OSINT Image & Video Verification 2 — Questions and Answers
Question 1: Which metadata field in a JPEG's EXIF data most directly reveals the GPS coordinates where a photo was taken?
- GPSLatitude and GPSLongitude tags (Correct answer)
- DateTimeOriginal tag
- CameraModel tag
- ImageDescription tag
Correct answer: GPSLatitude and GPSLongitude tags
The GPSLatitude and GPSLongitude EXIF tags store the precise coordinates embedded by smartphones and GPS-enabled cameras at the moment of capture.
Question 2: An analyst suspects a video was recorded at a different time than claimed. Which visual cue in the footage could help establish the actual time of day?
- Shadow length and direction relative to the sun's position (Correct answer)
- The resolution of the video file
- The frame rate encoded in the video
- The color profile used during editing
Correct answer: Shadow length and direction relative to the sun's position
Shadow length and direction can be cross-referenced with solar calculators to determine the approximate time of day and season a video was recorded.
Question 3: What does the term 'metadata stripping' mean in the context of image verification?
- Removing embedded EXIF/IPTC data before sharing a file (Correct answer)
- Reducing image file size through compression
- Converting an image to a different format
- Applying a filter to obscure identifying features
Correct answer: Removing embedded EXIF/IPTC data before sharing a file
Metadata stripping removes embedded information such as GPS coordinates, device identifiers, and timestamps from image files, often to protect privacy or conceal origin.
Question 4: Which technique involves overlaying a satellite or map image on top of a photo to confirm the depicted location matches the claimed site?
- Geospatial cross-referencing (Correct answer)
- Pixel interpolation analysis
- Chroma key compositing
- Steganographic decoding
Correct answer: Geospatial cross-referencing
Geospatial cross-referencing aligns visual landmarks in a photo with satellite or street-level imagery to confirm or refute a claimed location.
Question 5: An OSINT analyst finds a viral photo allegedly from a recent protest. Performing a reverse image search returns results dated three years earlier. What does this most likely indicate?
- The image is recycled from an older event and may be misrepresented (Correct answer)
- The image was taken with an older camera model
- The image has been digitally altered
- The reverse image search engine has indexed the photo incorrectly
Correct answer: The image is recycled from an older event and may be misrepresented
Earlier reverse image search dates strongly suggest the photo pre-dates the claimed event, indicating possible misattribution or deliberate reuse of old imagery.
Question 6: Which tool is specifically designed for authenticating images by detecting inconsistencies in JPEG compression artifacts?
- FotoForensics (Error Level Analysis) (Correct answer)
- Google Reverse Image Search
- InVID/WeVerify
- Maltego
Correct answer: FotoForensics (Error Level Analysis)
FotoForensics uses Error Level Analysis (ELA) to detect areas of an image that were re-saved at different compression levels, indicating potential manipulation.
Question 7: A video clip appears to show a building collapse, but the collapse direction seems to defy gravity. What analysis method should an OSINT analyst apply first?
- Check if the video has been reversed or played backwards (Correct answer)
- Analyze the audio frequency spectrum
- Run a facial recognition scan on bystanders
- Search for the video's codec information
Correct answer: Check if the video has been reversed or played backwards
Reversed videos are a common manipulation tactic; checking playback direction is a quick first step before more complex analysis.
OSINT Image & Video Verification 2
Which metadata field in a JPEG's EXIF data most directly reveals the GPS coordinates where a photo was taken?