Blue Team Labs Meta Writeup: EXIF Metadata and Reverse Image Search
A Blue Team Labs Online Meta walkthrough using ExifTool and reverse image search to extract camera metadata, timestamps, comments, and location clues.
Meta is a Blue Team Labs Online challenge about validating image evidence with both metadata and OSINT. The scenario gives two images posted by a criminal on the run with the caption, I'm roaming free. You will never catch me. I followed the original challenge questions directly: inspect the metadata first, then use the image content to confirm the location.
Description
The attached images were posted by a criminal on the run. Since metadata can be changed, I treated Exif results as leads instead of final truth.
Challenge Submission
I started with ExifTool against both provided files.
exiftool uploaded_1.JPG
exiftool uploaded_2.png
What is the camera model?
The first image metadata exposed the camera model used to take the picture.
Answer: Canon EOS 550D
When was the picture taken?
The timestamp field gave the date and time embedded in the image metadata.
Answer: 2021:11:02 13:20:23
What does the comment on the first image say?
The comment field was the strongest hint that the criminal expected investigators to rely too much on metadata.
Answer: relying on altered metadata to catch me?
Where could the criminal be?
Because the metadata itself warned that it may be altered, I pivoted to visual OSINT. Comparing the visible landmark and surroundings led to Kathmandu.
Answer: Kathmandu
Key Takeaways
- Exif data is a fast first pass, but it should be treated as evidence to validate, not blindly trusted.
- Metadata comment fields can contain useful intent clues.
- For image investigations, combine metadata, visual landmarks, and reverse image search before making a location claim.