Open-source intelligence (OSINT) investigations succeed not through proprietary commercial surveillance subscriptions, but through the rigorous, creative synthesis of public utilities. Whether an investigator is pinpointing the exact coordinates of an airstrike, authenticating a contested protest rally, or identifying the provenance of a leaked PDF, specialized open-source tools provide verifiable, reproducible results.

As established in our foundational OSINT Verification Handbook, digital forensic research requires isolating individual evidentiary axes. This guide presents an authoritative catalog of the premier open-source tools for metadata extraction, satellite verification, and solar chronolocation—evaluated for reliability, data privacy, and evidentiary rigor.

1. ExifTool by Phil Harvey: The Universal Metadata Standard

There is no substitute for Phil Harvey’s ExifTool. Maintained for over two decades, it is a cross-platform command-line Perl library capable of reading, parsing, and writing metadata across virtually every known media container (JPEG, TIFF, RAW, MP4, PDF, PNG, and QuickTime).

# Recommended forensic audit flags:
# -a: allow duplicate tags
# -u: extract unknown binary tags
# -g1: group tags by logical structure (IFD0, ExifIFD, GPS, XMP)
# -s: print tag names instead of descriptions
exiftool -a -u -g1 -s evidence_file.jpg

Forensic Power Moves:

• Extracting Embedded Preview Thumbnails: Even if an image has been edited or cropped, digital camera software often retains an untouched, low-resolution thumbnail inside the EXIF header: bash exiftool -b -ThumbnailImage input.jpg > extracted_original_thumbnail.jpg
• PDF Incremental Updates: ExifTool exposes whether a PDF has been sequentially updated, revealing previously saved revisions and hidden author usernames.

If command-line installation is unavailable in your field environment, our zero-upload Digital Media Verification Navigator provides an in-browser EXIF extraction engine operating entirely within local client memory.

2. SunCalc.org: The Physics of Solar Chronolocation

Created by Torsten Hoffmann, SunCalc.org is the essential chronolocation instrument for open-source investigators. It maps solar movement, solar azimuth (compass bearing), and sun altitude (elevation angle) for any coordinate on Earth at any minute in history.

                      Compass Azimuth (North = 0°)
                                    N (0°)
                                    │
                         W (270°) ──┼── E (90°)
                                    │
                                    S (180°)

Practical Application:

1. Locate a vertical structure in the photograph (e.g., a 10-meter utility pole).
2. Measure the bearing of the cast shadow relative to true north using Google Earth Pro’s ruler tool.
3. Input the coordinates and calendar date into SunCalc.
4. Move the time slider until the simulated orange shadow vector matches the photographed shadow angle. This confirms or refutes the claimed hour of the event within a narrow 15-minute margin.

3. Sentinel Hub EO Browser: Multispectral Satellite Ground Truth

While commercial satellite providers (Maxar, Planet) charge thousands of dollars for high-resolution tasking, the European Space Agency’s Copernicus Sentinel-2 constellation captures the entire planet every five days at 10-meter resolution—free of charge.

Via the Sentinel Hub EO Browser (apps.sentinel-hub.com/eo-browser), researchers can query: * True Color (RGB): Optical satellite imagery confirming building destruction, new road construction, or severe seasonal flooding. * Shortwave Infrared (SWIR / False Color): Pinpoints active thermal anomalies (active wildfires, missile impacts, industrial flares) invisible in optical bands. * Normalized Difference Vegetation Index (NDVI): Quantifies crop destruction, deforestation, or earth disruption caused by military trenching.

4. Google Earth Pro (Desktop Client)

The browser version of Google Earth is inadequate for serious investigation. The free desktop installation (Google Earth Pro) contains critical forensic functionality:

• The Historical Imagery Slider: Travel backward through decades of aerial photography to establish when a building was erected, when a road was paved, or when a perimeter wall was constructed.
• 3D Terrain & Digital Elevation Models (DEM): Recreate the exact focal length, elevation, and line of sight of the photographer. Match distant mountain silhouettes and horizon contours against the camera position.
• Sun & Shadow Simulation: Toggle real-time solar illumination across 3D buildings to verify shadow lengths directly on the digital globe.

5. PeakFinder: Mountain Horizon Profiling

When verifying footage captured in rural or mountainous areas (such as the Caucasus, the Hindu Kush, or the Andes), building landmarks do not exist. PeakFinder.org computes a 360-degree panoramic profile from any geographical viewpoint on Earth.

• It draws the exact silhouette of all mountain peaks from the observer’s elevation.
• Investigators can overlay the PeakFinder horizon outline directly over the horizon visible in eyewitness video (as demonstrated in our Video Verification Guide) to confirm the exact valley or ridgeline where the footage was filmed.

6. Overpass Turbo: Advanced OpenStreetMap Querying

Most users interact with OpenStreetMap (OSM) as a simple map. For open-source investigators, OSM is a structured spatial database. Overpass Turbo (overpass-turbo.eu) allows you to run SQL-like queries against physical infrastructure patterns.

Real-World Investigative Query Scenario:

An eyewitness photo shows a narrow gauge railway track running parallel to a church within 100 meters of a power substation. Instead of manually scouring thousands of square miles of satellite tiles, an Overpass QL query returns all instances matching those exact geographic criteria:

[out:json][timeout:25];
(
  way["railway"="narrow_gauge"](around:100, {{bbox}});
  node["amenity"="place_of_worship"](around:100, {{bbox}});
);
out body;
>;
out skel qt;

7. Iowa State University Mesonet (IEM): Historical METAR Weather

When bad actors recycle footage, they frequently claim an event occurred on a clear afternoon when the region was actually experiencing heavy precipitation.

The Iowa Environmental Mesonet (IEM) aggregates global METAR (Meteorological Aerodrome Report) station observations from commercial and military airfields dating back decades. * Search by regional ICAO airport code (e.g., OAKB for Kabul, EDDB for Berlin). * Extract hourly historical temperature, wind direction, visibility, and precipitation logs to cross-examine eyewitness weather conditions.

Complete Tools Matrix for Open-Source Desks

Investigative Discipline: The Rule of Three

No single tool or algorithm constitutes definitive forensic proof. Automated algorithms hallucinate, camera clocks can be misset, and weather stations can be located miles away from the target scene.

The Rule of Three: A location or timestamp is considered definitively verified only when confirmed across three independent evidentiary axes (e.g., matching mountain silhouettes via PeakFinder, solar angle consistency via SunCalc, and ground infrastructure alignment via Google Earth).

For immediate file metadata inspection without installing local software, launch our Digital Media Verification Navigator.