Converting from .heic to .jpg

A file with a .heic extension is an image using the new High Efficiency Image File Format (HEIF).

If somehow you've never heard about it, here are some sample files:
https://trac.ffmpeg.org/ticket/6521

At the time of this writing, not all forensic tools fully support it. For instance, among the tools I have:

• X-Ways Forensics (v19.7 SR-2) does no picture preview or metadata extraction. It has by the way a file carving algorithm for .heic images since version 19.5 Preview 2;
• Magnet AXIOM (v2.5.1.11408) is able to preview the images but it doesn't extract (for now) any EXIF data from the HEIF format;
• Cellebrite Physical Analyzer (v7.9.0.223) stands out from the crowd. If you have a set of images, you can easily view them and parse their metadata by simply choosing: File | Open (advanced) | Blank project | Folder | select the folder containing the pictures to analyze | Finish | Start decoding

Depending on the situation, it could be useful to use external viewers like XnView / CopyTrans HEIC or to convert .heic images to .jpg to make them "compatible" with other tools.

What follows is my method to do the conversion and can be used within a script.

Download and install ImageMagick (free - tested version on Win10: v7.0.8-12 7.0.8-28-Q16-x64-dll). Then open the command prompt and type:

magick SrcFile.heic DstFile.jpg

This will create a JPEG version of the HEIC file, but for some reason the EXIF metadata of the newly created file will be ignored and not parsed by many tools. After some trial and error, I managed to fix this issue with ExifTool (v11.10):

exiftool -overwrite_original -all= -TagsFromFile SrcFile.heic DstFile.jpg

The meaning of each option is the following:

-overwrite_original	Overwrite the destination file without creating any backup copy of the destination file
-all=	Strip off all metadata from the destination file
-TagsFromFile	Copy all metadata tags from the SourceFile into the DestinationFile
SrcFile.heic	Source file
DstFile.jpg	Destination file

If you need to set the filesystem timestamps "last modified date" and "creation date" equal to the ones of the source .heic file, run ExifTool with these options:

exiftool -overwrite_original -TagsFromFile SrcFile.heic -FileModifyDate -FileCreateDate DstFile.jpg

For more details, you may check the ExifTool Documentation.

Additional resources on the HEIF format:

• CCL Blog - iOS 11: HEVC and HEIF (heic) files
• Cheeky4n6Monkey -  Monkey takes a .heic

[UPDATE February 20, 2019]: Thanks to Phill Moore for letting me know that the metadata step described in the article is no longer needed when using the latest version of ImageMagick. Metadata is now properly added to the converted files.

Geotag2kml: python script to create a KML file from geotagged pictures

Sometimes it's not the photo itself that matters, but where the photo was taken.

I needed a tool to parse thousands of geotagged pictures and show them on Google Earth. I wrote a Python script based in part on what was posted years ago in the ExifTool Forum.

My script was written to:

• parse recursively geotagged pictures
• create a KML file to show geotagged pictures on Google Earth
• group and sort GPS data by date
• show visually for each date where the first geotagged picture was taken. Each first GPS point is indicated by the icon of a small man
• connect the GPS points of each date with a colored line
• get the preview of a picture when clicking on a placemark
• list make and model information of each digital camera used to take and geotag the analyzed photos
• speed up my analysis ;)

Prerequisites

• Python v2.7
• Exiftool (rename the executable to "exiftool.exe" and put it in the same folder of the script)
• Google Earth

Usage

Run the script and type the absolute path of the directory containing your pictures. The script will create and save in this path a file named "GoogleEarth.kml".

Download

geotag2kml v0.1

Here are a couple of screenshots.