The file you share is not the file you think it is

Most people who get burned by metadata never knew it existed. The cases below are all documented — and in each one, the damage came from a field the photographer didn’t know the camera was writing.

Case 1 — John McAfee, Guatemala, 2012

The best-known metadata failure on record. In December 2012, John McAfee was in hiding in Guatemala while Belizean police sought him for questioning about a neighbor’s murder. Vice magazine published an exclusive photo of McAfee alongside its editor-in-chief — with the original JPEG’s EXIF GPS coordinates intact: roughly 15°39′N, 88°59′W, pinpointing the pair to a specific spot in Guatemala. Within hours, readers had mapped it; the location was reported worldwide. Whatever security value secrecy had was gone because a camera had quietly appended a lat/lon to the image file. The lesson repeats on a smaller scale daily: any original phone photo can carry the same field.

Case 2 — The thumbnail that outlived the crop, 2003

In 2003, a US television host posted photos of herself online, cropped to be presentable. Readers recovered the EXIF-embedded thumbnails — small preview JPEGs cameras and editing software store inside the file — and found they still showed the uncropped originals, which were considerably less presentable. Cropping the displayed image had done nothing to the embedded preview. Modern tools behave the same way: many editors update the main image and leave the thumbnail alone, because it is “only a preview.” It isn’t — it is a second image riding inside the first, and this viewer’s report calls it out explicitly when one is present.

Case 3 — Geotagged photos and deployed soldiers, 2012

Also in 2012, the US Army publicly warned that soldiers posting geotagged photos from deployment zones were publishing the locations of helicopters, vehicles and camp layouts. A sequence of ordinary snapshots — each carrying a few meters’ worth of GPS precision — aggregated into a map an adversary could never have scouted directly. The Army’s guidance eventually boiled down to the same rule this site pushes: check what’s in the file before it leaves your hands, because “the photo itself” already contains far more than the frame you see.

Case 4 — The everyday version: your own address

You don’t need to be a fugitive or a soldier. A geotagged photo of your kid’s birthday posted to a classifieds listing or community forum — platforms that don’t re-encode attachments — is a precise home address tied to a family photo. Originals sent by email or shared as cloud-drive files keep every byte of metadata. Journalists and researchers check for it routinely (OSINT investigations lean heavily on EXIF); the gap is that ordinary users rarely check their own files. That asymmetry is the actual risk.

What these cases have in common

None of them required hacking. The data was in the file, written by helpful cameras doing what they were designed to do. The fix is equally unglamorous:

1. Look before you share — drop the file into the viewer and read the “what this photo reveals” panel.
2. Strip a copy for sharing — one button produces a metadata-free version; keep the original intact for your own archive (EXIF is genuinely useful for sorting and searching).
3. Know your platforms — the stripping guide shows which platforms remove metadata for you and which never touch it.

Frequently asked questions

Can someone really find my house from a photo?

If the original file carries GPS coordinates — yes, to within a few meters. A geotagged photo shot in your kitchen is effectively your street address attached to an image. That is why social platforms strip EXIF on upload, and why sharing the original file (email, cloud link, forum attachment) is fundamentally different from posting through an app.

Do screenshots and downloaded images keep my metadata?

Screenshots are new files — they carry your device's metadata (or none), not the original photo's. But downloading a photo keeps whatever the platform left in the file: sites that strip metadata produce clean downloads, sites that don't hand out everything the uploader's camera embedded.

Is viewing EXIF data legal?

Reading metadata embedded in a file you possess is legal in most jurisdictions — it's data the file's owner gave you, often unknowingly. Using it to stalk, dox or harass is a different matter entirely. This page exists so that *you* check what *your* files disclose before sharing.