Add jpeg exif parser

plaso/data/formatters/generic.yaml

@@ -489,6 +489,26 @@ short_source: 'JAVA_IDX'
 source: 'Java Cache IDX'
 ---
 type: 'conditional'
+data_type: 'jpeg:exif'
+message:
+- 'Width: {image_width}'
+- 'Height: {image_height}'
+- 'Manufacturer: {manufacturer}'
+- 'Model: {model}'
+- 'Serial number: {body_serial_number}'
+- 'Software: {software}'
+- 'Latitude: {latitude}'
+- 'Longitude: {longitude}'
+short_message:
+- 'Width: {image_width}'
+- 'Height: {image_height}'
+- 'Manufacturer: {manufacturer}'
+- 'Model: {model}'
+- 'Software: {software}'
+short_source: 'JPEG_EXIF'
+source: 'JPEG EXIF Metadata'
+---
+type: 'conditional'
 data_type: 'kodi:videos:viewing'
 message:
 - 'Video: {filename}'

plaso/data/timeliner.yaml

@@ -699,6 +699,12 @@ attribute_mappings:
   description: 'Content Modification Time'
 place_holder_event: true
 ---
+data_type: 'jpeg:exif'
+attribute_mappings:
+- name: 'exif_datetime'
+  description: 'EXIF datetime'
+place_holder_event: true
+---
 data_type: 'kodi:videos:viewing'
 attribute_mappings:
 - name: 'last_played_time'

plaso/parsers/__init__.py

@@ -17,6 +17,7 @@
 from plaso.parsers import fseventsd
 from plaso.parsers import ios_discord
 from plaso.parsers import java_idx
+from plaso.parsers import jpeg_exif
 from plaso.parsers import jsonl_parser
 from plaso.parsers import locate
 from plaso.parsers import macos_keychain