Metadex

Image forensics for the details you can’t see

A photo shows you the image. Metadex helps you inspect the rest of the file.

Inspiration

Images can carry information that never appears in the picture: metadata, comments, encoded text, or bytes appended after the image data. Reviewing those details by hand can be tedious, especially across a folder of photos.

We built Metadex to make that first review easier. It brings image scanning, evidence review, visual search, and plain-language explanations into one workflow.

What it does

Metadex scans a single image or a folder and checks for:

EXIF and file metadata, including dates and camera fields
Image comments, such as ImageDescription, UserComment, and XPComment
Encoded text, showing stored text and decoded content when possible
Appended bytes beyond the image’s normal end

Results are grouped into Suspicious and Normal sections. Open a file to review recovered comments, view its full metadata in a details panel, or download the scan results as JSON.

Metadex also supports natural-language visual search. Search the scanned collection with a description such as black cat; OpenCLIP ranks the images by similarity. The search results filter and reorder as you type, and the progress bar shows when the collection is being indexed.

Gemini can explain scan findings in plain language. Metadex presents indicators for review; an unusual field or a search match is not, by itself, proof of an attack.

How we built it

The web app sends image files to Metadex’s Python checker for analysis. The checker extracts metadata and comments, inspects file structure, and returns results for the dashboard. The command-line interface can scan a single image or a directory, including nested folders.

OpenCLIP powers visual search across the scanned collection. When deployed on Vultr GPU infrastructure, the model can use GPU inference to rank image matches.

The Learn page introduces image metadata, encoded content, least-significant-bit concepts, appended bytes, and privacy through a short, scrollable walkthrough.

The hardest part

The hardest part was making the results useful without treating every unusual value as proof of malicious activity. Image files can contain unexpected data for harmless reasons, and encoded strings may not always be meaningful.

We focused on showing the evidence behind each finding: what Metadex checked, what value it recovered, and which result deserves closer review. We also kept the suspicious and normal groups separate and made detailed metadata available only when someone opens a file.

What we’re proud of

A single workflow for scanning one image or a whole folder
Recovery of image comments, with encoded text shown in stored and decoded forms when possible
Separate Suspicious and Normal result groups
A details panel that keeps the main report readable
Terminal scanning alongside the web interface
Visual search across the same scanned photo collection

What we learned

Building Metadex showed us how much information can live outside the visible pixels of an image. It also taught us that a forensic tool needs to show its work: a useful result should explain what was found and leave the interpretation to the person reviewing it.

Team contributions

Hamza Elashry — Backend: Built the Python image-analysis service and connected scanning results to the application.
Mohamed Elashry — Frontend: Built the dashboard and the interface for uploading images, navigating scan results, opening metadata details, and searching the collection.
Marwan Elashry — Cybersecurity: Focused on the forensic aspect, terminal integration, & contributed to both backend & frontend.

Built for Technica 2026

Metadex was built for the Vultr, Gemini, Educational, Best UI/UX, Cipher Tech, and Startup tracks.

Try it

Web app

npm install
npm run dev

Drop a folder of images into the local site, or scan the cat-photos-350 folder in this repository. It contains 350 cat photos, including a synthetic conversation planted in image comment fields for testing recovery.

After the scan:

Switch between Suspicious and Normal.
Open a file to inspect recovered comments and decoded text.
Open Details to review the rest of its metadata.
Search the collection by visual description.
Ask Gemini about the scan. Set GEMINI_API_KEY in .env.local before starting the site.
Download the full results as JSON.

The checker listens at 127.0.0.1:8741. If the site says it is not running, start the API from packages/metadex-py and try again.

Command line

python3 -m pip install -e packages/metadex-py
metadex ./photo.jpg
metadex ~/Pictures

Run Metadex on a single image or a directory. Nested folders are included. Add --json to output the full result instead of the summary.

Tech stack

Tools	Role
React, TanStack Start, Vite, TypeScript, Tailwind CSS, Framer Motion	Web app
Python, FastAPI, Pillow, piexif	Image analysis and metadata extraction
Gemini	Plain-language explanations of scan findings
OpenCLIP, PyTorch, Vultr	Visual search and GPU inference
Docker	GPU deployment