Since the beginning of the war between Ukraine and Russia, the multitude of photos and videos published on social networks has made it possible to follow the course of the fighting in almost real time. Thanks to this amount of accessible content, many neophytes learned about OSINT and, more specifically, GEOINT (geospatial intelligence), which consists of using image data (notably satellite or geospatial). Some experts managed to provide the general public with accurate analyzes of the troops’ progress and progress during this war.
To accurately date and locate a photo or video, searching through the EXIFs (Interchangeable image file format, interchangeable image file format) is sometimes possible. This is metadata that is automatically recorded when taking pictures or videos. Metadata are for example: geolocation (GPS coordinates), time, date, device used and many other information. They are difficult to use because most social networks like twitter, Facebook Where Instagram now automatically delete this data when publishing content, further complicating the GEOINT process.
Therefore, it is now necessary to resort to more technical investigations, identifying specific elements in the shots, and then relying on software or websites that allow the most accurate analysis possible.
Identification of important image elements for geolocation
For this demonstration, the example used is a tweet accompanied by a photo, published on April 16, 2022 on twitteron account @Steven_DFS.
Source: Steven_DFS’s Twitter account
First of all, it is a matter of highlighting the elements present in the photo that are useful for locating its location, and then estimating the moment when the photo was taken.
Here, the photo provides three particularly interesting pieces of information:
The plane’s shadow (framed in blue);
The edge of a forest (framed in green);
Aircraft registration (framed in orange).
Thanks to the aircraft registration, a unique identification number for each aircraft, it is possible to consult its flight history through the tool FlightAware. By taking the date of publication of the photo in the twitteron April 16, 2022, it appears that the plane took off and landed at Maubeuge-Elesmes for the day’s five flights.
An aerial view of the area Google Maps identifies a forest close to the airport (green box) with, in front of it, the possible sector where the aircraft would be located (red box). Indeed, if the latter had been located further along the road or on the runway (blue boxes), it would not have been possible to observe the wooded area in the photograph published in twitter.
To more accurately determine the position of the aircraft, it is possible, using Google Street Viewto cross-reference the information to get a plan close to the original snapshot:
Image observed in Google Street View
Enlarged original image
Thanks to the highlight of the tree (purple), the forest (green) and the difference in tar (blue), visible in the image taken from Google Street Viewit is now possible to locate the aircraft even more precisely and obtain the following GPS coordinates: 50.31569783568291, 4.030008001316812.
Once the photo has been accurately geolocated through cross-referencing information, the use of open source tools allows finding the time it was taken.
The use of suncalc mark the time of the photo
suncalc is a free and fully accessible website that allows you to geolocate or tag images and videos using the position of the sun and shadows…:
Framed in blue, the orange dot represents the sun and its position at the time indicated at the top of the screen. The yellow line from this point illustrates the direction of the sun’s rays. By moving the yellow dot on the graduated scale located above, the position of the sun adapts to the indicated time.
In the two green boxes are the representations, to the east, of the time when the sun rises and, to the west, of the time when the sun sets. These indications make it possible to visualize the trajectory of the star over the course of a day, simulated by the curve in yellow on the crescent of the same color.
The purple box is used to indicate address, date and time information in order to provide the most accurate representation of the situation possible.
Finally, in the red area, you can enter the height of the object (in meters) to visualize its shadow later.
After indicating all the information found (location, shooting date, height) and placing the cursor in the precise position of the object sought, suncalc will thus stamp the image. Now it’s a matter of varying the sun’s position to find a shadow angle similar to the original photo. In this specific case, the registration of the plane allows us to find its model thanks to the database jetphotos.com. It is a 3M Short SC-7 Skyvan with a height of 4.60 meters.
Thus, as shown in the photo above, the blue arrow therefore represents the direction in which the plane is pointing, the red circle its position and the black line the orientation of its shadow. This information allows Suncalc to accurately determine the date the photo was taken, around 09:00 UTC+2.
There are other alternatives
However, it must be clarified that suncalc it’s not the only online software that lets you estimate the time an image was taken using the shadows present in the photo.
Path of the Sun 3D
The tool Path of the Sun 3D it also allows you to observe the action of the sun in the shadows according to the place, date, time and buildings by generating the sun’s trajectory over the course of a day.
Shadow Calculator allows you to delimit the area of the object whose shadow you want to have and thus calculate its extension according to the date and time.
SunSeeker (Google Play App / App Store)
The tool SunSeeker helps us to determine the position of the sun according to the time and therefore the position of the shadows. A tool often used by photographers to plan their shots in natural light, it can also be useful for Osint investigations.
As is often the case with OSINT, there are several tools that can be used during an investigation. Each one has its specificities that must be appropriate to be able to fully explore them, retrieve a lot of information and carry out investigations.
Pierre Antonin Rousseau for the OSINT & Eve ClubAEGE