Every file format File X-Ray inspects

File X-Ray reads the hidden metadata inside 60 kinds of file - images, camera RAW, video and audio, documents, mobile apps, executables, fonts, archives and forensic formats - entirely in your browser. Pick a format to see exactly what it reveals.

JPEG (.jpg .jpeg) - EXIF, GPS, camera make/model/serial, lens, thumbnail, IPTC, XMP, C2PA, AI parameters
PNG (.png) - Text chunks, AI generation parameters, XMP, ICC profile
TIFF (.tif .tiff) - EXIF, GPS, IPTC, camera and software
GIF (.gif) - Dimensions, colour depth, GIF version
WebP (.webp) - EXIF, XMP, ICC profile
HEIC / HEIF (.heic .heif) - EXIF, GPS, depth map, HDR gain map, tiled-image hidden pixels, colour signalling (CICP), stored rotation
AVIF (.avif) - EXIF, XMP, ICC profile
JPEG XL (.jxl) - Brotli-compressed EXIF and XMP, C2PA manifest, codestream header, hidden preview
MIE (.mie) - Camera serial, owner name, GPS, place, timestamps, keywords, multilingual comments, and the whole file it wraps with its original filename
JPEG 2000 (.jp2 .jpf .jpx .jpm .j2k .j2c .jpc) - Carried EXIF, XMP and IPTC blocks, GeoTIFF ground position, free-form XML, encoder comment, colour profile
Photoshop (.psd .psb) - Hidden layers, source-photo EXIF and GPS, IPTC by-line, document ancestors, slice names, editor
SVG (.svg) - Editor and version, local export paths, embedded scripts, Dublin Core creator, edit history
Canon RAW (CR2) (.cr2) - Body serial, owner name, lens, shutter count, GPS, full EXIF
Canon RAW (CR3, CRW) (.cr3 .crw) - Body serial, owner name, lens, shutter count, GPS, full EXIF
Nikon RAW (.nef .nrw) - Body serial, lens serial, shutter count, GPS, full EXIF
Sony RAW (.arw .sr2 .srf) - Internal serial, shutter count, lens, GPS, full EXIF and maker notes
Fujifilm RAW (.raf) - Body serial, lens, film simulation, GPS, full EXIF
Panasonic RAW (.rw2) - Body serial, lens, GPS, EXIF (a reduced set on Sigma X3F, Leica RWL and Minolta MRW)
Olympus RAW (.orf) - Body serial, internal serial, lens, GPS, full EXIF
Adobe DNG (.dng) - Full EXIF, GPS, camera serial, original raw filename, edit history
More RAW (.pef .srw .3fr .dcr .kdc .x3f .rwl) - Body serial, lens, GPS, full EXIF
RAW we do not rewrite (.fff .mrw .mos .iiq) - Body serial, lens, GPS, full EXIF
PDF (.pdf) - Author, XMP, producer, embedded camera serial, IPTC contact, incremental edit history, hidden layers
Word (.docx .docm .dotx .dotm) - Author, last-saved-by, company, manager, editing-session lineage, macros, hidden text, sensitivity label
Excel (.xlsx .xlsm .xltx .xltm .xlam) - Author, two absolute save paths (username and last-saved location), sheet names, macros
PowerPoint (.pptx .pptm .potx .potm .ppsx .ppsm .ppam) - Author, speaker notes, hidden slides, external hyperlinks, modern authors list
Visio (.vsdx .vsdm .vssx .vssm .vstx .vstm) - Author, last editor, company, template path, create/modify history, custom properties, digital signatures
Legacy Office (.doc .dot .xls .xlt .ppt .pps .pot .msg) - Author, last-opened-by, retained revision log, send-for-review email trail, macros; for .msg: sender, recipients, originating IP, mail client, message-ID
EPS / PostScript (.eps .epsf .epsi .ps .ai) - Creator application, author, "created for" name, creation date, PJL username/host, embedded preview, colour profile
OpenDocument (.odt .ods .odp .fodt .fods .fodp) - Initial creator vs current author, generator, editing cycles, total edit time, template path
Rich Text (.rtf) - Author, company, generator, creation and revision dates, edit minutes
EPUB (.epub) - Adobe DRM account ID, every identifier, calibre library data, contributors, dates
Kindle (.mobi .azw3 .azw .prc) - Purchase watermark, account-linked keys, ASIN, retail price, rental expiry, purchased vs personal
iWork (.pages .numbers .key) - Author, application version, document properties
MP4 / MOV (.mp4 .mov .m4v) - GPS location and full track, GoPro camera serial, satellite time, purchaser Apple ID, C2PA / AI-generated
Matroska (.mkv .webm .mka .mks) - Title, encoder, muxing app, creation date, tags, track languages
MP3 (.mp3) - ID3 tags, file owner and licensee, ownership frame, cover art, popularimeter email
FLAC, WAV & more (.flac .wav .m4a .ogg .aiff .aif .wma .ape .wv .mpc .mp+ .dsf .dff) - Native tags, broadcast WAV originator, purchase atoms, cover art, archival location
DICOM (.dcm .dicom) - Patient name, ID, date of birth, physicians, hospital, study description, de-identification claim, burned-in text
GPS tracks (.gpx .kml) - First point (often home), full track and route, named places, author, contact details
Email (.eml) - Origin hop IP and hostname, hop count, originating IP, SPF/DKIM/DMARC result, sender-vs-return-path spoof tell, tenant ID
Calendar (.ics) - Attendees, location, organizer, meeting links and dial-in passcodes, record timestamps
vCard (.vcf) - Name, email, phone, postal address, birthday, organization, social handles
ZIP & ZIP-based packages (.zip .jar .whl .idml .sketch .kra .xd) - File listing, Unix user and group id, unsafe paths, macOS Finder origin, and the package metadata inside a wheel, jar, IDML, Adobe XD, Sketch or Krita file: author name and email, company, build tool, JDK, document and instance IDs, editing sessions and total editing time
gzip (.gz .tgz) - Original filename before compression, modification time, host operating system, and the tar inside a .tar.gz
TAR (.tar .tgz .tar.gz) - Owner account name and uid/gid, full file listing, link targets, setuid files, per-file timestamps
RAR (.rar) - Full file listing, sizes, per-file timestamps, host operating system, encryption state, multi-volume and solid flags
7z (.7z) - Format version always, plus the file listing, per-file timestamps and Unix permissions when the archive stores its index uncompressed
BitTorrent (.torrent) - Trackers, creation date, client, complete file listing, private flag
SQLite (.sqlite .sqlite3 .db) - Recoverable deleted rows, schema, recognized app databases, journal mode (flags a -wal companion), writing application
Apple plist (.plist) - Property keys and values, account emails, paths carrying the username, device and app configuration
Executable (.exe .dll .so .dylib .elf .ko .com .sys .drv .ocx .cpl .scr .efi .ax .axf .mui .node .winmd .bundle) - PDB build path with username, code-signing certificate and signer, version resources, company, entitlements, embedded URLs
Android app (.apk) - Package, permissions, embedded API keys, signing-certificate fingerprint and identity, exported components, debuggable flag, SDK levels
iOS app (.ipa) - Bundle ID, privacy manifest (tracking domains + collected data), entitlements, provisioning team, backend/associated domains, build-machine OS
Web font (WOFF, WOFF2) (.woff .woff2) - Designer, foundry, licence and licence URL, vendor URL, copyright, trademark, unique font ID
Font (.ttf .otf .ttc .otc .eot .dfont .pfa .pfb .pfm .afm .acfm .amfm .t1 .pt1) - Designer, foundry, licence and licence URL, vendor URL, copyright, trademark, unique font ID, digital signature
Windows shortcut (.lnk) - Target path with username, working directory, MAC address, origin machine name, volume serial
XMP sidecar (.xmp) - Creator, edit history, rights, GPS, document IDs
Apple AAE sidecar (.aae) - Edit admission, adjustment type, editing app bundle ID, adjustment format version, decoded edit parameters
Any other file (unrecognized) - Usernames in paths, emails, IPs, MAC addresses, GUIDs, AWS keys, private keys, JWTs, byte entropy