Image OSINT toolbox

Curated by a 25-year intelligence analyst and military veteran

The external half of image verification: where a photo appeared before, where it was taken, and when. ChronoVerify reads a file's internal evidence; these are the tools working analysts use for the rest. Curated by a 25-year intelligence analyst; every link verified live on July 3, 2026.

How this fits together

Image verification has two halves. The internal half is what the file itself carries: metadata, Content Credentials, compression history. That is the half ChronoVerify automates into one verdict, and the half our OSINT use-case page walks through. The external half is context that no file can carry: prior appearances, the depicted location, the depicted time. That half is craft, and these are the tools for it.

Reverse image search

The first move on any suspect image: has it appeared before? If the picture was published before the event it claims to show, the claim fails without any forensics. Crop to the distinctive detail before searching, and check more than one index.

Google LensThe broadest index and the strongest object matching. First stop for almost any image. TinEyeA smaller index that sorts matches by crawl date, which is the point: the earliest appearance dates the image. Yandex ImagesConsistently strong on faces, buildings, and non-Western sources. Often finds matches the others miss. Bing Visual SearchA fourth index worth sweeping when the first three come up empty.

Metadata

What the file says about itself: capture time, device, GPS, editing software. Easy to read, easy to strip, easy to forge, which is why it is a source of leads to corroborate rather than a source of facts.

ExifToolPhil Harvey's command-line reader is the ground truth for metadata. When two viewers disagree, believe ExifTool. Metadata2GoBrowser-based EXIF viewer for when you cannot install anything. ChronoVerify EXIF and XMP viewerOur free viewer: the curated capture fields plus the raw tag map and GPS, nothing retained.

Pixel forensics

Compression and noise analysis can highlight a region that was edited into an image. Every tool here produces probabilistic signals that degrade on recompressed and screenshotted files: read each tool's own documentation before reading meaning into a heat map.

FotoForensicsThe reference error-level-analysis implementation. Read its tutorials first; raw ELA is the most misread output in image forensics. ForensicallyA suite of browser-side lenses: clone detection, noise analysis, level sweep. Runs locally in your browser. Image Verification AssistantMulti-algorithm forensic report from the CERTH research group. Slower; useful as a second opinion. InVID / WeVerify pluginThe browser extension newsrooms standardized on: keyframes, reverse-search fan-out, metadata, and forensics in one toolbar.

C2PA Content Credentials

Cryptographically signed provenance attached to the file itself, the strongest internal evidence an image can carry. Still rare in the wild; absence proves nothing.

Content Credentials VerifyThe Content Authenticity Initiative's own inspector: the reference view of what a credential claims. ChronoVerify C2PA inspectorOur free inspector shows the full manifest store; the main verifier validates the signature against the official trust lists and folds it into one verdict.

Geolocation

Where was it taken? Embedded GPS is a claim to verify, and most images carry none, so the work is visual: match terrain, architecture, signage, and skylines against satellite and street-level imagery.

Google Earth ProSatellite imagery, terrain, and the underrated feature: the historical imagery slider. Overpass TurboQuery OpenStreetMap for feature combinations, like a church within 200 meters of a rail line, to shortlist candidate locations. Bellingcat OSM SearchA friendlier front end for the same OpenStreetMap feature-search workflow. MapillaryCrowdsourced street-level imagery, with coverage in places Street View never drove. GeoHintsA visual reference library of what utility poles, license plates, signage, and bollards look like, by country. PeakVisorMountain skyline matching: give it a ridgeline and it names the peaks.

Chronolocation

When was it taken? Corroborate the file's recorded capture time against evidence inside the frame: sun position, shadow length, weather, and season.

SunCalcSun position and shadow direction for any place, date, and time. The workhorse for dating and placing outdoor photos. Weather Underground historyHistorical weather by station and date. Check the claimed date's weather against what the photo shows. timeanddate.comSunrise, sunset, and moon phase for any date and place.

First seen and archives

Publication history: when did this image or the page carrying it first exist? An archive snapshot that predates the claimed event settles the question.

Wayback MachineThe largest web archive. Check the carrying page's history, not just the image. archive.todayA second archive with different coverage; snapshots pages the Wayback misses.

Is it AI-generated? A different question

Provenance asks where an image came from; generation detectors guess how it was made, and ChronoVerify deliberately does not score that. No detector proves an image real, and none is court-grade. If you need the signal, treat any score as one probabilistic input, never a conclusion.

AI or NotA quick browser check that scores whether an image looks AI-generated. One signal among many, never a conclusion. How the detector vendors compareOur sourced comparisons with Sightengine and Hive explain what detection scores do and do not tell you.

Toolkits and communities

The broader catalogs this page deliberately does not duplicate. Image work is one lane of OSINT; these cover the rest.

Bellingcat's Online Investigation ToolkitAn actively maintained tool catalog from working investigators, with honest notes on what each tool is good for. OSINT FrameworkThe classic clickable tree of OSINT tools by category. awesome-osintThe community-maintained GitHub list. Broad, occasionally stale, always a starting point. OSINT Combine free toolsFree browser utilities from the training company, including image and geolocation helpers.

What this page deliberately leaves out

Facial-recognition search engines. They exist and analysts know their names, but identifying private individuals from a photograph carries harms this page will not promote. The list above stays on the image itself: its origin, its history, and its internal evidence.

Start with the internal evidence: capture time, device, provenance, one verdict.

Run a photo through ChronoVerify