Firstly, thank you to both Missthinks and OrganicAnagram33 for sharing the
original untouched photographies.
I've done a little work on these interesting photographies that I will try
to expose here. Please bear with me as English is not my native language!
As lot of work have already been done on it, I will not use again neither
ELA nor Photoshop to prove or disprove any point.
My work here will be based solely on EXIFTool (From Phil Harvey, see here)
and JPEGSnoop (From Calvin Hass, see here).
As pointed out before by GiftofProphecy, and this is an important point, there
are some discrepancies between the EXIF datas of our photography and another
from the same camera. We will see in this study if this is a "proof" of the photo
to have been faked.
The main reason why I asked for the original photography taken a few seconds
apart and without the "ghost" is that I wanted to do some comparisons:
Lets call the photography with the ghost "ghost001" and without it "ghost002"
I also choose 16 photographs test, all taken with an original Sony DSC-W55
and each one from various sources (see the three sources references at the end).
(1) Comparisons between ghost001 and ghost002:
- Using Exiftool:
- Firstly, there's a 100% match between the exifs datas names and positions
on both photos. However, there are a few differences between the values:
1- Shutter speed (Exposure time) is sligthly different
2- ISO 100 for ghost001 and ISO 200 for ghost002
3- They were taken (unless time/date exifs stamps weren't set) in 2008 June
25th, at respectively 14:06:16 and 14:06:25 (9s apart). OrganicAnagram33 said
in its first post that they were taken in 2007, I guess that either there's
a problem that the date/time set or that it's a mistake from the OP)
4- Flash was fired for both photographs, but the return was detected only in
Points (1), (2) and (4) can explain the differences we see in these photos,
i-e hue, contrast, etc....
- Using JPEGSnoop
The camera is not in the database, so the assessment "4" is not a surprise,
but this is not the interesting part about JPEGSnoop here.
The main thing that JPEGSnoop is able to do is to search for a JPEG
compression signature, given in a 32-digits number/letters in the result.
This signature characterize the way the camera compress the RAW datas into
a JPEG file; it depends on many factors such as firmware for example.
A single camera can produce different signatures compression for an original
photo, depends of camera settings at the time the shoot was made. (ISO,
So let's compare compression numbers/letters of both photos:
Compression signature are not the same.
(2) Comparisons between ghost001, ghost002 and "photos-test":
- Using Exiftool:
This work was already done by GiftofProphecy and all the EXIF datas of my 12 photos-test
are conform to what he have found.
Interestingly, there are absolutely no differences between EXIFS tags names and
positions when comparing the photos-test between themselves, except that two of
these photos (DSC00007 and DSC00013) have the tag "JFIF Version"
added after "MIME Type", which is the
file format, referred to as the JPEG File Interchange Format (JFIF), for file-based interchange of images encoded according to the JPEG standard and
is of no consequences in the validity of the photo.
- Using JPEGSnoop:
Here are the compression results for each of the 16 photos-test and ghost001 and 002:
Note that there are always the same pairs of compression digit-numbers/letters, sometimes
flipped, and that they are found twice in all my examples, except for photos n°
DSC0007 and DSC00013 that have the same compression digit/number of our two "ghost
photos" and that are also the only one to have the "JFIF Version" in their EXIF
This could be a clue of the origin of the discrepancies in the EXIF datas.
JFIF Version did not appears in the EXIFS datas of both ghosts photos though...
Note that any use of a post-process software will inevitably modify this compression
signature in a way that the 32-digit number/letters will not be anymore
the same as the original photo. (See (3) below)
(3) Tests with various post-process softwares:
I will not fully detailled all the test that I've done here, as it will be a long
and boring talk, it can be easily reproduced anyway.
None of my tests was able to modify the EXIFS datas in a similar way of those of the
let's take a look at how JPEGSnoop react to these modifications.
Only one photograph and the results will be shown here.
The photo-test that was used:
Any use of Photoshop (with "Save as", as "Save for the Web" strip the EXIFS datas...),
PAINT, PAINT.NET, PICASA, etc... will result in the file to be sort
as "class 1" assessment, "Image is processed/edited" and with a # compression number.
While it's very easy to remove in the EXIF any tampering related datas, it still
leave a different compression number, which is much harder to modify and match to
an original one.
Opening it in any viewer do not modify this JPEGSnoop assessment, but modify the
compression number anyway. Then, using Microsoft Viewer modify this number as if
it was done with a post-process software, such as Photoshop or PAINT.NET.
Anyway, GIMP allow users to keep intact EXIFs datas and compression as well, and
Giftofprophecy was right on its assumption that GIMP could have been used:
Unless the compression of a possible tampered (with basic tools) area of the ghost photo have been
modified to match those of the photos-test, (which is not impossible, but hard
to do without leaving any traces) plus the EXIFS datas tampered with to hide any
manipulation, the compression digit-number/letters of JPEGSnoop results couldn't
have been the result of any post-process modification.
Another easier possibility is the use of GIMP with the value advanced default options
"save the EXIFS datas" on, which leave intact both EXIFS and compression level.
At this point, and using only EXIFs datas and JPEGSnoop, it's impossible to say that the
photos wasn't tampered with.
It will be helpful for further investigations if the OP could provide us some photographs taken
with the exact same camera, and of course without any modification.
I also will try to find other photograph examples on Internet that exhibit the same EXIF anomalies;
maybe there's another firmware for this camera that gives differents EXIFs.
Now, if there was any modification, it could have been made using GIMP that don't leave any traces,
however, that alone do not explain the discrepancies in the EXIFs datas plus I don't see the point
for an alleged hoaxer to modify these EXIFs without removing useful camera technical informations,
but only randomly change their order! Unless the used of a post-process software automatically allow that, that I'm not aware of any.
A thorough examination of the "ghost" don't shows any traces, anomaly or visible manipulation.
Another point that have already been done by many here is that the flash was fired and that this
could well simply be the reflection of something (bug, fly, butterfly, whatelse....)close to
the camera that reflect the flash light to over-saturated the CCD sensor.
A final word to say that there are other means to determine wether a photo have been tampered with,
as for example the chroma subsampling value examination. I will talk about this point later.
So what we have so far is either:
- A hoaxer using GIMP and that don't correctly knows how to fake EXIFS datas
- A genuine photography of a ghost
- A genuine photography of something natural in front of the camera flash.
edit on 23-5-2011 by elevenaugust because: (no reason
edit on 23-5-2011 by elevenaugust because: (no reason given)