How to Install ExifTool and Detect AI-Generated Images

2026-07-13 9 min read Cybersecurity Digital Forensics Technology

How to Install ExifTool and Detect AI-Generated Images

AI-generated images often contain metadata that identifies the software, service, or content-creation pipeline used to produce them. When this information is preserved, tools such as ExifTool can reveal fields associated with providers including OpenAI, ChatGPT, Google, Adobe, and other generative AI platforms.

One useful indicator is the C2PA claim generator metadata, which may appear as fields such as:

Claim Generator
Claim Generator Info Name
C2PA Claim Generator
Claim Generator Info Version

Example values may include:

OpenAI Media Service API
ChatGPT
Google C2PA Core Generator Library
Adobe Firefly
Other provider or library names

Metadata analysis can provide strong clues, but it is not a perfect AI detector. Metadata can be removed, modified, or forged.

Install ExifTool

ExifTool is available for Windows, macOS, Linux, and most Unix-like operating systems.

Install ExifTool on Windows

Download the Windows executable from the official ExifTool website.

Download the Windows executable.
Rename exiftool(-k).exe to exiftool.exe if required.
Place it in a directory such as:

1

C:\Tools\ExifTool

Add that directory to the Windows PATH, or run ExifTool from its installation directory.
Open PowerShell and verify the installation:

1

exiftool -ver

A version number confirms that ExifTool is available.

Install ExifTool on macOS

Using Homebrew:

1

brew install exiftool

Verify the installation:

1

exiftool -ver

If Homebrew is not installed, install it from the official Homebrew website.

Install ExifTool on Debian or Ubuntu

1
2


sudo apt update
sudo apt install libimage-exiftool-perl

Verify the installation:

1

exiftool -ver

Install ExifTool on Fedora

1

sudo dnf install perl-Image-ExifTool

Verify the installation:

1

exiftool -ver

Install ExifTool on Arch Linux

1

sudo pacman -S perl-image-exiftool

Then check the installed version:

1

exiftool -ver

Inspect Basic Image Metadata

To display all available metadata from an image:

1

exiftool image.jpg

Replace image.jpg with the path to the image you want to examine.

For more useful forensic output, include duplicate tags, group names, and tag identifiers:

1

exiftool -a -u -g1 -s image.jpg

The options perform the following functions:

-a displays duplicate tags.
-u displays unknown tags.
-g1 groups fields by metadata family.
-s uses tag names instead of verbose descriptions.

This makes it easier to distinguish between EXIF, IPTC, XMP, and C2PA-related data.

Search for AI Provider Metadata

On Linux and macOS, search ExifTool output for common AI and C2PA indicators:

1

exiftool -a -u -g1 -s image.jpg | grep -iE "claim|generator|c2pa|openai|chatgpt|google|gemini|firefly|ai"

On Windows PowerShell, use:

1

exiftool -a -u -g1 -s image.jpg | Select-String -Pattern "claim|generator|c2pa|openai|chatgpt|google|gemini|firefly|ai"

Potential output may look similar to:

1
2
3


[XMP-c2pa]      Claim Generator              : OpenAI Media Service API
[XMP-c2pa]      Claim Generator Info Name    : ChatGPT
[XMP-c2pa]      Claim Generator Info Version : 1.0

Another example could be:

1

[C2PA]          Claim Generator Info Name    : Google C2PA Core Generator Library

The exact group and field names depend on the image format, the provider, and the ExifTool version.

Check the Claim Generator Info Name Field

If ExifTool recognizes the field directly, query it by name:

1

exiftool -s -Claim_Generator_InfoName image.jpg

You can also search across all metadata groups:

1

exiftool -a -u -g1 -s image.jpg | grep -i "Claim_Generator_InfoName"

On PowerShell:

1

exiftool -a -u -g1 -s image.jpg | Select-String -Pattern "Claim_Generator_InfoName"

Look for values associated with known generation services or content-authenticity libraries, such as:

1
2
3
4


OpenAI Media Service API
ChatGPT
Google C2PA Core Generator Library
Adobe Firefly

A provider name in this field is evidence that the image passed through that provider or its content-generation pipeline. It does not independently prove that every visible pixel was generated by AI. For example, an image may have been edited, resized, or exported after generation.

Inspect C2PA Metadata

The Coalition for Content Provenance and Authenticity standard allows content creators and tools to attach signed provenance information to media.

To inspect possible C2PA fields:

1

exiftool -a -u -g1 -s image.jpg | grep -iE "c2pa|claim|assertion|ingredient|signature"

A C2PA-enabled image may contain information such as:

The software or service that created the asset
The tool used to edit or export it
Previous assets used as ingredients
Creation and modification timestamps
Cryptographic signatures
Content credentials or provenance assertions

For a broader inspection, write the complete metadata report to a text file:

1

exiftool -a -u -g1 -s image.jpg > metadata-report.txt

Then search the report:

1

grep -iE "c2pa|claim|generator|openai|chatgpt|google|ai" metadata-report.txt

On Windows:

1
2


exiftool -a -u -g1 -s image.jpg | Out-File metadata-report.txt
Select-String -Path metadata-report.txt -Pattern "c2pa|claim|generator|openai|chatgpt|google|ai"

Check IPTC, XMP, and EXIF Separately

Metadata is stored in different namespaces. Checking each group separately can make the investigation clearer.

Check IPTC Metadata

1

exiftool -IPTC:All image.jpg

IPTC fields commonly contain:

Caption or description
Creator or photographer
Copyright information
Keywords
News or publishing metadata

The Claim Generator Info Name field is generally associated with C2PA or XMP provenance data rather than traditional IPTC fields. However, some applications may copy or expose related values through other metadata groups.

Check XMP Metadata

1

exiftool -XMP:All image.jpg

Search XMP for generator and provenance fields:

1

exiftool -XMP:All image.jpg | grep -iE "claim|generator|c2pa|ai|openai|google"

Check EXIF Metadata

1

exiftool -EXIF:All image.jpg

EXIF may reveal the camera model, editing software, timestamps, and export software. A software field such as Adobe Photoshop, GIMP, or an image-processing library does not automatically mean the image was AI-generated. It only indicates that the file was processed by that software.

Create a Simple Detection Script

The following Python script runs ExifTool, extracts metadata, and searches for common AI-generation indicators.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67


import re
import subprocess
import sys
from pathlib import Path

AI_INDICATORS = [
    "claim generator",
    "claim generator info name",
    "c2pa",
    "openai",
    "chatgpt",
    "google c2pa",
    "gemini",
    "adobe firefly",
    "midjourney",
    "stability ai",
]

def inspect_image(image_path: str) -> None:
    path = Path(image_path)

    if not path.is_file():
        raise FileNotFoundError(f"File not found: {path}")

    result = subprocess.run(
        ["exiftool", "-a", "-u", "-g1", "-s", str(path)],
        capture_output=True,
        text=True,
        check=True,
    )

    metadata = result.stdout
    matches = []

    for line in metadata.splitlines():
        lowered = line.lower()

        if any(indicator in lowered for indicator in AI_INDICATORS):
            matches.append(line)

    print(f"Image: {path}")
    print()

    if matches:
        print("Potential AI or provenance indicators:")
        for match in matches:
            print(f"  {match}")
    else:
        print("No obvious AI-generation indicators were found.")

    print()
    print("Metadata presence is not proof of origin.")
    print("Metadata may be missing, stripped, modified, or forged.")

if __name__ == "__main__":
    if len(sys.argv) != 2:
        print(f"Usage: python {Path(sys.argv[0]).name} image.jpg")
        sys.exit(1)

    try:
        inspect_image(sys.argv[1])
    except subprocess.CalledProcessError as error:
        print(f"ExifTool failed: {error}", file=sys.stderr)
        sys.exit(1)
    except FileNotFoundError as error:
        print(error, file=sys.stderr)
        sys.exit(1)

Run it with:

1

python detect_ai_metadata.py image.jpg

Example output:

1
2
3
4
5
6
7


Image: image.jpg

Potential AI or provenance indicators:
  [XMP-c2pa] Claim Generator Info Name : ChatGPT

Metadata presence is not proof of origin.
Metadata may be missing, stripped, modified, or forged.

Interpret the Results Carefully

Stronger Evidence

The following findings are more useful when they appear together:

A valid C2PA manifest
A cryptographic signature that verifies successfully
A recognized claim generator
A consistent creation and modification history
Provider-specific metadata that matches the file format and workflow
Provenance information showing the asset was generated or edited by an AI service

A signed C2PA record provides stronger evidence than an ordinary text metadata field because the signature can help detect unauthorized changes.

Weaker Evidence

These findings alone are not enough to classify an image as AI-generated:

Missing camera metadata
A generic Software field
JPEG compression
An unusual filename
A low-resolution export
A metadata field containing the word AI
A provider name in an unsigned, easily editable field

Metadata can be manipulated with ExifTool or other tools. For example, a user can write arbitrary values to standard metadata fields:

1

exiftool -XMP:Description="Example text" image.jpg

This illustrates why a plain metadata string should be treated as an indicator, not definitive proof.

Check Whether Metadata Was Stripped

Many platforms remove metadata when users upload or download images. Social media sites, messaging applications, image compressors, and screenshot tools may eliminate EXIF, IPTC, XMP, or C2PA information.

Check whether an image contains any metadata:

1

exiftool -a -u -g1 -s image.jpg

If the output contains only basic file information, possible explanations include:

The image was generated without metadata.
The metadata was removed during export.
A platform stripped the metadata.
The image was converted or embedded into another file.
The file is a screenshot or re-encoded copy.

A lack of AI metadata does not prove that an image was created by a human.

Compare the Original and Downloaded Files

When possible, analyze the original file instead of a copy downloaded from a website or messaging platform.

Calculate a cryptographic hash:

1

sha256sum image.jpg

On Windows PowerShell:

1

Get-FileHash image.jpg -Algorithm SHA256

You can also record a complete ExifTool report:

1

exiftool -a -u -g1 -s image.jpg > image-metadata.txt

Preserving the original file and its hash helps establish whether the image changed during handling.

Recommended AI Image Analysis Workflow

Use a layered process instead of relying on one metadata field:

Preserve the original file.
Calculate its SHA-256 hash.
Record the file type, dimensions, and timestamps.
Extract all metadata with ExifTool.
Search for C2PA, claim generator, provider, and software fields.
Check whether the C2PA signature or content credential validates.
Compare metadata with the image’s known source and history.
Use visual analysis or specialized detection tools as supporting evidence.
Report the result as an assessment rather than absolute certainty.

A practical classification might be:

Likely AI-generated: Valid provenance identifies an AI provider or generation service.
Possibly AI-generated: Metadata contains provider indicators, but signatures or provenance cannot be verified.
Undetermined: No useful metadata is available.
Likely edited or processed: Software metadata identifies an editor, but there is no evidence of AI generation.

Common Limitations

ExifTool can read metadata, but it cannot magically determine how every image was created. Important limitations include:

Metadata is optional.
Metadata can be removed during export.
Metadata can be rewritten or forged.
C2PA support varies between applications and formats.
A provider may add metadata only to certain workflows.
A human-created image may be edited by an AI tool.
An AI-generated image may be resized, screenshot, or re-encoded without provenance data.
The same generator library may be used by multiple products.

The most reliable conclusions come from combining signed provenance, file history, source verification, metadata analysis, and visual examination.

Conclusion

ExifTool is a fast and practical way to inspect image metadata for AI-generation indicators. Start with:

1

exiftool -a -u -g1 -s image.jpg

Then search for fields related to:

1
2
3
4
5
6


Claim Generator
Claim Generator Info Name
C2PA
OpenAI
ChatGPT
Google C2PA Core Generator Library

A value such as OpenAI Media Service API, ChatGPT, or Google C2PA Core Generator Library can be a meaningful indicator that an image passed through an AI generation or provenance pipeline. However, treat ordinary metadata as evidence rather than proof. For higher confidence, verify signed C2PA credentials and preserve the original file before analysis.