extract-metadata
Extract embedded metadata, detect MIME/extension mismatches, and compute SHA-256 hash from forensic evidence files to verify authenticity and origin.
Instructions
Extract metadata from a forensic evidence file. Runs the real file --brief --mime-type command to detect the actual MIME type, compares it against the file extension using a bundled magic-byte signature database to detect MIME/extension discrepancies, runs ExifTool to extract embedded metadata (camera, GPS, timestamps, dimensions), and computes a streaming SHA-256 hash of the file. Use this tool for metadata extraction, MIME-disguise checks, and file hashing. All results come from actual command execution against the file bytes — no fixtures or mocks.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| filePath | Yes | Absolute or relative path to the evidence file within the evidence root (e.g. /evidence/suspect_photo.jpg) |