What’s in a Name? Discovering Clues Hidden in Google Maps Image Filenames
Google Maps is a treasure trove of information for open source researchers. Bellingcat frequently uses the platform’s satellite imagery and street view in investigations, and user-written reviews and user-uploaded images have also been useful in identifying people and places.
One detail that we often don’t think about when viewing an image on Google Maps is its filename, which can provide useful contextual clues.
When a user uploads an image to Google Maps, it automatically gets tagged to a location. This can be a standalone image of a site, or an image linked to a review of a place. Anyone on the internet can view the image, but the filename is not visible by default.
That’s where the Bellingcat Filename Finder can help. It’s a browser extension for Google Chrome that runs in the background and grabs the filename from the data that Google Maps sends to your browser, then it displays the filename over the image in an unobtrusive black box.
After installing the extension, when you come across images on Google Maps on your Chrome browser, the filename for each image should automatically appear on the top left as shown in the example below.
Finding Out When Images Were Taken
If you use an iPhone, you might be used to images called things like ‘IMG_8928.jpg’. That’s just the “IMG” prefix followed by a number that goes up by 1 for every photo you take. This format isn’t very descriptive or helpful for an open source researcher.
But, if you use an Android phone, you might be more familiar with filenames that include the date and time that the image was taken:
- PXL_20240830_150806479.jpg
- IMG20240830150806.jpg
- IMG_20240830_150806.jpg
- 20240830_150806.jpg
These filenames could be useful for researchers trying to chronolocate images or establish a sequence of events at a location. Filenames can also provide hints to the type of device used – the first example above starting “PXL” indicates that the photo was taken on a Google Pixel device. The date format indicates it was taken on the Aug. 30, 2024.
Not all the filenames shown by the Filename Finder will match the image’s original filename. For some images, it seems that Google changes the filename to the upload date, i.e. “2024-08-30.jpg”. Be careful when using filenames matching this format, as they probably refer to the image’s upload date instead of the image’s creation date.
Other Potential Clues
Timestamps are typically the most common information you can extract from image filenames, but this tool can also help obtain other clues – especially when images have been renamed before they are uploaded to Google Maps, as a recent Bellingcat investigation demonstrates.
While investigating suspected links between a company called CasinoMentor and an “AI art” generation website called OpenDream, we found a Google Maps listing for CasinoMentor in Malta, which included the following photo uploaded by the company.
A reverse image search showed that the image was taken in Vietnam, where we also suspected OpenDream’s founders were based.
To better understand the context behind this photo we checked the image filename. This filename turned out to be “CMTeam.jpg”, implying that it showed the CasinoMentor team, and as we found with our geolocation, the team were in Vietnam despite the company’s address in Malta.
Read more about this investigation here.
The Bellingcat Filename Finder was inspired by research by Kolina Koltai.
Featured image: Graphic by Galen Reich.
Bellingcat is a non-profit and the ability to carry out our work is dependent on the kind support of individual donors. If you would like to support our work, you can do so here. You can also subscribe to our Patreon channel here. Subscribe to our Newsletter and follow us on Twitter here and Mastodon here.
