3.raw
0: Output directory: exifdemo
...

When you are done, you’ll see output that looks like this:

$ ls -l exifdemo
total 38972
-rw-r--r--  1 simsong  staff        64 Nov  7 08:09 _thread0.stat
-rw-r--r--  1 simsong  staff        64 Nov  7 08:09 _thread1.stat
-rw-r--r--  1 simsong  staff        64 Nov  7 08:09 _thread2.stat
-rw-r--r--  1 simsong  staff        64 Nov  7 08:12 _thread3.stat
-rw-r--r--  1 simsong  staff       176 Nov  7 08:12 ccn.txt
-rw-r--r--  1 simsong  staff       128 Nov  7 08:06 config.cfg
-rw-r--r--  1 simsong  staff  13876849 Nov  7 08:12 domain.txt
-rw-r--r--  1 simsong  staff  17500510 Nov  7 08:12 email.txt
-rw-r--r--  1 simsong  staff    202768 Nov  7 08:12 exif.txt
-rw-r--r--  1 simsong  staff         0 Nov  7 08:12 exif_stopped.txt
-rw-r--r--  1 simsong  staff       285 Nov  7 08:12 report.txt
-rw-r--r--  1 simsong  staff   3101978 Nov  7 08:12 rfc822.txt
-rw-r--r--  1 simsong  staff     27651 Nov  7 08:12 telephone.txt
-rw-r--r--  1 simsong  staff   4711492 Nov  7 08:12 url.txt
-rw-r--r--  1 simsong  staff      1771 Nov  7 08:12 url_searches.txt
-rw-r--r--  1 simsong  staff    131051 Nov  7 08:12 url_services.txt
-rw-r--r--  1 simsong  staff    265961 Nov  7 08:12 zip.txt
$

Now run the script post_process_exif.py which is part of the bulk_extractor release (be sure that you have the 0.5.7 release or above):

$ python ~/domex/src/bulk_extractor/post_process_exif.py  exif.txt exif.csv
Input file: exif.txt
Output file: exif.csv
Scanning for EXIF tags...
There are 95 exif tags
$

You can now open the resulting exif.csv file in Excel.

Filed under: bulk_extractor

Tags: bulk_extractor