Kind: captions
Language: en
[Music]
hey everyone
welcome back to the series on how to do
open source investigations from home
i'm ben this is part four and let's get
started
[Music]
in this session we're going to go
through geolocation which is
specifically having a look at
where a photo or a video may have been
taken
what we really want to do is find out
where the person was when they were
taking this photo for example
and this example that we're going to
finish by the end of this session
is a challenge that was put up by john
mcafee on his twitter account and what
we're going to do is we're just going to
use some of the clues
in this photo to identify exactly where
he was standing
with his security team and so we're
going to look at things like this
building
this building in the background and
other specific clues available on his
twitter account to have a look at
exactly where he was when this photo was
taken of him
but before we go into looking at john
mcafee i wanted to go through one of the
most basic tools
in geolocation and location finding in
general
google maps is quite a useful tool
because it's a very accessible
representation of the earth's surface
and to see that from going from the map
view into a satellite view
all we have to do is click this little
icon down here in the bottom left
and this basically gives us a view of
the land
as it's seen from space or from the air
in some areas we have really good 3d
views
so for instance i'm at the dawn wall
which is in yosemite valley in
california
and you'll notice that when i just tilt
the camera i can get a perfect
3d view of that canyon area
or that mountain side that's so popular
with climbers
and you can see some of the attention
that's gone into the detail around here
it's not only the mountain areas that
have that but also the cities
so if we take a look at the city of
london we'll notice that
after it's finished rendering the
clarity of some of the buildings and the
sides of the buildings and the shape of
them that we have in the cityscape of
london right here
this type of 3d textured view is
available
in a lot of built-up cities around the
world so
do definitely go and check out your
local city or any nearby built up areas
and you might just be surprised that you
can
find this sort of 3d view as well now
you're probably thinking already this is
very useful for geolocation
and that's one of the benefits of why we
have google maps as that freely
available tool
because we can visit anywhere on the
earth and see a picture
of that place as to how it would look
like to a bird flying over
or to figuratively a satellite another
benefit to google maps is this little
icon down
on the bottom right of the screen here
this little golden yellow person
which says browse street view images now
we can either drag that or we can just
click on it
when we just click on it it gives quite
a few different details that we weren't
usually able to see
on the map those details are the blue
lines and the blue dots
the blue lines are street view or in
some of these cases
footpath view and the other ones are
blue dots
which are the 360 degree photos
let's click on one of those and have a
look around in the middle of trafalgar
square here
this is a 360 degree photo that's been
taken
of the area whereas this one
is the street view and you'll notice
that with the street view
we have different options available to
us that we didn't have
for the 360 degree photo for example we
can walk down the street hello
and we can see different things and we
can also see some of the
uh item markers that might be around
which are growing
in popularity on google maps you'll
notice some more and more as you go into
uh major and built up shopping areas all
right
it's important to remember that with
google maps
it's also very multilingual and this is
a real benefit for us when we're
searching in other languages as well so
you remember in one of the past sessions
about the power of using the google
translate plugin
sometimes some of these places might not
be available
in english for example such as this
small place here
with that google translate tool we can
simply translate that
and we could use that for example in
search results
to see other things about that place as
well
so that's quite useful in just having a
look around
specific areas that aren't in english
for google maps when you're doing your
research or investigations as well
so now that we know more about google
maps and how it might help us as a tool
to identify where someone was standing
when they took a photo or a video we can
have a look at applying a few different
methodologies
to that tool and how to do that process
as well
i'm going to start with this photo which
is a selfie of a person that i've
blurred out for privacy reasons
and we're going to have a look and see
if we can identify
exactly where this person was standing
when they took that selfie
so it might be easy to guess what major
city in the world this person might be
in
but how can we find exactly where he was
standing and how can we
do the same sort of thing for example in
myanmar or
syria or some of the other case studies
we're looking at
well here's a little checklist that i've
created and it's not the be all and end
all and there are a lot of different
other checklists that you can use for
imagery analysis or geolocation
but this is a simple checklist that i've
started to use myself
that really helps just to keep in mind
what we're trying to do when we
geolocate something
so of course one of the first and most
important ones
is having a look at the context of the
photo
if you remember back to the sum of the
past sessions we looked at doing an
image of verse search which gave us a
whole another country as to where that
photo was
and a village name as well in another
session
we looked at the exif and metadata which
gave us exact gps
coordinates as to where that photo was
taken
and that's why the context is so
important whether it's an image of a
search
whether it's doing google advanced
searches to try and find that location
or whether it's just to have a double
check
of the exif data just in case if it's
there
all of these bits of context help when
it comes to geolocation
then the next steps go into the idea of
imagery analysis which is having a look
in the foreground
what can you see in the front of the
photo for you to start
typing in something on google for
example thinking about and critiquing
and thinking
hmm that's an interesting building maybe
that might be
a building in eastern europe or western
europe it might be a building in a hot
area such as australia
it might be a temple like in a
buddhist-based country
or something like that and then
obviously having a look in the
background and the background is one of
the
easiest giveaways in most geolocation
cases
whether it be a big iconic building for
example
this one over here or this one that you
may have noticed already
or whether they be large mountains that
have a specific shape that we can start
looking for
all of these things are important and
that goes into the fourth one
which is map markings so i mentioned the
river already
what are these map markings is there a
big mountain
for example that you might not be able
to recognize the shape
but you can definitely see whether it's
a tall mountain whether it might be a
specific
peak whether the rivers are shaped a
certain way
and things like that and of course
there's always a little bit of trial and
error and the more you do this
the better you get so in having a look
at this photo
already we can point out some of these
things so for example
in the foreground we have this railing
which goes a little bit around and if we
ignore
the rest of the photo and we already
look at this from this railing we can
tell
he's at a specific height it's quite
high it's curved
so it must be a round building or
something like that
and the railing looks quite old but then
if we go just a little further back in
the foreground
we can see this type of green park or
grassy strip or something like that with
some of these unique building tops
we can see a river over here with a
bridge going over it
we can see this very iconic building
here so most of you would have looked at
this photo
and maybe you've seen this building
already and said okay it must be in
london
and you're right it is in london so
let's go to london
and check this place out okay so we have
our view
of london in 3d and we can start to have
a look at some of these buildings that
may have been appearing in the photo
so if we go back to our image we've got
this sort of big
pointy uh pyramid building over here
so we can see that one here and we can
also see the little one on the right of
it as well we've got this one
which has a large top and sort of goes
inwards
over here and we have that easter egg
building
over here as well one thing that i like
to do
is to flip my map locate those
three that we saw so we have this one
over here and then we have the egg over
here and work my way forwards
keeping an eye out for some of the
things that i noticed around this area
so remember we had this river as well
with a bridge crossing over it so we
have the river over here
where this place with the green on top
and these two little towers
in front of it we have that one here
that's a fairly good match
and we can keep working our way forward
but a bit more onto the road
and start to have a look for some of
these buildings around here
so we had this round building right here
which looks like this one here if we
work our way forward we've got some
pretty unique shapes like we have this
one over here
we have this one over here so let's keep
an eye out for them as we move forward
okay so i noticed this round shape here
that appears to be that one there
and now we can look at this park that's
the match of the part
and now we know that this building must
be just in front of that park
okay i think we have a fair idea of what
building that was
it looks like this one which is saint
paul's
cathedral remember how if we clicked on
this person
we can get our 360 degree photos in our
map view
so what i might start doing now is going
through
some of these 360 degree photos and
seeing if perhaps we can identify
one that might have been taken on top
of st paul's cathedral here so we have
one
from this angle and we can see all the
way around
and we can see that we might be on the
wrong
side but we still have that exact view
don't we
so we can't see that tall triangular
building
but we can definitely see some of these
over here
and that matches up almost perfectly
with what we have there
to be sure of that location we can even
click on st
paul's cathedral and start to view some
of the photos that are available on
google maps here some of the embedded
photos
and we can also view 360 photos just by
clicking that tab
and we can go down through all of these
pictures and start to have a look for
if there is a another photo that matches
our location
that we identified just before and so as
we look around a little bit more
we can start to get some images that
might even be closer to our exact
location
just to be more sure and for example we
can see this one
and we can almost replicate that exact
same view
just through this image and knowing that
this person
may have been standing uh just about
here
when they took this photo and that might
just match up with some of these
parts so now what we'll do is we'll go
through one of the case studies that
we've been focusing on for a while now
which is this image in myanmar
now if you remember from one of the
previous sessions we looked at this
image
and when we first received it we
actually received it from
a person who told us it was in nigeria
and it wasn't until we did an image
reverse search that we started to see
that this might actually be
a village fire taken in myanmar in burma
in the rakhine state
and so after doing image reverse
searches we found that
this village may actually be near a
village called the emraku or the
the township of emrak and so
what i've done is i've gone ahead and
typed that in
and start to have a look at emrak and
see if we can maybe find this village
we don't actually know exactly where it
is so it's always important to think
about some of the features that we have
so
when doing geolocation remember what do
we see in the foreground
well in the foreground we don't have too
much except this farmland but
what we do have is a specific shape of
this
area in front of us and so we have a
specific layout of the
trees and how they've been cut against
the farming to give us a sort of almost
like a jigsaw piece that we're looking
for
another thing that we have in the
foreground which leads into the
background
is this clear road or path that goes all
the way along and it's a straight road
too
so it's not bent it's not crooked it's a
completely straight line that seems to
be going there
and it's cut off or it's almost cut off
by this row of trees up here
the other thing that we can notice very
much in the background when scanning
are these mountains so we know that the
village is on the left of a mountain
range
we have lines of trees that cut off a
road
and we also have this almost like a
semi-circle or a half
moon of trees that seem to peel off and
come around in the distance
so one of the articles said that this
was north
or near elmer q so i'm just going to
follow this map up we also have a river
here
as well i don't really see a river
in this photo but i want to stay close
to those mountains that mountain range
over here just because i'm thinking if
this village is on the left of these
mountains
this might be the mountain range that
we're actually looking for
also don't forget we had this road as
well traveling up from emerald
i'm seeing a single road that seems to
be going up along these mountains
so i think to myself what if i followed
this road up maybe i could find this
village
i'm looking for that bent shape of trees
the road cut off by a line of trees as
well so if i start to zoom in on this
road
what i'm looking for is a straight cut
towards those mountains
so it seems like when we fly through
this map that i'm seeing around
half moon shape of trees here
this might be our location so let's have
a look
and go into this location for further
analysis
and this is just the scratch and peck
methodology
like a chicken we're scratching and then
we're going to peck
so what we've been doing is we've just
been scratching along the land with our
mouse
until we found a location and then we're
going to peck into it for further
observation
so what i want to do is have a look at
this photo
and see if i can find some similarities
so
zooming down into the detail one of the
first things i notice about this photo
is this sort of blue and red and brown
long buildings they make a kind of
puzzle for me or a specific
series of colors and shapes that we can
look out for on the right side or the
eastern side of this village
can we see them yeah we can the brown
one
is there it's even got the half tinted
color
on its roof right there right there
we have this blue one there
and then we have a type of red one here
and we have an empty
land patch in between the blue and the
brown one here
if we move a little bit more
to the left we have possibly
two round fields or ovals or
lakes or ponds and we can see them there
as well where those houses are
we can even start to see some of the
houses that may have been burning for
example
or identify which houses would have been
on fire those
and possibly this one here as well
just to have a look a little bit more to
see if the other things that we were
looking for match up so yeah we
definitely did have that
that road what about this part in
between these trees and these trees do
we have this
yeah we do so that was obviously like a
little lake or
or water deposit as well right there
and if we wanted to get even more
granular we could start to match up the
agricultural lines so for example this
path came down to this line
and we might have this line as well so
we could start to try and match some of
those up but those are seasonal they may
change
as well so we can't take those for for
setting concrete they can't take those
as fact
but some other things that we could look
at is for example this road that comes
out here and this one that comes out
straight
where it comes out there road goes up
through there as well so
we can really start to match this photo
with this satellite image and say
with high degree of certainty that this
photo
was taken from about back here
and so we've geolocated that what we can
do in the next steps which will be in
another video
is to really narrow down when this
occurred using other satellite imagery
as well we'll go into that in
another video so as we promised now
we're going to look at john mcafee for
geolocation as well so just like what we
did for myanmar and we did for that
person
in london that was standing on st paul's
cathedral
we had a look at first the foreground
and then the background and also the
context don't forget that as well
well first of all something that i
always like to do is just save and
download the image
so that we can analyze it a little bit
further so when looking at this image
what can we see so looking in the
foreground
at the front of the image it's not
really too much except we've got some
pretty large guys right here so i
wouldn't want to get on the wrong side
of them
okay let's move on to the background
because obviously we can see john mcafee
and a group of men
let's have a look at the background and
see if we can see anything else so first
thing we've got these flowers
we have this building with a like a
flagpole or something up there
we have some interesting things that i
like to notice on the right here so
i also like to sometimes draw
conclusions as well and go with gut
feelings and instincts
so for example i see this truck at and
this is obviously a fuel station or
service station
we can see the gas pumps here and the
cars park right next to it
these colors might be specific or unique
to to where this might be
so first thing is that i see this truck
and i think to myself well
this is quite an open area they don't
seem to be many buildings so it's not a
it's not a cramped city
it's not a close-up village or anything
like that there's quite a wide open
space here
there's a there's a fence around it
seems like maybe some nature
or it might be flat there might be water
there's trees in the background so you
never know what might be in there
but there's definitely no buildings
around but there is a truck here
i sometimes think okay well in combined
with the flowers
maybe this might be a roadside uh like
it like a
a main road or a highway or something
like that
because trucks don't really go into
small towns so this might be a freight
truck
pulling into a service station again
that's an assumption this is not a fact
so we also have this and we have the
the petrol bowsers so he said he was on
his way
to london in this tweet
yesterday on the way to london he's at a
service station as well so my guess
is he might be driving so let's have a
look a little bit further so i'm going
to guess this is a service station if
he's on his way to london
uh i'm guessing he's somewhere in europe
or somewhere close to london or the uk
so i'm guessing europe so what i might
do
is just have a look for instance at fuel
station
europe okay so what we're doing is we're
just having a look at fuel stations in
europe to see if we can see
any that might match the color of what
we have with this one over here so what
we're looking for is something with
blue petrol bowsers or fuel bowsers
and this red and white or light red or
dark red and white
uh roof or coloring or logo coloring
so having a look through here there are
a few there's
benzene but the bowsers don't seem to be
blue on that
there's a few others but the one that i
see with these sort of neon blue bowsers
is so petroleum okay that looks like a
pretty good fit it's got the blue petrol
bowsers it's got the same sort of little
wings or things that come out the side
here
and it's got this same sort of coloring
of the the red
and the white roofing as well and we can
see that red over here which might be
the actual store and that just might be
the the cover
for where you're putting your fueling
okay so this is a little bit of
intelligence or information that we now
know about this photo we can go back to
our
original tweet from john mcafee we can
now say
he was yesterday on the way to london
at an esso petroleum petrol station
in europe okay great so that's a little
bit of information we have to start with
there
what else can we do to get a little bit
more context or
intelligence or information about this
photo
maybe we can have a look on his timeline
on his twitter timeline and see
if he's posting photos like this maybe
he's also posting
other photos as well so one photo and
this was posted on the 28th of january
so one other photo that i found was this
one 26th of january 2020's two days
earlier it says my security teams are
arrived to escort us to england okay
cool so
we know that he's going to be in london
uh this was two days after this one and
he's still going to england and his
security team has arrived
great photo cool and these people look a
little bit colder or a little bit more
dressed up here
with the the security team we have a
little clue
and it's right here we see the name of a
hotel
uh it's called hotel schlicker or that
looks like an
s-s-c-h-l-i-c-k-e-r
so what we could do is we could maybe
put that into our google maps
okay let's do that now so we're at
london but we want hotel
so this has automatically completed this
for me it's taken me to munich
hotel in munich so let's have a quick
look at hotel schlicker
okay so remember what we did from london
we can just go through the photos and we
can start to see
maybe if we can see outside signs so
here's a sign for hotel schlicker
and if we have a look at even the sort
of way that arrow is down
the wall lining here as well like this
this part on the wall
is just above there it's sort of soft
here and then it goes rough there so
that's a fairly good match for where
they might have even been standing which
is just back
here okay so we need hotel schlicker we
guessed
they were probably driving because it
was my security teams
arrived to escort us to england
and we noticed that in our other photo
here they are at a petrol station
they've got red bull okay so we're
getting a little bit more
information about this because this
image
really confirms this image that they are
definitely driving
they've been at a gas station he's got
his red bull so
okay let's join these two together
yesterday on the way to london
at an esso petroleum station leaving
hotel schlicker in munich
so what do we need to do it's going to
take a while
but we can go directions let's reverse
that we're going from
hotel shlika and he's going to buy me
a beer in london so we have a couple of
different roads
my guess is that john mcafee's security
team would have done the exact same
thing
i did just then they would have put
london
into the google directions and driven
on the way that google maps would have
calculated i'm probably guessing they
did that
now everything in open source takes time
so i'm going to fast forward a little
bit here
as it did take me some time
so it looks like we do have a location
here
a possible location we have a esso
petroleum it's esso station uh
it looks like it's somewhere called
baidum baden it's right next to the
highway here
as well which is quite interesting and
so we have this
with long structure or building here so
let's just start to try and match some
of this up and see if it fits
so here's our image so first of all i
want to look at in the distance as well
i like to work my way backwards now so
background and then foreground
so the most obvious thing for me was
this sort of red roof
and this flagpole as well
so we have that here the little red roof
and this flagpole
and now that we have those two lining up
we can work our way
backwards from exactly them
we have this roof that looks like that
one there
we have this little roof up here with
the building and the flowers so
that would be this one here we have a
car park in the background
just behind this big gentleman so that
would be
this one here we can see the cars
underneath filling up the petrol so they
would be there
and then we can go into this service
station and start to
see maybe if we can identify where they
might have been standing so for example
they were on
there's some brick here as well now this
gentleman's
red bull can they might have just been
there
and going through just to really narrow
down we could also perhaps
okay so where this dog is right here
with the flowers with the lady
uh that might be right here the flower
trolley stand seems to go out all of the
time
and there's a bean behind this gentleman
uh
over here uh which is there so i hope
that gentleman puts his bread ball can
in there
and yeah so i think we've got a fairly
safe match to say
when john mcafee took this photo he was
on his way to london
from hotel schlicker in munich he was at
a atro
esso petroleum station in baden-baden
so that's geolocation it is a simple
process it really is going through those
check boxes that we went through before
so really going through the context the
foreground the background the map
markings
and as you can see trial and error
because as we did with john mcafee's
tweets we
went back a little bit to identify
context then context is one of the
trickiest parts whether it be for
doing an image reverse search having a
look at historical posts such as this
one that was taken two days
earlier that helped us geolocate this
image but that is geolocation in a
nutshell
thank you very much for listening this
has been geolocation which is one of my
favorite subjects and don't forget to
like and leave a comment and subscribe
for future content
[Music]
you