Technical guide for mobile devices.
EXIF / XMP / IPTC
EXIF metadata isn't limited to raw GPS. On Android/iOS, XMP dictionaries and OffsetTime fields survive superficial deletions. Residual GPS tags can be recovered via forensics. The threat: spatio-temporal cross-referencing via metadata dictionaries.
// FORENSICS RESIDUE (REAL CASE)
> GPSLatitudeRef: 48°51'23.4"N
GPSLongitudeRef: 2°17'42.1"E
MakerNote (Apple): 12 unerased chunks
Apple 'Hide Location': only removes main tags. But keeps: GPSImgDirection, GPSTimeStamp, and XMP:GPSAltitude.
Google Photos 'Remove Locations': cloud operation. The local file keeps APP1 and APP13 markers.
Native iOS Command/usr/bin/ImageIO -removeProperty kCGImagePropertyGPS
⚠️ Ignores XMP, JFIF, TIFF-EP.
Systematic ResidueEXIF:OffsetTimeOriginal + XMP:CreateDate
Location to ±200km via timezone.
DANGER: JSON sidecarGoogle Photos creates associated .json files containing precise GPS coordinates. Location removal doesn't erase these sidecars.
GhostMeta operates by canvas pixel reconstruction — the image is fully re-encoded through the browser's Canvas API, overwriting residual data in thumbnails and non-standard fields. Forensics tools (exiftool) only find null blocks.