Research, develop, consult and educate




Paterva Maltego Plugins

Paterva's Maltego is an open source intelligence and forensics application. It offers timous mining and gathering of information as well as the representation of this information in a easy to understand format. The functionality of Maltego can be extended through the use of additional entities and transforms which permit the inspection and correlation of alternate data sources.

GPS Image Forensics

A local Paterva Maltego transform to work with image EXIF GPS data; able to:

  • See images taken in the same location based on road, town or city.
  • See images taken in the same location but with different devices based on serial number (if available).
  • See images taken in the same location but with different types of devices based on make and model.
  • See images taken in the same location but altered via software later.
  • Search for images taken in a certain location across your acquired set.

This extension is designed for forensics or case investigators, who have to work with photographic images. This transform extension for Maltego works entirely locally and does not need any images to be sent off-site for analysis. Instead a local repository of images can be interrogated and the power of Maltego leveraged for effective relationship identification. For example:

  • GPS data can be extracted, and then analysed using existing Maltego transforms to produce address or broader town level locations.
  • Alternatively our local transforms can be used to search for images taken in a specific location.
  • For a demonstration and more information, please see our blog post.

Transform in Action

GPS Image Forensics Screenshot

Features

The Recx GPS Image Forensics package has the following features:

  • Eight new local transforms:
    • Two for initial file identification.
    • Six for data extraction.
  • Three new Maltego entities.
  • The capability to visualise image relationships using Maltego.
  • Use a location to search for images matching a road, town, city, state or country.

Prerequisites

Recx's GPS Image Forensics require an installed and working copy of Paterva Maltego. At the current time our software is only compatible with the Microsoft Windows (we recommend Windows Vista or Windows 7) version of Maltego. We currently support the following versions of Maltego:

  • 3.0.4
  • 3.1.0

In addition, an active Internet connection is required to resolve the GPS coordinate to physical locations.

Licensing

The transforms are licensed on a per-seat basis. This means for each installation of Maltego, you will need a dedicated license to utilise our GPS forensics transforms. All individual sales can be processed online using our NoChex button at the top of this page.

For bulk, enterprise or site-wide license sales please get in touch for a quote.

Sub Licenses

The icons used in the product are produced by pixel-mixer.com and are licensed under the Creative Commons Attribution Share-Alike license.

Documentation

We've produced an extensive online guide to the transforms, which covers installation, first use, power users and troubleshooting.