Author Topic: Possible paths for Raj  (Read 15701 times)

0 Members and 1 Guest are viewing this topic.

Offline onthefence

  • Administrator
  • Hero Dronie #3
  • **********
  • Posts: 1045
  • Karma: +49/-0
Re: Possible paths for Raj
« Reply #15 on: January 28, 2009, 05:53:43 PM »
Also found the archive: http://www.divshare.com/download/838310-91a

That link contains .PNG files, therefore someone altered those files.


yeah, the original high res flicker images are named

PICT0013.jpg
PICT0014.jpg
PICT0015.jpg
PICT0016.jpg
PICT0017.jpg
PICT0018.jpg

The DImage X saves files with upper case extension according to 10538 email to me:
Quote from: 10538 email to me
I just did the test for dimage file names.  It is all caps. PICT0001.JPG
Therefore Flikr image names have been altered.


not sure why drt has versions without the leading zeros?
I'm not sure either, but if you want me to upload the "correct" images to the website, you can email them to me.

Offline nekitamo

  • Administrator
  • Major Dronie
  • **********
  • Posts: 224
  • Karma: +28/-0
Re: Possible paths for Raj
« Reply #16 on: January 28, 2009, 06:10:09 PM »
Also found the archive: http://www.divshare.com/download/838310-91a

That link contains .PNG files, therefore someone altered those files.

Don't look at the files below, click "Download this file" at the top - it is an archive with .jpgs named "Capitola_Third_Sighting.zip "

Offline onthefence

  • Administrator
  • Hero Dronie #3
  • **********
  • Posts: 1045
  • Karma: +49/-0
Re: Possible paths for Raj
« Reply #17 on: January 28, 2009, 06:46:57 PM »
Don't look at the files below, click "Download this file" at the top - it is an archive with .jpgs named "Capitola_Third_Sighting.zip "

OK, I put those files into the history section and removed the previous ones.

I also noticed even more evidence of tampering. Most of the filenames in that archive have a space after the filename:

PICT0013.jpg
PICT0014 .jpg
PICT0015 .jpg
PICT0016 .jpg
PICT0017 .jpg
PICT0018 .jpg


And, as mentioned before, the extension should have been in UPPER CASE.

Offline 10538

  • Administrator
  • Hero Dronie #2
  • **********
  • Posts: 826
  • Karma: +33/-0
Re: Possible paths for Raj
« Reply #18 on: January 28, 2009, 07:26:26 PM »
OK, I put those files into the history section and removed the previous ones.

I also noticed even more evidence of tampering. Most of the filenames in that archive have a space after the filename:


And, as mentioned before, the extension should have been in UPPER CASE.

I can confirm the upper case JPG extension.  That's exactly the way it is in my DimageX and no spaces.


Offline spf33

  • Administrator
  • Major Dronie
  • **********
  • Posts: 215
  • Karma: +28/-0
Re: Possible paths for Raj
« Reply #19 on: January 28, 2009, 07:36:57 PM »
I can confirm the upper case JPG extension.  That's exactly the way it is in my DimageX and no spaces.

i've been downloading a ton of photos for reference from flickr in the past couple of days and all 400+ high res images have lower case extensions -all of them ".jpg".  might it be a built in function of the flickr servers to convert all uploads from uc to lc.?  should be easy enough to test on a pro account.

Offline HPO

  • Administrator
  • Hero Dronie #1
  • **********
  • Posts: 316
  • Karma: +27/-0
Re: Possible paths for Raj
« Reply #20 on: January 28, 2009, 09:42:07 PM »
I saw onthefence mentioning a HexEditor for tampering the time in the Exif.
I don't know if anybody already did this, but I thought I put PICT0016 through a HexEditor.

Again I don't know if somebody already posted this, but there are some interesting and odd things in the file.
There are at least  6 URL's in there, from which 4 of them from Adobe.
And there is also a mention of a TIFF file in there, I wonder why?

The results:

http://www.w3.org/1999/02/22-rdf-syntax-ns#

http://purl.org/dc/elements/1.1/

http://ns.adobe.com/xap/1.0/

CreatorTool adobe Photoshop CS2 Windows

http://ns.adobe.com/xap/1.0/sType/ResourceRef#

xmlns:tiff="http://ns.adobe.com/tiff/1.0/"

http://ns.adobe.com/photoshop/1.0/

I put a self-made DimageX photo in the HexEditor but I didn't find all those URL's and other stuff in there.

Offline elevenaugust

  • Administrator
  • Hero Dronie #3
  • **********
  • Posts: 1230
  • Karma: +34/-1
  • א ב ג ד ה ו ז ח ט י כ ך ל מ ם נ ן ס ע פ ף צ ץ ק ר
Re: Possible paths for Raj
« Reply #21 on: January 30, 2009, 04:58:58 PM »
Hi HPO!

I did the same thing with one of the Stephen's picture and nothing special pop up.

I don't know what does that mean except that it seems like Photoshop markers.
IPACO, the new tool for photo and video analysis is on-line! www.ipaco.fr

Offline HPO

  • Administrator
  • Hero Dronie #1
  • **********
  • Posts: 316
  • Karma: +27/-0
Re: Possible paths for Raj
« Reply #22 on: January 31, 2009, 10:39:07 AM »
Hi HPO!

I did the same thing with one of the Stephen's picture and nothing special pop up.

I don't know what does that mean except that it seems like Photoshop markers.

Hi 11A,

Yes they seem to be Photoshop markers, I've tested it in Photoshop with one of my own photo's.
Here I also get the URL's when viewed in the HexEditor, but this also confirms that the raj photo's went through Photoshop at some time.
And maybe the original was a TIFF file.

Offline 10538

  • Administrator
  • Hero Dronie #2
  • **********
  • Posts: 826
  • Karma: +33/-0
Re: Possible paths for Raj
« Reply #23 on: January 31, 2009, 07:03:26 PM »
HPO,

Have you tried running your DimageX photo through PS and then viewing with the hex editor?  I believe Neki ran some of mine through PS. 

Also, does anybody have the exact version of PS the was used for the Raj pics?


Offline HPO

  • Administrator
  • Hero Dronie #1
  • **********
  • Posts: 316
  • Karma: +27/-0
Re: Possible paths for Raj
« Reply #24 on: January 31, 2009, 08:16:30 PM »
Hi Numbers,

Yes I have ran a DimageX photo through the Hex editor, same result, lots of Adobe URL's and stuff.
The only thing I did was save it again as a jpg with quality at maximum and as a large file.

Also the Upper case JPG extension is gone.

Also, does anybody have the exact version of PS the was used for the Raj pics?

I found two different versions of Photoshop in the Raj photo hex file,... 'PS 1.0' and 'PS CS2'
I think this has to do with functions in photoshop, and on which version a particular function first was implemented,.... just a guess. 

Offline nekitamo

  • Administrator
  • Major Dronie
  • **********
  • Posts: 224
  • Karma: +28/-0
Re: Possible paths for Raj
« Reply #25 on: January 31, 2009, 08:23:21 PM »
I have access to Photoshop 8.0 (CS), 9.0 (CS2 - Raj's version) and 10.0 (CS3), so if necessary we can compare what happens with images in each of them. Here are Raj's save-as settings, per jpegsnoop (ICC profile included, lower-case extension, quality 10, progressive):





Not sure about progressive scans count, though...

Here's an archive containing both original image (from Dave) and one saved-as using above parameters:
http://rapidshare.com/files/192151635/PhotoshopCS2saveas.zip.html

Forgot to add - there's still that big-endian issue, and we never managed to test this with Mac OS version.
« Last Edit: January 31, 2009, 08:53:32 PM by nekitamo »

Offline 10538

  • Administrator
  • Hero Dronie #2
  • **********
  • Posts: 826
  • Karma: +33/-0
Re: Possible paths for Raj
« Reply #26 on: January 31, 2009, 10:25:48 PM »
Here's a photo I downloaded from flickr that is from a DimageX with exif version 220 and also has Big Endian exif byte ordering.  It was saved with a Mac.  Is it the Mac that is responsible for the Big Endian or the 220 exif?

http://home.comcast.net/~dl1027/files/object/DimageX220.jpg

Offline elevenaugust

  • Administrator
  • Hero Dronie #3
  • **********
  • Posts: 1230
  • Karma: +34/-1
  • א ב ג ד ה ו ז ח ט י כ ך ל מ ם נ ן ס ע פ ף צ ץ ק ר
Re: Possible paths for Raj
« Reply #27 on: February 01, 2009, 12:28:57 AM »
Here's a photo I downloaded from flickr that is from a DimageX with exif version 220 and also has Big Endian exif byte ordering.  It was saved with a Mac.  Is it the Mac that is responsible for the Big Endian or the 220 exif?

http://home.comcast.net/~dl1027/files/object/DimageX220.jpg
Could be.
Remember my tests with one of the Flickr Minolta's picture here.
This pictures had:
- Big-endian encoding instead of Little-endian
- Exif version 0220 instead of v.0210
- Tags "Software Quicktime 7.4.5" and "Host Computer Mac OS X 10.5.2.
IPACO, the new tool for photo and video analysis is on-line! www.ipaco.fr

Offline nekitamo

  • Administrator
  • Major Dronie
  • **********
  • Posts: 224
  • Karma: +28/-0
Re: Possible paths for Raj
« Reply #28 on: February 01, 2009, 12:59:54 AM »
Older Macs were using PowerPC processors which are big-endian, but 2006. and newer models use little-endian Intel CPUs. I'm not sure if this also means different Mac OS Photoshop versions behave differently, but CS2 for Mac seems to be available as both PowerPC and "Universal" version. The later can probably be tested even with some regular x86 PCs, judging by this page.

Offline 10538

  • Administrator
  • Hero Dronie #2
  • **********
  • Posts: 826
  • Karma: +33/-0
Re: Possible paths for Raj
« Reply #29 on: February 01, 2009, 08:46:15 PM »
Older Macs were using PowerPC processors which are big-endian, but 2006. and newer models use little-endian Intel CPUs. I'm not sure if this also means different Mac OS Photoshop versions behave differently, but CS2 for Mac seems to be available as both PowerPC and "Universal" version.

Thanks for clearing that up, Neki.  Next question, does anybody here have a Motorola based Mac with Mac version PS CS2?