Extract Exif data from picture on ingestion

[mokaddem]

Could be done in a similar fashion than advanced malware extraction

[Th4nat0s]

I+1 On this idea.
But not only for pictures, for office doc documents, and pdf.

I maybe nice to have an object like "document metadata" linked to the object. If we based it of exittool output,

For PDF It may be nice to have. 

• Producer
• Creator
• Creator Tool
• Language
• Create Date

For Jpg

• Camera Model Name
• Date/Time Original
• Owner Name
• Serial Number

For Office Document

• Creator
• Last Modified By
• Create Date
• Application
• Language

In STIX for PDF there is a "6.7.4 PDF File Extension" > https://docs.oasis-open.org/cti/stix/v2.1/os/stix-v2.1-os.html#_gckz8qcky97t
Where the exif tags are part of a document_info_dict

[adulau]

Some notes

{

  "type": "file",

  "spec_version": "2.1",

  "id": "file--ec3415cc-5f4f-5ec8-bdb1-6f86996ae66d",

  "name": "example.pdf",

  "extensions": {

    "pdf-ext": {

      "version": "1.7",

      "document_info_dict": {

        "Title": "Sample document",

        "Author": "Adobe Systems Incorporated",

        "Creator": "Adobe FrameMaker 5.5.3 for Power Macintosh",

        "Producer": "Acrobat Distiller 3.01 for Power Macintosh",

        "CreationDate": "20070412090123-02"

      },

      "pdfid0": "DFCE52BD827ECF765649852119D",

      "pdfid1": "57A1E0F9ED2AE523E313C"

    }

  }

}

[adulau]

Object template is done via 3469a48