JPEGSnoop
JPEGSnooper is a port of some of the functionality of the freeware application JPEGsnoop Version 1.5.2 by Calvin Hass and the JPEG metadata analysis functionality of Irfanview to EnCase. This script will analyze selected JPEG files cull present metadata from the file and display the decoded results in the console. Thus an examiner does not have to individually open each image file with an external file viewer such as Irfanview or JPEGSnooper to view the present metadata. Currently the script will process any valid JPEG image and present available metadata. Additionally it will provide manufacturer specific information for NIKON cameras. (This is additional information NIKON cameras will write sometimes to image files.) Additional support for other manufacturers will be in later updates.
Download NowEnCase Forensic 7.05