Dear Amped fellows, welcome to this week’s tip! Like we did last week, we begin this tip with an Italian saying, which goes: “Le bugie hanno le gambe corte”. Literally, it translates to “Lies have short legs”, suggesting that, eventually, the truth will come out. And this is something Amped Authenticate users care a lot about! Today we’ll see how Amped Authenticate makes it easy to verify whether shadows in your evidence images are consistent with the declared time metadata. Keep reading to find out more!
Let’s begin straight away with an example: we’re given this image as proof that some individuals were in a certain place at a certain time (click here to download the original picture file).
Place and time information are indeed available in the image metadata, as promptly shown by the Exif filter:
So we have place and time info, but… are they reliable? We know, also from previous tips, that metadata are easily editable! So, let’s begin with the GPS info: it just takes a click to see where those GPS coordinates point to: let’s head to the Tools menu and select Show Image Location on Google Maps, and here’s what we get:
This is indeed consistent with what we see in the picture in terms of vegetation and buildings, so the GPS location seems OK. What about the time? Metadata say the image was captured on June 29th, 2018 at 17:48. You may remember that, in a past tip, we said there are websites allowing us to check the sun position at a given time and place. But converting GPS coordinates isn’t always trivial, and that’s why, in the latest Amped Authenticate release, we added a new tool called Check Sun Position for Image Location and Date on Suncalc.org
Just click on that, and you’ll be brought to the properly configured page on suncalc.org
The central red dot denotes the GPS location available in image metadata (but remember: you should allow several meters accuracy when dealing with coordinates obtained by GPS chipsets on smartphones); the yellow ball denotes the sun, so the line connecting the red circle to the yellow ball denotes the direction of light coming from the sun. We’ll talk about the other two colored lines later.
Now, we can now compare the direction of sunlight and the direction of shadows in the image. But there’s more: Suncalc offers an additional tool, which allows you to calculate and draw on the map the direction and length of an object’s shadow, provided you know its real height. Let’s say the leftmost building is 8 meters high: we just need to click on the text box on the left and write 8 there, then click on the building to move the red circle over the edge of its roof.
You see that black line? It tells how long the shadow of the building is expected to be, given the sun position and the object’s height.
If we go back on the image, we see that there’s good consistency between the expected shadow length and the observed one!
Notice that, if we change the time by just 1h on SunCalc.org, moving from the original 17:48 to 18:48, the shadow direction changes just slightly, but the length changes considerably and it would be much less consistent with what we see in the image (see below).
So, this is a case where verification with satellite map and SunCalc.org provided good support to the hypothesis that time and location metadata are reliable.
Let’s now consider this other image (click here to download the original):
In this case, as well, metadata contains location and time information.
Let’s use the same tool we used before to check the consistency of location and sunlight. This is what suncalc.org shows us for this image:
You see, this time the yellow circle isn’t there, there is just a gray circle. It means that at that time, in that place, the sun had already set! The bright-orange yellow line, indeed, indicates the direction at which the sun will rise, while the dark-orange line indicates the direction at sunset. If the image was really captured there at 18:56, we should not see direct sunlight nor shadows like those in the questioned image!
Having been warned by this potential inconsistency, we decide to take a deeper look at Exif metadata to compare the various time information (as suggested in this previous Tip!). We see that all time metadata provided by the device read 18:56, but the one provided by the GPS clock reads 15:56.
Before jumping to conclusions, remember device time is already compensated for the timezone, while GPS time follows the UTC time zone, so we first need to compensate the timezone before comparing these values. As shown on https://www.timeanddate.com, the timezone at the image location on March, 17th is UTC+1, which means that the GPS clock says the picture was taken at 16:56, not 18:56 as declared in image metadata. Which one should we trust? Let’s put 16:56 on the same suncalc.org page we had before (you can just drag the yellow circle on the top bar to set the hour).
We now see that the sun had not set yet at that time, and we can cross-check shadow directions and lengths in the image with those provided by the website: if you try you’ll find a good match. This leads us to hypothesize that, for some innocent or malicious reason, the clock of the device which captured the photo was set to a different time than the real one, or, image metadata were altered after the acquisition. Luckily for us, the GPS clock information is retrieved directly from the GPS and was not affected (or, if the time was forged, the forger forgot to change the GPS clock).
And that’s it! The integration between Amped Authenticate and SunCalc.org makes it much easier and faster to verify time and location accuracy! Don’t blindly trust your metadata.
