Help Analyze a Photograpic Anomaly

reply to post by TKDRL


I plan on making a post about my old band anyway, it was going to be sooner or later. I'd sooner not give jerks my e-mail address.

I would have never imagined this thread would escalate to what it has. Is there only one moderator? I'm curious as to why he hasn't posted the e-mails either..

FOR THOSE WHO MISSED THIS:

Originally posted by DontTreadOnMe

ATTENTION!!!

Please post on topic!!

Member's posting habits and allegations of rules violations are not to be discussed here.
Any further mention of off topic material will be removed and/or warned.

Contacting Staff: Alerts, Suggestions, Complaints

reply to post by missthinks


We do not post email addresses or allow others to post email addresses in the forums.

reply to post by OrganicAnagram33


Ok, just with the info you posted, considering you are telling the truth, I have you narrowed down to three names lol. And no one of them is not miguel

reply to post by DontTreadOnMe

Oh. Not even if we remove the e-mail addresses?

reply to post by DontTreadOnMe


She doesn't mean the email addresses, just the e-mails scrubbed of their personal info.

This thread is being closed temporarily for staff review.

Thanks for your patience.


After this cooling off period, I am going to reopen this thread.

Please know that any return to the kinds of posting of last night will not be tolerated.
Limit yourself to the topic. Do NOT discuss other members.
This will be strictly enforced.

Mod Note: Terms & Conditions Of Use – Please Review This Link.

MOD NOTE: ALL MEMBERS: We expect civility and decorum within all topics - Please Review This Link.

Trolling, And What To Do About It

YOU are responsible for your own posts

As this thread is open again does anyone know where everyone has gone? I asked the moderator when it would open and he said it was open again but how will anyone know. It had gotten really interesting too.

Originally posted by sprocket2cog
Ok, so here is a image error analysis.

[atsimg]http://files.abovetopsecret.com/images/member/a80d887fae71.jpg[/atsimg]
image A is a forensic error analyisis of the original image as seen in image B (the one from the opening post)
as you can see there is no white areas around the ghost anomaly, it shows as a slightly darker spot, but there is no blocks or marks..
the way then software works, it picks up errors in compression from edited areas and highlights them in varying brightness.
as an example of how an edited photo would appear, i have included the image (image C) that solid007 edited to make it hard to find the edit...(he added light to the stairs and door way)
but as you can see the area on the steps where he made small edits is clearly show in the error analysis image D.
so at this point i would say if the original image was edited its a very good job indeed..
heres the site you can use to do your own comparison of the images
errorlevelanalysis.com...

edit on 22-5-2011 by sprocket2cog because: (no reason given)

It appears to me, you have done an excellent job in your analysis. You definitely show there is a difference in the OP image and the faked image produced by makeitso. After reading all the posts and seeing the examples that others have tried to put forth to show that the OP image was shopped puts that idea down. IMHO it appears the OP image is genuine, not photo shopped, not faked digitally. I think this is the final nail in the photo shopped side of the debunkers.

I am going with genuine artifact. However, that still does not answer the question of what it is, and/or what caused the anomaly.

-Gib

reply to post by transubstantiation


I am hoping our posts will generate the return of our investigators. I too, am very interested in keeping this going.

Originally posted by Gibborium

Originally posted by sprocket2cog
Ok, so here is a image error analysis.

[atsimg]http://files.abovetopsecret.com/images/member/a80d887fae71.jpg[/atsimg]
image A is a forensic error analyisis of the original image as seen in image B (the one from the opening post)
as you can see there is no white areas around the ghost anomaly, it shows as a slightly darker spot, but there is no blocks or marks..
the way then software works, it picks up errors in compression from edited areas and highlights them in varying brightness.
as an example of how an edited photo would appear, i have included the image (image C) that solid007 edited to make it hard to find the edit...(he added light to the stairs and door way)
but as you can see the area on the steps where he made small edits is clearly show in the error analysis image D.
so at this point i would say if the original image was edited its a very good job indeed..
heres the site you can use to do your own comparison of the images
errorlevelanalysis.com...

edit on 22-5-2011 by sprocket2cog because: (no reason given)

It appears to me, you have done an excellent job in your analysis. You definitely show there is a difference in the OP image and the faked image produced by makeitso. After reading all the posts and seeing the examples that others have tried to put forth to show that the OP image was shopped puts that idea down. IMHO it appears the OP image is genuine, not photo shopped, not faked digitally. I think this is the final nail in the photo shopped side of the debunkers.

I am going with genuine artifact. However, that still does not answer the question of what it is, and/or what caused the anomaly.

-Gib

So what you are saying is that there is no way that these images could not have been fabricated?

I mean let's just say for the sake of argument as an example someone, and I'm not saying this is what happened by any means, generated a fabricated image and then used a digital camera to create an authentic digital image.

Science can and will never give you the answers you seek to explain your observation. Trust in your own observation to reveal truth to you.

Well there is definitely way more evidence showing this is a genuine, not photoshopped image so far. Maybe the debunkers will step up their game, and actually provide some real evidence their way.

I hope the o.p comes back again to answer queries, i must admit he had an answer for everything.

I'm not at all good with photoshop. I'm still learning. Never had an interest until lately so I can't say one way or the other.

I did, however, paste the images in MS Word and enhanced the brightness and contrast and this is what I came up with.

[atsimg]http://files.abovetopsecret.com/images/member/b7984bbd4117.jpg[/atsimg]

[atsimg]http://files.abovetopsecret.com/images/member/1f830d8fc63f.jpg[/atsimg]

Someone went to a lot of trouble, IMO, to fake this picture. The enhancement almost looks electric.

Anyone see the face of a 'Grey' to the right of the 'crotch' in the second picture?

reply to post by Intelearthling


If something fell in front of the camera and the flash was on, it could have been one of these. If it was an object that is.

Hello all!

Firstly, thank you to both Missthinks and OrganicAnagram33 for sharing the
original untouched photographies.

I've done a little work on these interesting photographies that I will try
to expose here. Please bear with me as English is not my native language!

As lot of work have already been done on it, I will not use again neither
ELA nor Photoshop to prove or disprove any point.
My work here will be based solely on EXIFTool (From Phil Harvey, see here)
and JPEGSnoop (From Calvin Hass, see here).

As pointed out before by GiftofProphecy, and this is an important point, there
are some discrepancies between the EXIF datas of our photography and another
from the same camera. We will see in this study if this is a "proof" of the photo
to have been faked.

The main reason why I asked for the original photography taken a few seconds
apart and without the "ghost" is that I wanted to do some comparisons:

Lets call the photography with the ghost "ghost001" and without it "ghost002"
I also choose 16 photographs test, all taken with an original Sony DSC-W55
and each one from various sources (see the three sources references at the end).

(1) Comparisons between ghost001 and ghost002:
- Using Exiftool:



NOTES:
- Firstly, there's a 100% match between the exifs datas names and positions
on both photos. However, there are a few differences between the values:

1- Shutter speed (Exposure time) is sligthly different
2- ISO 100 for ghost001 and ISO 200 for ghost002
3- They were taken (unless time/date exifs stamps weren't set) in 2008 June
25th, at respectively 14:06:16 and 14:06:25 (9s apart). OrganicAnagram33 said
in its first post that they were taken in 2007, I guess that either there's
a problem that the date/time set or that it's a mistake from the OP)
4- Flash was fired for both photographs, but the return was detected only in
ghost001.

Conclusion 1:
Points (1), (2) and (4) can explain the differences we see in these photos,
i-e hue, contrast, etc....

- Using JPEGSnoop
The camera is not in the database, so the assessment "4" is not a surprise,
but this is not the interesting part about JPEGSnoop here.
The main thing that JPEGSnoop is able to do is to search for a JPEG
compression signature, given in a 32-digits number/letters in the result.
This signature characterize the way the camera compress the RAW datas into
a JPEG file; it depends on many factors such as firmware for example.
A single camera can produce different signatures compression for an original
photo, depends of camera settings at the time the shoot was made. (ISO,
resolution, etc....)

So let's compare compression numbers/letters of both photos:



Conclusion 2:
Compression signature are not the same.

(2) Comparisons between ghost001, ghost002 and "photos-test":
- Using Exiftool:

This work was already done by GiftofProphecy and all the EXIF datas of my 12 photos-test
are conform to what he have found.

Interestingly, there are absolutely no differences between EXIFS tags names and
positions when comparing the photos-test between themselves, except that two of
these photos (DSC00007 and DSC00013) have the tag "JFIF Version" added after "MIME Type", which is the
file format, referred to as the JPEG File Interchange Format (JFIF), for file-based interchange of images encoded according to the JPEG standard and is of no consequences in the validity of the photo.

- Using JPEGSnoop:
Here are the compression results for each of the 16 photos-test and ghost001 and 002:





Note that there are always the same pairs of compression digit-numbers/letters, sometimes
flipped, and that they are found twice in all my examples, except for photos n°
DSC0007 and DSC00013 that have the same compression digit/number of our two "ghost
photos" and that are also the only one to have the "JFIF Version" in their EXIF
datas.
This could be a clue of the origin of the discrepancies in the EXIF datas.
JFIF Version did not appears in the EXIFS datas of both ghosts photos though...

Note that any use of a post-process software will inevitably modify this compression
signature in a way that the 32-digit number/letters will not be anymore
the same as the original photo. (See (3) below)

(3) Tests with various post-process softwares:

I will not fully detailled all the test that I've done here, as it will be a long
and boring talk, it can be easily reproduced anyway.
None of my tests was able to modify the EXIFS datas in a similar way of those of the
ghosts photos.
let's take a look at how JPEGSnoop react to these modifications.
Only one photograph and the results will be shown here.

The photo-test that was used:



Results:



Any use of Photoshop (with "Save as", as "Save for the Web" strip the EXIFS datas...),
PAINT, PAINT.NET, PICASA, etc... will result in the file to be sort
as "class 1" assessment, "Image is processed/edited" and with a # compression number.
While it's very easy to remove in the EXIF any tampering related datas, it still
leave a different compression number, which is much harder to modify and match to
an original one.

Opening it in any viewer do not modify this JPEGSnoop assessment, but modify the
compression number anyway. Then, using Microsoft Viewer modify this number as if
it was done with a post-process software, such as Photoshop or PAINT.NET.

Anyway, GIMP allow users to keep intact EXIFs datas and compression as well, and
Giftofprophecy was right on its assumption that GIMP could have been used:



Conclusion (3):
Unless the compression of a possible tampered (with basic tools) area of the ghost photo have been
modified to match those of the photos-test, (which is not impossible, but hard
to do without leaving any traces) plus the EXIFS datas tampered with to hide any
manipulation, the compression digit-number/letters of JPEGSnoop results couldn't
have been the result of any post-process modification.
Another easier possibility is the use of GIMP with the value advanced default options
"save the EXIFS datas" on, which leave intact both EXIFS and compression level.


General Conclusion:

At this point, and using only EXIFs datas and JPEGSnoop, it's impossible to say that the
photos wasn't tampered with.
It will be helpful for further investigations if the OP could provide us some photographs taken
with the exact same camera, and of course without any modification.
I also will try to find other photograph examples on Internet that exhibit the same EXIF anomalies;
maybe there's another firmware for this camera that gives differents EXIFs.

Now, if there was any modification, it could have been made using GIMP that don't leave any traces,
however, that alone do not explain the discrepancies in the EXIFs datas plus I don't see the point
for an alleged hoaxer to modify these EXIFs without removing useful camera technical informations,
but only randomly change their order! Unless the used of a post-process software automatically allow that, that I'm not aware of any.

A thorough examination of the "ghost" don't shows any traces, anomaly or visible manipulation.

Another point that have already been done by many here is that the flash was fired and that this
could well simply be the reflection of something (bug, fly, butterfly, whatelse....)close to
the camera that reflect the flash light to over-saturated the CCD sensor.

A final word to say that there are other means to determine wether a photo have been tampered with,
as for example the chroma subsampling value examination. I will talk about this point later.

So what we have so far is either:
- A hoaxer using GIMP and that don't correctly knows how to fake EXIFS datas
- A genuine photography of a ghost
- A genuine photography of something natural in front of the camera flash.

Photos sources:
Gallery 1
Gallery 2
Gallery 3

Originally posted by 22ndsecond
reply to post by Intelearthling

 

If something fell in front of the camera and the flash was on, it could have been one of these. If it was an object that is.

edit on 23-5-2011 by 22ndsecond because: addition

Quite possible but where's any light reflection on the wrought iron fence that's obviously not photoshopped?

I don't know if this applies to all digital cameras, but in my camera, I can pull up a picture and it will have all the stats about the picture whether it was auto or manual. Flash or no flash. It'll show the f-settings and all. The history of any picture is stored automatically.

We don't know if there was a flash.

reply to post by Intelearthling


The last post before you and a few others showed that it said "Flash fired, return detected". Meaning it fired and bounced off of something. In this case the object had to have been close because it's so bright. Also pretty small for the person photographing to miss it. Likely caused by some wind blowing something in the frame for a second. It happens.

reply to post by elevenaugust

So what we have so far is either: - A hoaxer using GIMP and that don't correctly knows how to fake EXIFS datas - A genuine photography of a ghost - A genuine photography of something natural in front of the camera flash.

Wow, looks like you did a thorough job, and went to great lengths to provide a reasonable analysis. emberscott brought up a good rebuttle to my earlier post.

I mean let's just say for the sake of argument as an example someone, and I'm not saying this is what happened by any means, generated a fabricated image and then used a digital camera to create an authentic digital image.

I had already considered the possibility of the anomaly picture being rephotographed. This would mean that someone would have to rephotograph both pictures. I think it has been proven that the two pictures are two different pictures taken within a short interval of time.

I have taken colored 35 mm slides and rephotographed them to produce a positive color photograph. This in itself is a very time consuming process with a lot of darkroom time (I am an old school photographer). Depending on the method used, because there are several, determines the quality of the final photograph. I would be interested in what you have to say about the OP photos being a photo of a photo.

-Gib