Some analysis with JPEG snoop

[Gfamad]

Well, very interesting all that. I can see two way to understand that:

1/ Those pictures are real, and were saved at least one time with photoshop. (Or another adobe product, but I only know Photoshop).

2/ Those pictures were processed by Photoshop. BUT the hoaxer forget to modify by hand all EXIF tags. But as you said knowhow, they used many kind of camera... Grrrrr.... I undersand why you are studying it since one year !

Well, it seems to be a dead end. I really don't know what to think of that. Well, I'm at work now, and I will study it this evening (night  ).

[knowhow]

Gfadam & others
Here's how I think any software handles an imported image.  The first and highest priority is to not make any change to the image data that the user does not make himself.  On the other hand, if the user makes changes then what he did with the importing software must leave a pedigree mark on the image data field. The simple clicking of the "quick fix" button will place the whole string of traceable software identities into the image data field.  I believe the Raj photos were handled this way because the software identities were all placed in the same zone of the image data field.  You can see that this would include the TIFF which is used to process the text on the major boom.
On the other hand what seems almost certain to me is that there was not any substantial editing of the image because there is not a major distribution of identities across the image.  If I draw a line here and there, these insertions will be randomly spread in the data field. If I take a picture of a pole and then try to insert another picture of say the drone model, all this history is there for analysis. I see nothing of it in the Raj photos.
I am certain there are forensic photo people out there with much higher familiarity with image data fields than me.  But I know drawing and modeling software as well as anybody and there are no fingerprints of that sort of activities in the Raj image data fields.
Of course, the other news is that the images from other photos do not seem to use Photoshop from Adobe.  There are two photos, one the Big Basin area and the other Birmingham which each use an Apple Computer for the photo processing.  Still another that uses Intel with an ancient version.  It seems to me that if one considers the overall drone scenario, a hoax is totally out of the question.
Let's say that Raj did get a picture of an airborne drone and attempted to put some Japanese Hiragana on the main boom.  As far as I know, even the Japanese version of Photoshop does not easily allow you to create characters that are not Hiragana characters. But for absolute certainty, if you attempt to insert the "Label" say from a Japanese 747 onto the boom of the drone, the fingerprints of that activity will be in the photo image data field.
I will continue to snoop around and my hat off to Gfadam for getting me going where I should have gone months ago.
knowhow

[knowhow]

Looks like the LMH scanner/computer combination at least for one of the Ty Drone photos went thru Adobe Photoshop cs2 version into a MacIntosh Computer.  I could see no sign of subsequent modifications after the scan.
knowhow

[Gfamad]

Good work knowhow ! And Highly interesting !

A last thing that I wasn't aware off: That the EXIF data keep track of all the work you made on it. Are you sure of that ? If it's true, all that could be a PROOF of the reality of the pictures !!!! ( Remember, the data were not modified by hand because there is still the Photoshop mark, and the supposed Hoaxer should have erased those finger prints !)

But (there's always a BUT !) maybe some pictures format don't handle meta-data. (Need to investigate).
Suppose:
-Take a JPEG photo with a camera
-Open it with Photoshop.
-Make all the work....
-Save the result in BMP (it's an exemple, I don't know if BMP handle meta-data, I'm still at work and I can only guess !)
-Close Photoshop (or close the picture)
-Reopen the BMP Image.
-Save it in JPEG format...

....

I'm not agree with myself on this point ( lol, it came to me while I was writting !) because the lost of EXIF data should also lost EXIF data like Camera used, Focal, etc....

So, if you're right, if there is a stack of modification in EXIF data, then we could have a strong proof that those photo are real ! Maybe a great step ?

Very very very interesting....

GFA-MAD

[knowhow]

Gfamad
Always at the beginning of an image data field, there is the exif and jfif data field for about 80 characters.  This primarily has to do with the camera settings and finally the type of camera which is normally without code and just in plain asci text.
Then mixed in with the entire image are various data fields which allow image processing software to enter its pedigree when the user makes any changes to the image file.
A rastor image, bitmap, is primarily for color control of typical scenery in an image with higher resolution.  If you import the image into say MS Paint, a simple, cheap and low memory image modifying software from msft, and say enter a line or a label, then along with the user modification goes the MS Paint version and certain coding to allow a future analysis of what was done. The software looks for places to place the pedigree according with its exporting algorithm.  These things are all quite trackable in photos.
If now you save the bitmap format in jpeg option, then a data compression algorithm compresses the file length by combining things that look alike such as blue sky, grass blades, etc.
If you have a little more sophisticated software such as Photoshop CS3 or licensed versions for scanners and certain computers, then there are options like "quick fix".  I seldom use a flash and even took a picture of the lunar eclipse in nearly total darkness.  The quick fix button seems to make a major repair to almost anything I can screw up.  I call it the cardiac relief button.  It is a fairly sophisticated piece of software which goes thru the image and checks for color balance, focus, sharpness and makes a stab at where you should have had the camera set.  Works most of the time but sometimes takes the image someplace you don't want to be like with sunset and sunrise pictures.  Once the algorithm is done and you click ok, it then goes to the image data field and places all the identities of the image software pedigree, in this case a specific location and major grouping of information.
On the other hand, if you attempted to merge two photos or add information from one photo into another, this is a much more complex operation and requires multiple engagements between the image processing software and the original image. The algorithm to insert this information into the image data field is much more complex and the decision process more difficult to follow.  But by the nature of being spread out, is very detectable in simple scans of the data.  Generally this information is coded and exactly what it reflects is only known by the software developer.  But it is obvious when it exists.
If you decide to look at the image data fields be prepared to look at megabytes of data because the rastor image data is mixed in with it. What I have done is written a program to look for certain types of data such as the simple string "id:"  This is universily used before various identity fields and that is how the Raj CS2 Photoshop ID came up.
Hope this helps
knowhow

[Gfamad]

Thanks for the explain.

Well, I know a little about image coding because I have looked for several encoding algorithm  (ten years ago I also looked how the JPEG work) and on my HP48Gx I created a program to display 4 grey scale pictures ! And I also added a basic compressio algorithm.

But maybe I have missed something with modern image format. Correct me if I'm wrong:
-The JPEG, except on the begining (like you said, EXIF data and Meta Data from photoshop) contains only a flat pictures with no layers, no ? There is no extra data "inside" the data of the raster image ? So even if you merge two pictures in one, there will be no extra data, and the final JPG will be a single layered picture. No matter the tools you are using (an eraser for exemple).

Well, I don't want to bore you with all my questions, and I'm gonna practice with some pictures. And each time I will check the data.

But thanks for your help. I think we are going in a good way.

Gfamad

[knowhow]

Unlike a chemical film which simply converts photons to chemicals, a digital storage device stores things just like old punched cards with organization like allocation tables (your bios on your computer).  Every so often in the file there is a data section which allows the image to change color ratios, sharpness, etc.  When you use jpeg to compress the photo, the compression data is in this area. If there were no data locations, you could not compress the file because you wouldn't know how to compare pixels that were similar.
In your HP 48 you might be getting exited before you get very far into the data file and not really getting past the first rastor data.  The data I posted from picture 16 and 17 was down about 10% into the file, far beyond the first 80 characters for exif.  Remember 80 characters descends from punched cards which had 80 characters across the long way of the card.
knowhow

[Gfamad]

OK, I'm OK with that. That's what I know in fact, but as I said, English is not my native language, so it's hard for me to understand at 100% all what is said here.

My work is nearly finished, and I have bad bad news. I really hope Knowhow I made a mistake and I hope you will counter ...

Gfamad

[leviathan]

You will always be left with the chance of HOAX and there may be those who are more comfortable with HOAX.  It is time to say "So be it" or more importantly So Mote It Be.  The DRT have done an admirable job, but this site has its enemies some dressed as sheep and Dronies.  The Drones can die for now, but we have made sure their resurrection will come.  This is a characteristic of this phenomena and anyone who is interested in the longevity of an event must consider this and plan for it.  That has been done.  This Drone/Isaac event now has sufficient status and exposure to out live its detractors literally.  If you do not understand what we (9) are referring to just look around or ask around and you will understand.
As always, be seeing you in time.
L E V I A T H A N

[Gfamad]

First Leviathan, I came here because I wanted a serious place to study those strange Drone. I'm not here as a detractor, you can believe me !

But in a study, if you find things that are not in the direction you want, what MUST we do ? Simply hide it under a carpet ?

Like I said, I would like Drones to be real, and for me it's must comfortable to find that they are real. But what if they are not ?

I do agree that DRT did and continue to do a great work on it. It's a very interesting work, whatever it is. And I personnaly believe UFO are real (whatever they are).

I saw ennemies on DRT on other forums, and as you can check (my Pseudo is always Gfamad or GFA-MAD, check on youtube, a program I did 'Livrant' or my (outdated...) Blog !) I've never spoke about drone on other place. I'm here to respect the work that has been done, and not to claim 'Real' or 'Hoax'.

I'm only studying this case and tell you what I found, only that. I'm here to help, if I can of course !

Well, I'm going on what I was doing before this reply !

Gfamad

[10538]

I don't think Lev was directing any of his comments at you Gfamad.  You are doing fine.  Keep digging.  Who knows what you might uncover.  I too think it unlikely a hoaxer would go to the proportions in this case and then miss removing the photoshop tags.

Remember we may be dealing with people (the photo witnesses) who have no idea how much hoaxing goes on.  For that reason they would never understand that some tweaking or instant fixing could be conscrewed as a attempt to hoax.

[Gfamad]

Well, let me explain what I found.

First I have only worked with Raj photo.
Second, we have found that at least, the pictures where saved with Photoshop CS2 windows.

At this point, the only thing that we can say is that the photo were not directly taken from the memory card and put on the hard drive. It passed throw Photoshop.

But there is more... I found this simply by examinating the files with Notepad !

When you save a Picture under Photoshop, it gets two Id: An InstanceId, and a DocumentId (I will talk only about the DocumentId)

But when you are saving AGAIN your work, it also keep track of the last documentId from where it came frome. You can find those data after the DerivedFrom tag.

So let's see the story of a photo I took with my personnal camera:

-First photo taken from the Memory card: No Meta Data except the Exif data.
-Then I save this image with Photoshop: It gets a DocumentID. But NO DerivedFrom:DocumentId
-Then I save it again with Photoshop: It gets a NEW DocumentID and it gets a DerivedFrom:DocumentId ! And of course this last number is the same that the documentId where it came from.

Here is the results of test I have done:

Original photo taken from my camera (PIC1):

No Meta-Data after the EXIF data (or not visible !)

Original photo saved one time with Photoshop (PIC2)

xapMM:DocumentID="uuid:AE99BC821263DD119FEAF7D6B9E8CD07"
<xapMM:DerivedFrom rdf:parseType="Resource"/>

PIC2 with colors corrections and play with Eraser Tool (PIC3):

xapMM:DocumentID="uuid:2C6DE19F1363DD119FEAF7D6B9E8CD07"
<xapMM:DerivedFrom
  stRef:instanceID="uuid:AF99BC821263DD119FEAF7D6B9E8CD07"
  stRef:documentID="uuid:AE99BC821263DD119FEAF7D6B9E8CD07"
/>

PIC2 saved again without touching it (PIC4):

xapMM:DocumentID="uuid:0A5608501463DD119FEAF7D6B9E8CD07"
<xapMM:DerivedFrom
  stRef:instanceID="uuid:AF99BC821263DD119FEAF7D6B9E8CD07"
  stRef:documentID="uuid:AE99BC821263DD119FEAF7D6B9E8CD07"
/>

PICT13 from Raj
<xapMM:DerivedFrom rdf:parseType="Resource">
  <stRef:instanceID>uuid:466E2C450D07DC119FD78ABD8FA3219B</stRef:instanceID>
  <stRef:documentID>uuid:B546BEBB0507DC119FD78ABD8FA3219B</stRef:documentID>
</xapMM:DerivedFrom>


PICT14 from Raj
<xapMM:DerivedFrom rdf:parseType="Resource">
  <stRef:instanceID>uuid:5465D66D1307DC119FD78ABD8FA3219B</stRef:instanceID>
  <stRef:documentID>uuid:F8D02F7C0D07DC119FD78ABD8FA3219B</stRef:documentID>
</xapMM:DerivedFrom>

PICT15 from Raj
<xapMM:DerivedFrom rdf:parseType="Resource">
  <stRef:instanceID>uuid:4C39D5585706DC11B56B90D9F510219F</stRef:instanceID>
  <stRef:documentID>uuid:1BB542315206DC11B56B90D9F510219F</stRef:documentID>
</xapMM:DerivedFrom>

PICT16 from Raj
<xapMM:DerivedFrom rdf:parseType="Resource">
  <stRef:instanceID>uuid:4A39D5585706DC11B56B90D9F510219F</stRef:instanceID>
  <stRef:documentID>uuid:19B542315206DC11B56B90D9F510219F</stRef:documentID>
</xapMM:DerivedFrom>


PICT17 from Raj
<xapMM:DerivedFrom rdf:parseType="Resource">
  <stRef:instanceID>uuid:426E2C450D07DC119FD78ABD8FA3219B</stRef:instanceID>
  <stRef:documentID>uuid:1D57A31D0307DC119FD78ABD8FA3219B</stRef:documentID>
</xapMM:DerivedFrom>

PICT18 from Raj
<xapMM:DerivedFrom rdf:parseType="Resource">
  <stRef:instanceID>uuid:DA6B83F81407DC119FD78ABD8FA3219B</stRef:instanceID>
  <stRef:documentID>uuid:5E65D66D1307DC119FD78ABD8FA3219B</stRef:documentID>
</xapMM:DerivedFrom>

What we can see now that at least, those Pict as been saved at least two time, and the last time with Photoshop.

Hope I made a mistake somewhere... 
What's your opinion about all that ?

Gfamad

[leviathan]

What we said is what we meant, as to how you take it is your business.  We have no problem with research or different opinion, yours are anyone else.  We have a problem with AGENDA.  The camera data can be manipulated and we learned how at OMF, so the camera data is as inconclusive as anything else.  Our opinion on this has been stated many times and quite frankly we are more than used to being the villain and not frighten by it.
L E V I A T H A N

[Gfamad]

You're right Levi, the camera data can be manipulate VERY easily. But why Raj would do such a thing before posting them ? They were obviously not manipulate by us. So who manipulated them ? I'm open of course to this view. But it need more explainations.

Hey Chad and the others, it's time to show yourself ! The DRT need you ! It will help us if you could speak here. So many silence is not good....

Gfamad

[onthefence]

But why Raj would do such a thing before posting them ? They were obviously not manipulate by us. So who manipulated them ? I'm open of course to this view. But it need more explainations.

How about this for a guess:

• Raj gets brother-in-law to pull images off camera
• they get emailed to Raj
• Raj opens them up and saves them to a folder on his computer before uploading them to Flikr

The above scenario counts for at least two times a computer program could have touched the images.

Raj stated that he did not have the camera in his possession, so he likely did not directly bring the photos into his computer before uploading to Flikr. Therefore, there must have been two computers involved.