Originally posted by CHRLZSorry, but no, that isn't how it works. You may have proved it to yourself, but all we have is your word. Such 'proof' needs to be repeatable, and so you need to name your methodology. What software was it?

I am a computer programmer, and my specialty is graphics. I created the software my self for a computer forensics agency. I can not tell you the method for multiple reasons.

1: It would allow future hoaxes to avoid detection.

2: It would put me and the agency out of business.

If this was the court of law, I would gladly tell you the method. This is just a conspiracy website, and I don't really care if you believe me or not. That wont stop me from telling you the EXIF data has been altered.

Originally posted by CHRLZ
You only found a few?

Yes, only a few EXIF data inconsistencies. Did you find ANY?

I didn't even mention any other evidence that shows it to be a fake.

Originally posted by CHRLZ
Yes, it's one way. But I'd be questioning other stuff on this image first...

Start with what is provable. Then mention what is questionable.

Originally posted by CHRLZ
Yes (maybe!), and my first question, before even looking at the EXIF, is why on earth is the image only 800x600? Nobody would shoot a S5500 at that resolution, unless they had something to hide.. right, Dave????
(I'm kiddin' around, don't worry!) BTW, is it an S5500? I thought you said it was an S5000, Dave?

And as a point of fact, the S5500 doesn't offer 800x600 as a shooting mode, as far as I am aware. Dave, you're busted.

I agree, that is suspicious. I noticed that too. However, I figured the camera is capable of 800x600.

Originally posted by CHRLZ
It wouldn't be my first step! A little more on that below..

Everyone has different steps.

Originally posted by CHRLZ
Really? . A twade secwet??? And you can't even give us a hint? I do agree that *techniques* to falsify images shouldn't be given out freely, but you can't just make a handwaving claim like that and expect it to be good enough as 'further evidence'. That's ridiculous. Back it up, or don't even mention it.

Once again, yes it's a trade secret that only the forensics agency and I are allowed to know. If this was a court of law, I would tell you the secret after making everyone sign a N.D.A.

Since this is a conspiracy site, all I can do is tell you there is a inconsistency, and then let you find it your self.

Originally posted by CHRLZ
BTW, there are some freeware programs around that can help expose fakery, but there are some very major caveats to their use. I'll talk about them a bit later when I spend more time on the OP image.

Yes, I have created many functions in my software that can expose "fakery".

I have to agree with the rest of your words. There is no point in discussing the image because to my trained eye it is just wrong, it is screams fake. However, professional opinion is not admissible evidence. So, anything else (like EXIF inconsistencies) is the first thing to mention for me.

G'day!

Davespanners asked me to post his explanation.....

He hopes you enjoyed his "puzzle".....

The image IS made by photoshoping a picture one a pc with an LCD screen and then taking an actual photograph of the image on the screen. So all of the EXIF data and things is straight off of my camera and this actual image hasn't been alatered at all it's a photo of an altered image.

Cheers
Maybe...maybe not

Originally posted by Maybe...maybe not
G'day!

Davespanners asked me to post his explanation.....

He hopes you enjoyed his "puzzle".....

The image IS made by photoshoping a picture one a pc with an LCD screen and then taking an actual photograph of the image on the screen. So all of the EXIF data and things is straight off of my camera and this actual image hasn't been alatered at all it's a photo of an altered image.

Cheers
Maybe...maybe not

Mmmmhmmmm...

So, given that I posted this:

... you seem to be avoiding the point - you STILL haven't addressed the simple issue of WHY it was taken at such a low resolution. Doing so indicates you have something to hide (like rephotographing another image or perhaps a montage) or you needed it small just to make it very easy to cut and paste. Either of those, and perhaps more, are possibilities.

..do I get a prize? MMN, I trust you will verify that at no point did I ask you, nor did you tell me, what was the 'problem' with this image..

Truth is, I thought he had perhaps photographed a print, with a cutout ufo. That too would have worked.. But the posterisation of the colours should probably have given it away as an LCD screen. So, you win, Dave , and it's a good reminder of other ways to fake an image. But you *should* have adjusted the exif to make the exposure settings more sensible

Originally posted by gift0fpr0phecy

Originally posted by CHRLZ
You only found a few?

Yes, only a few EXIF data inconsistencies. Did you find ANY?

As I mentioned, I found many inconsistencies in the *image*. The only issues I found in the exif (and I would point out I haven't gone over it with a fine tooth comb for the reasons I made clear elsewhere) were the missing resolution factor, and the glaringly inappropriate exposure settings.

I didn't even mention any other evidence that shows it to be a fake.

Which I find puzzling. Indeed, as you focused your 'investigation' on the exif, I'm puzzled that you didn't comment on the exposure settings - they are clearly ridiculous if the image was supposedly taken on a bright sunny day...

Start with what is provable. Then mention what is questionable.

But we already *know* that exif is NOT evidence, unless it can be proven genuine through access to the original media (and even that is not necessarily 100% provenance..) So using the exif is questionable in itself - there is nothing stopping the source from falsifying, and even adding in deliberate problems to distract from the real issues. In this case, the real issue is that this is simply a re-photographed montage. So the ONLY part of the exif data that might be relevant is the exposure settings. There may be some other reason for the empty resolution line - I wouldn't mind following up on that with Dave on his return. I have a very different Fuji camera at the moment, but I might run some tests and see if it drops that line in any circumstances. It may simply be a firmware issue with some Fuji's when shot at that resolution, for all we know.

Originally posted by CHRLZ
Yes (maybe!), and my first question, before even looking at the EXIF, is why on earth is the image only 800x600? ...

I agree, that is suspicious. I noticed that too. However, I figured the camera is capable of 800x600.

The only reason I looked it up was that I have owned two very similar Fuji's, and neither offered 800x600. The important point is that the small size of the image means it would be easy to fake, in a number of ways.

Everyone has different steps.

Agreed, but I disagree about starting with exif.

Once again, yes it's a trade secret that only the forensics agency and I are allowed to know. If this was a court of law, I would tell you the secret after making everyone sign a N.D.A.

FTR, I'll be using simple, easily available techniques that are readily available to anyone reading this. No handwaving, no mysterious and uncited software...

If you really are involved in proper investigations, then surely it would occur to you that posting such claims using an anonymous login at a conspiracy site is.. well, not very convincing. Especially given that you have only uncovered something that freeware software does quite adequately...

Since this is a conspiracy site, all I can do is tell you there is a inconsistency, and then let you find it your self.

I'm afraid I'm not going to be looking for it, as explained above.

However, professional opinion is not admissible evidence.

Umm, what???? Of course it is, although there are several requirements. Essentially if you are a proven professional/expert and are seen to be impartial, then it's admissible. But here on ATS that ain't gunna happen, so the best thing we can do (and what I am *going* to do) is provide the tools and evidence in a form that can be tested and repeated by anyone. Definitely 'admissible'...

Originally posted by gift0fpr0phecy
CHRLZ, your attitude is disgusting. Drop the big headed ego.

Please stick to the facts, rather than attack the messenger. Show where I'm wrong, and then the truth wins out.

All I wanted to say is that whatever the guy did the EXIF data has been altered during the process.

No, all that you showed was that one solitary line was missing. You have alluded to other inconsistencies, but haven't elaborated. A single missing line could indicate a firmware fault/bug/'feature', or as I mentioned earlier, a simple image rotation (which can even happen automatically in some cameras) can result in the loss of that line. If you are trying to identify whether the exif was deliberately falsified - that missing line does not necessarily mean that he deliberately altered it. Indeed you would have to ask the question - why on earth would you take out a resolution factor?

It could have been caused by many things.

Correct. Yet you seem to have come to the conclusion he altered it...

When starting an investigation, you want to first see if the EXIF data is there, has not been altered, and shows no signs of being run through another program.

When I investigate a CLAIM, I start by reading the supplied description, and then examining the image, leaving the exif till some time later in the process. If you feel you get better results by going straight to exif, good luck to you. And maybe if you have the original media, or someone else is looking at the contextual information, that might be a reasonable approach.

But a LOT of the images posted here on ATS are just like Dave's - small, poor quality, and showing a scene riddled with defects indicating falsification, like the lighting problem in that one,and the fact that the ufo matches a stock ufo image (see my avatar...). I wouldn't bother even asking for exif for such images.

If some guy gives me an image with no EXIF data, I will ask for the original images that contain the data, or else the image is suspect. If the EXIF data is not consistent with similar cameras and or is missing values, I will think the EXIF data has been altered, and the image is suspect. If the EXIF data contains additional "APP" tags, I will ask for the original image, or else the image is suspect. The above 3 tasks are the basics... a starting point. Always start with the basics.. the EXIF data.

I can think of two ways that "APP" tags can be interpreted... but never mind - I think the basics are the story, and the appearance of the image...

Then you can B.S. about image size, aperture, suspect pixels, lighting, etc., when you know you have legit EXIF data in the first place.

Please point out the B.S. in my comments, or apologise for that remark.

Also, there are very small changes in the byte data of the image itself when EXIF data is changed from it's original. That change doesn't show up on an EXIF data and you need an external application, or byte reader to find the change. That is all I can say about the program I was referring to. You don't really need any special tools, you just need to know where to look.

Seriously, you would bother drilling down to that level on an image like Dave's, at a conspiracy forum, and given you don't have the original media..? So tell me, how would you *now* proceed? Dave tells us that the exif is unchanged. You are saying that he is misrepresenting the image and has altered the exif - so what will be your next step? I'm sure Dave will cooperate when he returns. FTR, I'm willing to buy a card to suit his camera, send it to him to take some sample images, and then send that card on to you. In response, i would expect a properly prepared report on the validity or otherwise of the exif data. If such a report came with the proviso that you found x,y,z defects but were unwilling to provide the evidence to prove your assertion, then that would certainly NOT be admissible - I'd be wanting my money back.... I'd be interested to know why the line is missing, but frankly I'm willing to take his word for it, given he has explained what he has done and it was not intended as a serious attempt at hoaxing.

Again, professional opinion is not solid evidence, unless the opinion brings forth facts.

Which is why methodology needs to be open, testable, repeatable, and sensibly applied. When it is, it is 'admissible'.

A quick note before I begin. I'm going to do this off the top of my head - no Googling, no reference to notes. So that means I wll probably leave stuff out, and maybe have to backtrack to stuff if I forget. But I want to do it that way so as to invite others to chime in and contribute - please do!!! If I miss somethign obvious, butt in and correct me! If you think exif-first is a better way, say so, with reasons.


So what is my 'ideal' process? I'm not claiming outright that this approach is the best, or that other approaches may not come to the same conclusion, or even be more efficient. But it is based on real investigative procedures, real science, and a history of experience with photography (both film and digital), imaging and working in the sciences in research roles, and a long history of looking at ufo hoaxes* and misidentifications.

* - A very special Hi goes out to Jaime Maussan and Jose Escamilla.

A couple of basic issues - you will note as we go that a lot of what follows is about identifying/eliminating the 'known'. I concede that what is 'known' can be arguable, but hopefully we can agree that much of it is not really in question.

To take this to a ridiculous extreme, let's say someone posts an image of Donald Duck, claiming it is an alien that he photographed. I think we could probably agree that the claim was not really worth investigating much further, because the image is of something known.. A better example might be a long-zoom video which is accompanied by information about the location, time, direction and magnification, that shows a bright spot and a couple of much dimmer ones in a line. By referencing an astronomy program (and just knowing one's skies) it may well be trivially easy to prove the video is almost certainly Jupiter. Again, no need to go further as a 'known' has been applied, and eliminated the need for a 'UFO' hypothesis (let alone an alien one..).

This process is made simplest by choosing the most simple aspects to investigate first. Ie, the claim itself, and the image's content and appearance.

So let's go... The first and most obvious step is .. to read the claim, and look at the image.

1. The Claim and The Image

As far as ATS-type investigations go, the process usually commences when a claim is made and an image is posted (not necessarily simultaneously). So the very first questions are:

1.a. Does the claim make sense? Is it logical and does it match the image?

1.b. Is the claim well-documented? Do we know the type of camera and what settings were used (the exif data will come in later, here I'm simply referring to what the poster *says* about the image), the location, time and direction the camera was pointed? The timeline of events, if applicable?

You'll notice that at this point, I'm happy to take the claimant's words at face value. That may seem strange, but it is with good reason. What the claimant says may or may not be true, and initially we may not be able to determine that. But by immediately throwing suspicion at the claimant, it is likely they will stop providing information... Clearly the more information we get at the start, the better. Plus it is important to note that this is 'just' witness testimony. Witnesses, even the most honest and well-trained, get stuff wrong. Anyone who denies that is kidding themselves.

1.c. Does the image look plausible? Obviously what is 'plausible' is arguable, but if the image is cartoonishly 3D-rendered or contains elements where the lighting angles just do not make any sense, then it would be appropriate to question that aspect in detail. This includes other considerations as reflections through a window, objects that are blurred in such a way as to give clues as their distance (or lack thereof..), and recognisable objects like buttons.. (grin)

1.d. Does the image look like an original? By simply asking what camera took the image, we can easily determine what size the image should be. (It is true that most cameras can shoot at a number of lesser resolutions, but if that is the case, questions need to be asked.) For someone who has a lot of camera experience, original images from different cameras have 'looks' (things like the nature of the noise, the pixel-level sharpness, lens issues like chromatic aberrations, and so on) that can give away any untrue claims. For example, if I saw the OP image and the claim was that it was taken on a Nikon DSLR (or any DSLR for that matter), I'm afraid that would be the end of the investigation from me...

1.e. Does the image contain obvious optical/digital effects like flares, or digital artefacts like jpeg compression blocks, posterisation, sharpening haloes, excessive blurring or false interpolation detail from over enlargement? Again, many of these effects are easily recognisable by someone with experience, and whilst it can be argued that the 'ufo' might be using super-duper energy fields that caused the blurring, the KISS principle applies. If it is blurred, it is more likely to be out of focus or motion blurred, rather than an alien craft using a hyper-dimensional-plasma-field-effect generator...

....
... to be continued (and I promise to include some pictures in the next instalment)..

Part 2...

So far, we've looked at some basic issues with the claim and the image, and now, I think it's time to .. stand back. We will also get out the magnifying glass (with some provisos that will be outlined in Part 3), but for now, the next step is just to look at the image as a whole.

1.f. What does the overall image tell us? Forgetting the claim for a moment, just look at the complete picture - what can we tell from it? How would you interepret this scene if you had not heard the story? What does it look like at first glance? What time of day was it? What were the weather conditions, and would they affect the image (eg fog, raindrops on windows, sun glare)? Are there signs of motion blur? If there are directional light sources (eg the Sun, or streetlamps) do the shadows and lighting look correct? Are there any road signs or other things (houses, buildings, etc) that might help identify the context?

So let's do that for the original image that was posted. Note that this image is NOT I repeat NOT the full-resolution image that was supplied later. Here it is:

OK, so we have some rooftops, and a blob under a very grey sky - clearly the sun wasn't out, but there are no other clues as to the time of day... As a photographer, the thing I then noticed was the dullness and underexposure. Not that unusual for a picture taken under a gloomy grey sky, but unfortunate as it means there is little usable detail in the 'blob'... The next thing I noticed was the fuzziness of sections of the image. Initially I thought this looked like (vertical) motion blur, but when I took a slightly closer look, the effect is strangely unbalanced - the blurring effect is very noticable at the top of things, like the blob and the roofline, but not so noticable below - note the difference between the top and bottom of the blob... Very odd. Could this effect perhaps come from a very badly aligned lens element?

Now at this point, there is a motivation to zoom in, but here we need to pause, for the traps in enlarging an image are HUGE. So on to the next stage in the analysis - how to (and how NOT to) examine the image in more detail.

First up, the image is clearly not a full-size original - it is reduced. Whenever you reduce an imge and re-save it, there are two nasty things that happen:
- you lose detail. The smaller the image, the less detail.
- (if it is saved as a jpeg) new artefacts, especially around the edges of objects, will be introduced on resaving. FALSE detail. Detail that was NOT part of the scene. The more compression used, the more (and uglier) false detail is produced. Not only does jpeg compression cause false detail, it also reduces the colour quality and may introduce 'posterisation' - visible banding in color gradients. More about that later..

Even a casual glance at the OP image shows horrible jpeg artefacts, eg the haloes around the blob and the faint rectangle (which is a jpeg 'blocking' artefact) that surrounds it.

Clearly, enlarging this image on screen is going to make all of that image corruption more obvious. Take a look, this is the blob from the OP image, placed next to a crop (magnified 200%) from the higher resolution original for comparison:

For the record, I have used non-interpolated (more about that in next instalment) enlargement to magnify the right hand (full-res) image by 200%, and then similarly enlarged the left hand image to get to roughly the same size. I also adjusted the 'gamma' of both images (to ~ 0.7) to better show the artefacts.

It's pretty clear why you should ALWAYS try to get hold of the full-size original...!! All of that junk around the left hand image (including the rectangular jpeg blocking that some have misinterpreted as copy-paste evidence) came from the reduction and re-saving that was done to that image. It's ALL false. The full-res one does have some artefacts (and shows 'noise' that has been wiped out of the other during the reduction), but it is obvious that the left hand image is almost completely worthless and should never have been used for magnified analysis.


But there's yet another trap!! When you enlarge an image beyond 'actual size' or 100%, you are at the mercy of the software you are using. Most likely, that software will use one of a number of enlarging techniques called 'interpolation'. That means they try to smooth out the pixel edges by *guessing* what would be there. MORE false detail!!! Just what we need.. In the next instalment, we'll look at magnifying an image, how not to do it, and some (free) software that allows you to magnify WITHOUT interpolation (like I have done above)..

Jjx, can you explain how you would recognise a jpeg compression block?

I'll be covering this in some detail later on and it's a VERY important question in this case - (that's a HINT), so you might want to get in first, do a bit of research, and hopefully have an "AHA" moment. That will be followed by a realisation that your claim about it being 'proof' of a cut and paste was incorrect.

---

---