Meta

Overview

Platform: BTLO
Category: Image Forensics
Tools: ExifTool, Google Lens / Reverse Image Search
Artifact: uploaded_1.JPG, uploaded_2.png

Q1. What is the camera model?

Answer:
Canon EOS 550D

Process:
I used exiftool to parse the metadata of the first artifact. Filtering for “Model” quickly isolated the specific camera hardware used to capture the image.

# exiftool uploaded_1.JPG | grep Model
Camera Model Name               : Canon EOS 550D
Canon Model ID                  : EOS Rebel T2i / 550D / Kiss X4
Lens Model                      : EF-S55-250mm f/4-5.6 IS

Q2. When was the picture taken?

Answer:
2021:11:02 13:20:23

Process:
Metadata contains several timestamps. I prioritized Date/Time Original, as it represents the point of capture rather than file system modification.

# exiftool uploaded_1.JPG | grep Date
Modify Date                     : 2021:11:02 13:20:23
Date/Time Original              : 2021:11:02 13:20:23
Create Date                     : 2021:11:02 13:20:23

Screenshot removed: local pasted image 20260214200842 is not present in the repo.

Forensic Note:

DateTimeOriginal: The exact moment the camera shutter was triggered.
CreateDate: When the digital file was initially written to the storage media.

Q3. What does the comment on the first image say?

Answer:
relying on altered metadata to catch me?

Process:
I checked for any non-standard metadata fields. Extracting the Comment field revealed a provocative message left by the creator.

# exiftool uploaded_1.JPG | grep Comment
Comment                         : relying on altered metadata to catch me?  

Q4. Where could the criminal be?

Answer:
Kathmandu

Process:
Since the metadata lacked GPS coordinates, I performed a reverse image search using the second artifact. The search indicated the location was Kathmandu. Used: https://images.google.com/

Final Answers (for submission)

Canon EOS 550D
2021:11:02 13:20:23
relying on altered metadata to catch me?
Kathmandu