Some analysis with JPEG snoop

[Gfamad]

Well, I read the thread about the tool for image analysis. I get JPEGsnoop and I played with it a little bit. For each picture, I will write what JPEGsnoop wrote in the last field (**** Searching compression signature ****)

First test: A photo I know which is original (directly taken from my SONY DSC-P72)
Verdict:
 
  ASSESSMENT: Uncertain if processed or original
  Appears to be new signature for known camera.
  If the camera/software doesn't appear in list above,
  PLEASE ADD TO DATABASE with [Tools->Add Camera to DB]



Now the same picture loaded and saved with Photoshop CS3 (quality 10)
Verdict:
  NOTE: Photoshop IRB detected
  NOTE: EXIF Software field recognized as from editor
  ASSESSMENT: Image is processed/edited

Now Raj PICT13:
Verdict:
    SW :[Adobe Photoshop          ]                                       [Save As 10      ]
    ASSESSMENT: Image is very likely processed/edited

Raj PICT18:
Verdict:
    SW :[Adobe Photoshop          ]                                       [Save As 10      ]
    ASSESSMENT: Image is very likely processed/edited

Then I took a look at the camera Raj used. It's a Minolta DiMAGE X (Well, JPEG snoop told me  ) and I try to found some original pictures made with this camera. I found some here:
http://www.dpreview.com/reviews/minoltadimagex/page9.asp
At the end, you will find some photo in 1600x1200.

I tried with this two pictures:
http://a.img-dpreview.com/reviews/samples/rescharts/minolta_dimagex.jpg
http://a.img-dpreview.com/reviews/MinoltaDimageX/Samples/Ghosting/PICT0020.JPG
Verdict:
  ASSESSMENT: Uncertain if processed or original
  This may be a new camera for the database.
  If this file is original, and camera doesn't appear in list above,
  PLEASE ADD TO DATABASE with [Tools->Add Camera to DB]

Now with Stephen and Bigbasin1 and Bigbasin2:
Verdict:
  ASSESSMENT: Image is processed/edited
  This may be a new software editor for the database.
  If this file is processed, and editor doesn't appear in list above,
  PLEASE ADD TO DATABASE with [Tools->Add Camera to DB]

And that's all. For the other sightings, the pictures are too small (so it's not the original) or they are scanned.

Conclusion: Well I don't know what to think about all that. We should have the original from the camera to do a better job. But if it's the original, it's not good  (Are the photos on DRT compressed for using less storage space ?)

Gfamad

[10538]

Hi Gfamad,

I do have a Dimage X, same as the Raj pics.  I took a photo with it had 11A save it with Photoshop Elelments without touching the file otherwise.  I just ran it through JpegSnoop.  Here is it's assessment:

  NOTE: Photoshop IRB detected
  NOTE: EXIF Software field recognized as from editor
  ASSESSMENT: Image is processed/edited

So what does this tell us?

[leviathan]

Thank you 10538.  Just as we thought for at least one year.
L E V I A T H A N

[onthefence]

Are the photos on DRT compressed for using less storage space ?

I was very careful to upload the files intact to the DRT website. So, all non-thumbnail images located here:
http://droneteam.com/history/
are originals.

The only thing that may have changed is the file's date-stamp due to FTP issues. However, the embedded EXIF data which includes camera date-stamp should be reliable.

Note: for the Chad scanned images, there have been many file-names floating around, I suspect that this is due to webmaster fiddling at C2C.

[Gfamad]

I do have a Dimage X, same as the Raj pics.  I took a photo with it had 11A save it with Photoshop Elelments without touching the file

OK, good point ! But one thing I don't understand and maybe you will light it: When I take a photo that I want to give, I send the original file, except if it's too large.
So why do you have to Save it with Photoshop ? The camera does create a JPG no ? Maybe it's because I don't understand what 'it had 11A' mean ?
But what it tell us is that the photo have been at least saved with Photoshop. Of course, the soft may be wrong.
Now, 10538, what about a photo taken with your Minolta and analysis without passing through Photoshop ?

For Leviathan: Sorry, I didn't know that this point was already study (Well, in fact I was sure it had already been seen, but I didn't found the topic here and the search with JPEG snoop gave me no answer on OMF...)

[10538]

I'm sorry Gfamad.  I did a typo when I typed that.  The sentence should have read:

I took a photo with it and then had 11August (drt member) save it with Photoshop Elements without touching the file otherwise.

Yes, it seems if jppsnoop sees any tags with "photoshop" then it assumes the photo has been edited, even if no editing was done but only saving.  We have never denied that photoshop was ever used.  We acknowledge that many people use photoshop simply for transferring pics from camera to PC.  If you install Photoshop on a PC does it not adjust file and action associations?  That's not to say no enhancements were done on the Raj pics.  It is highly likely some color/lighting corrections were done.  But no evidence has yet been found that photoshop was used to composite.

[knowhow]

Gfamad
I too have the Sony 72 and write software to investigate images. Any time you import an image into something like photoshop, photoalbum or even, heaven forbid, Adobe Photodeluxe, the software will add its proprietary mark near the exif fields. If your version of Jpeg Snoop is fully up to date with all photo-processing software (a daunting task considering all the nations and languages of the world), it will identify the field marked with the sotware stamp listed in the Jpeg Snoop data base and indicate such during the search.  If the field is blank then the program usually indicates the image is unprocessed or edited. In reality, this is no proof that the image has not been modified by someone aware of the software tendencies.  Companies like Adobe are constantly changing their software to protect proprietary capabilities and frequently make modifications to embed markers to assist in tracking the pedigree of an image.
You can use Visual Basic to simply look at each file data element and examine each and every bit of info in the exif area and clear thru the entire image whether jpeg compression or something with higher resolution.
While I like your approach to the question of photo-modification, I think you might benefit from taking the analysis to a little higher level of detail.  If you are in my age group, you might do the same with MS-Dos.
knowhow

[Gfamad]

For 10538: You're totally right ! It prooves nothing. For exemple, if you take a photo, and simply rotate it with the build-in photo browser of Window, JPEG snoop will detect it. But it is obvious that it is not a compositing operation !

For knowhow: As you said, by simply analysing a file with any kind of programm (Java, Blitz Basic, Visual Basic, Python...) you can find the EXIF data area. The only thing to do is to find a doc with each offset to use.
And I think that you can also do the opposite: Write by hand EXIF data. And we have proof that this thing wasn't done !

I do TOTALLY agree with you when you say we need more analysis to proof anything (and I hope the picture is true).

A good way could be JPEG artifact analysis. When you take a photo, it is compressed once. But if you insert a shape in the photo, and then save (compress) again, the JPEG artifact should be different on the two part of the photo. But I don't know yet how to analyse them. But it can be a great way (the best ?) to prove that those pictures ar REAL.

And a last thing: Yes I know MS-DOS and before (Atari 800XL, Atari ST, AMIGA, HP 48GX....).

Thanks for your answers.

GFA-MAD

[knowhow]

Gfadam
If the overall drone issue were some type of hoax, it is likely that each proposed individual would actually be the same person and he would likely use the same camera and that would have the same data compression scheme which would show up in the image portion of the file even if he modified the exif portion to indicate different cameras.  I don't personally feel that ambitious to make that effort but maybe it would settle some of the nervousness about the drone realities if someone were so inclined.
knowhow

[majicbar]

With the "Stephen" photos having the only other camera based EXIF data it makes the Chad and Ty scanned photographs more portent to being elements of a hoax. Yet, not everyone has or is using electronic cameras, other oldies like myself. Looks like the Drone Detectives may yet be the only hope of resolution for some serious questions that remain out there.

[knowhow]

If any of the photos are actually film based and then converted to electronic version via the developer, then the developer footprint should reside in the electronic file somewhere.  In my days before the Sony 72 I used a local company called Idaho Photo and you received a CD and had to use their proprietary software to view your own photos.  In fact, I would be surprised if the Sony software I use to download my pictures from the camera via USB ports to the computer doesn't have its signature somewhere in the final photo file.  It doesn't seem likely to me that somebody would use the Photoshop expensive and memory hog software to simply download pictures but of course it could be so. I think I will take a look at some of these photo files.
knowhow

[onthefence]

It doesn't seem likely to me that somebody would use the Photoshop expensive ...

I understand there are many people that do not pay for such popular software titles.

Maybe someone is hiding from the software police

[knowhow]

Well if anybody offended by the icky look of this, its Gfadam's fault...he got me started.  Here is the pertinent part of the Rajinder Picture 16 file including the ID of the software.  I will post picture 17 next and you can see it is the same ID.

Picture 16 Raj

ÿ�ÿá:³http://ns.adobe.com/xap/1.0/ <?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?>
<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="3.1.1-112">
   <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#">
      <rdf:Description rdf:about=""
            xmlns:dc="http://purl.org/dc/elements/1.1/">
         <dc:format>image/jpeg</dc:format>
      </rdf:Description>
      <rdf:Description rdf:about=""
            xmlns:xap="http://ns.adobe.com/xap/1.0/">
         <xap:CreatorTool>Adobe Photoshop CS2 Windows</xap:CreatorTool>
         <xap:CreateDate>2007-05-20T13:05:16-07:00</xap:CreateDate>
         <xap:ModifyDate>2007-05-20T13:05:16-07:00</xap:ModifyDate>
         <xap:MetadataDate>2007-05-20T13:05:16-07:00</xap:MetadataDate>
      </rdf:Description>
      <rdf:Description rdf:about=""
            xmlns:xapMM="http://ns.adobe.com/xap/1.0/mm/"
            xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#">
         <xapMM:DocumentID>uuid:FAE3395E0D07DC119FD78ABD8FA3219B</xapMM:DocumentID>
         <xapMM:InstanceID>uuid:FBE3395E0D07DC119FD78ABD8FA3219B</xapMM:InstanceID>
         <xapMM:DerivedFrom rdf:parseType="Resource">
            <stRef:instanceID>uuid:4A39D5585706DC11B56B90D9F510219F</stRef:instanceID>
            <stRef:documentID>uuid:19B542315206DC11B56B90D9F510219F</stRef:documentID>
         </xapMM:DerivedFrom>
      </rdf:Description>
      <rdf:Description rdf:about=""
            xmlns:tiff="http://ns.adobe.com/tiff/1.0/">
         <tiff:Orientation>1</tiff:Orientation>
         <tiff:XResolution>720000/10000</tiff:XResolution>
         <tiff:YResolution>720000/10000</tiff:YResolution>
         <tiff:ResolutionUnit>2</tiff:ResolutionUnit>
         <tiff:NativeDigest>256,257,258,259,262,274,277,284,530,531,282,283,296,301,318,319,529,532,306,270,271,272,305,315,33432;BBCC38DB1E0C414A23E9120915D12520</tiff:NativeDigest>
      </rdf:Description>
      <rdf:Description rdf:about=""
            xmlns:exif="http://ns.adobe.com/exif/1.0/">
         <exif:PixelXDimension>1600</exif:PixelXDimension>
         <exif:PixelYDimension>1200</exif:PixelYDimension>
         <exif:ColorSpace>1</exif:ColorSpace>
         <exif:NativeDigest>36864,40960,40961,37121,37122,40962,40963,37510,40964,36867,36868,33434,33437,34850,34852,34855,34856,37377,37378,37379,37380,37381,37382,37383,37384,37385,37386,37396,41483,41484,41486,41487,41488,41492,41493,41495,41728,41729,41730,41985,41986,41987,41988,41989,41990,41991,41992,41993,41994,41995,41996,42016,0,2,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,20,22,23,24,25,26,27,28,30;B18766B2D943F46AC2A573FD1C3E642F</exif:NativeDigest>
      </rdf:Description>
      <rdf:Description rdf:about=""
            xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/">
         <photoshop:ColorMode>3</photoshop:ColorMode>
         <photoshop:ICCProfile>sRGB IEC61966-2.1</photoshop:ICCProfile>
         <photoshop:History/>
      </rdf:Description>
   </rdf:RDF>
</x:xmpmeta>
knowhow

[knowhow]

There is all kinds of stuff in here to check out.  Version dates, time differentials and who knows what.  If you all have seen this before, my apologies. If you have ideas as to where to go from here, let me know.

knowhow

Picture 17 Raj


Q¶Š(  Í ¢Š  Â¥Ã? P11KÅ (  Ã? ¢Š M´m¢Š.  3<Ã?T#)
 Å?î úšÃ?¼`¸â?¢ 3 ûàÃ?FJó¸~­úQEe[XÅ¡Ã?~ñ«g0ž sâ??¿)â¦Ã? Vâ?ÂÃ â?°Â¨Â­&%!¢ŠÐâ??ÿÃ?ÿá:³http://ns.adobe.com/xap/1.0/ <?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?>
<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="3.1.1-112">
   <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#">
      <rdf:Description rdf:about=""
            xmlns:dc="http://purl.org/dc/elements/1.1/">
         <dc:format>image/jpeg</dc:format>
      </rdf:Description>
      <rdf:Description rdf:about=""
            xmlns:xap="http://ns.adobe.com/xap/1.0/">
         <xap:CreatorTool>Adobe Photoshop CS2 Windows</xap:CreatorTool>
         <xap:CreateDate>2007-05-20T13:05:32-07:00</xap:CreateDate>
         <xap:ModifyDate>2007-05-20T13:05:32-07:00</xap:ModifyDate>
         <xap:MetadataDate>2007-05-20T13:05:32-07:00</xap:MetadataDate>
      </rdf:Description>
      <rdf:Description rdf:about=""
            xmlns:xapMM="http://ns.adobe.com/xap/1.0/mm/"
            xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#">
         <xapMM:DocumentID>uuid:FDE3395E0D07DC119FD78ABD8FA3219B</xapMM:DocumentID>
         <xapMM:InstanceID>uuid:FEE3395E0D07DC119FD78ABD8FA3219B</xapMM:InstanceID>
         <xapMM:DerivedFrom rdf:parseType="Resource">
            <stRef:instanceID>uuid:426E2C450D07DC119FD78ABD8FA3219B</stRef:instanceID>
            <stRef:documentID>uuid:1D57A31D0307DC119FD78ABD8FA3219B</stRef:documentID>
         </xapMM:DerivedFrom>
      </rdf:Description>
      <rdf:Description rdf:about=""
            xmlns:tiff="http://ns.adobe.com/tiff/1.0/">
         <tiff:Orientation>1</tiff:Orientation>
         <tiff:XResolution>720000/10000</tiff:XResolution>
         <tiff:YResolution>720000/10000</tiff:YResolution>
         <tiff:ResolutionUnit>2</tiff:ResolutionUnit>
         <tiff:NativeDigest>256,257,258,259,262,274,277,284,530,531,282,283,296,301,318,319,529,532,306,270,271,272,305,315,33432;0B6BF69440046F3B557E81FDE5409B4C</tiff:NativeDigest>
      </rdf:Description>
      <rdf:Description rdf:about=""
            xmlns:exif="http://ns.adobe.com/exif/1.0/">
         <exif:PixelXDimension>1600</exif:PixelXDimension>
         <exif:PixelYDimension>1200</exif:PixelYDimension>
         <exif:ColorSpace>1</exif:ColorSpace>
         <exif:NativeDigest>36864,40960,40961,37121,37122,40962,40963,37510,40964,36867,36868,33434,33437,34850,34852,34855,34856,37377,37378,37379,37380,37381,37382,37383,37384,37385,37386,37396,41483,41484,41486,41487,41488,41492,41493,41495,41728,41729,41730,41985,41986,41987,41988,41989,41990,41991,41992,41993,41994,41995,41996,42016,0,2,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,20,22,23,24,25,26,27,28,30;B18766B2D943F46AC2A573FD1C3E642F</exif:NativeDigest>
      </rdf:Description>
      <rdf:Description rdf:about=""
            xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/">
         <photoshop:ColorMode>3</photoshop:ColorMode>
         <photoshop:ICCProfile>sRGB IEC61966-2.1</photoshop:ICCProfile>
         <photoshop:History/>
      </rdf:Description>
   </rdf:RDF>


id="W5M0MpCehiHzreSzNTczkc9d software ID picture 16
id="W5M0MpCehiHzreSzNTczkc9d  software ID picture 17

[majicbar]

As I am understanding it, the photo prints were scanned and then ported to Photoshop. In my computer setup it is possibble to have my HP all-in-one port its scan directly into photoshop, which I think is the way that Linda Moulton Howe had also handeled her scans of the Ty photographs.
Without locating the "witnesses", Chad and Ty, who sent their photos we will not be able to know what exactly happened and are left with the odd chance of hoax.