OSINT. Determining the location by photo. Global and local indicators.

23 April 2023 11 minutes Author: Cyber Witcher

OSINT and intuition

Modern smartphones (and many digital cameras) embed GPS coordinates in every picture. Yes, the photos you take have location data embedded in them – at least by default. You can hide this information when sharing private photos online. GPS coordinates are stored as “metadata” embedded in the photo files themselves. All you have to do is view the properties of the file and search for it. But I thought it was too simple and decided to find a more complex investigation for myself. I don’t think any investigative training program recommends relying on intuition to find solutions. This is not necessarily a bad thing, because any conclusions a researcher comes to must be supported by objective evidence. Anyone should be able to repeat the steps and reach the result. However, any experienced researcher will rely heavily on intuition, even if they don’t realize it.

The reason is simple: intuition is a much more rational process than we think. In a second, our brain makes dozens of unconscious calculations based on previous experience to reach a very quick decision. A good instinct is a stupid reaction. It allows you to “think without thinking”, and it would be pointless to ignore your intuition altogether. What does this have to do with OSINT and photo location? When I was solving Yuri’s Quiztime challenge, my journey began with a guess that the place was in Eastern Europe – purely from the look of the photo. I had no rational reason to prove it, but intuition guided me in the right direction.

Global – Local

The goal of this challenge was not just to find where the photo was taken – it was necessary to determine the floor of the building where it was taken. It was a difficult challenge. Nothing obvious to immediately conclude about a part of the world, let alone what city or house. The background details were too blurry for parts of them to be used for image searches, and the chairs and table in the foreground were not very noticeable. And where to start? I guessed it was in Eastern Europe, though I couldn’t explain why. Looking back, I think my intuition kicked in because of the concrete buildings. It didn’t resemble anything from the Western Europe I knew, and the vegetation and houses were not Asian or African.

Some posts on Quiztime talk a lot about starting big and then refining your search parameters to localize and eventually find the right location. I tried this approach with this photo. Instead of “big” and “small”, I used the concepts of “global” and “local”. “Global” clues are something in an image that can tell me what part of the world it is in. The “local” hints will help me find the exact location after I use the global hints to find the approximate location.

Photo from the top of the building.

The items in the green rectangles were what I would classify as global indicators – if they can be identified and then put together, they will roughly show what city it is in. Items in red rectangles are local indicators: they are not specific to a country or city, but together with global indicators will help to find a specific place.

It might not be entirely obvious what I was looking at, so here’s a quick rundown:

Global indicators:

  1. Single-decker bus with red and white coloring. In particular, it is a red stripe on the rear lower part and white on the rest of the part.

  2. The group of buildings that stands out is much higher than the surrounding ones. One seems to be yellow.

  3. A green highway sign that looks like it’s indicating an exit. One digit of the road number appears on it.

Local indicators:

  1. Motorway sign (again). Shows us that the place will be next to the road, maybe next to the exit.

  2. A strange tent-like roof leading to the bridge that crosses the highway.

  3. Table and chairs. This is probably the most local indicator and will only be useful for finding out the final exact location.

The abundance of frames in the image means that this is correct OSINT.

So we can say that this place is in a city where there are red and white buses. A tall yellow building will dominate the city. A tall yellow building will be in the field of view of the place. There is a freeway nearby, which may have a single-digit number. Near the location will be a strange, tent-like structure that leads to a bridge that crosses the highway. Inside the building will be a cafe or restaurant with chairs and tables that look like the picture. And this is probably in Eastern Europe, although there is no objective reason (yet) to say that this is really so.

Bus

I started with the bus because I thought it was the best opportunity to define the country and the city. I decided to focus on Eastern Europe, so my search method was to use Google Images and search for “country” + “red and white bus”. It was clumsy, but it worked. Poland decided first. There were some red and white buses, but they were old and didn’t look like the picture. Then we found Slovakia. There weren’t many matches, but the photo above looked promising – mostly a white bus with a red one behind it. I couldn’t discount it, so I added Slovakia to the list of candidates. Then I came across the Czech Republic. Again, there weren’t many buses like the one in the picture, but one photo stood out. When I clicked on it, it brought up many similar photos showing that the trams and buses in Prague are also red and white like the picture.

Bus of Slovenia.

Public transport of the Czech Republic.

At this point I got a little sad. I’ve only checked buses in three countries so far, and already two of them had red and white buses that were possible matches. What if I search ten more countries and find ten more matches? It will take too long. At this point, I took a bit of a risk and decided to switch from searching by country to city. If I make a mistake, I can go back to the country search again. I looked at the ten largest cities in the Czech Republic and Slovakia. Then I again used the search for similar images on Google, using the query “city” + “bus”. Most of the cities did not appear in the results, but Bratislava, Brno and Prague looked like they were actually using the red and white buses. To be honest, it was very difficult to comb through these three cities, knowing that there were a bunch of other European cities that I hadn’t even looked at.

I used the motorway sign to rule out Brno as an option. The sign showed a one-digit number of the motorway, while Brno only has a part of the #2 motorway, which is single-digit. After a quick check with Google 3D maps, I couldn’t find any areas that looked like the right place.

The same highway number 2 also passed through Bratislava, but again I could not find anything similar to the right place. Prague was the only option left, but it is surrounded by highways 0, 1, 2, 4, 6, and 7, and they could all be the same highway.

I spent a lot of time just looking at cities in Google 3D maps. It’s a very inefficient way to find a place, especially when you know you might even be looking at the wrong country. I did not approach the table and chairs from the picture and was fed up with the search.

Prague on Google Maps

Визначаємо будівлі

After a break, I came back and tried a different approach. He was rude too, but it worked. I decided to forget about the buses and focus on Prague instead of Bratislava, because the 3D maps showed that it has more high-rise buildings than Bratislava. If I make a mistake, I can always go back and look at other places. So, I looked at the next global indicator – a tall yellow building. One Google image query for “tall yellow building” + “Prague” returned many useless results, but one match stood out. This is a tall yellow building – Hotel Opatov in Prague. It looked a lot like the tall buildings in the photo. If it was the Opatov Hotel, I could switch to 3D view on google maps, find the freeway in line of sight of the hotel with the odd tent and bridge across it, and then I’d find the place. Here is the original photo with the surrender image.

The building from the initial photo.

The result of a query in Google images.

And here is the Opatov hotel on the map:

And on the 3D map:

Hotel Opatov on Google Maps:

There is a highway nearby! The highway has a unique number – yes! It is next to several concrete houses – yes!

Well, I switched to a 3D map to reproduce the original image as best as possible. This is the closest approximation to 3D projection. The angle is slightly off, but the Opatov Hotel is on the right in the distance, the motorway in the foreground, the bus stop on the right. This is all evidence of the shopping center Centrum Chodov.

Maximum zoom on the 3D map.

We sum up with local indicators.

So the world indicators led me here. But to find the exact location, I had to find local indicators. There was a strange tent next to the highway bridge. “Tent” is a roof for a bus station. I had to use street view to find a photo of the buses and see what they actually look like close up. Bingo! Parked in the same location and color scheme as the original photo.

Image of the area on a 3D map.

Using street view to find the right photo.

Then I checked the freeway on Street view.

Here’s a close-up of the sign. Perfectly coincides with the original photo and informs about the exit from highway #2.

Using street view to check the highway.

The mystery was still not completely solved – I still needed to find which floor the photo was taken from. I rotated the 3D map 180 degrees.

Old image of a shopping center on a 3D map.

The mall was probably still under construction when this was taken. But I searched and got a more recent version of the photo from Google Earth.

A modern image of the shopping center from Google Earth

By comparing the original image and Google 3D Maps, you could tell that the photo was taken from a location close behind one of these windows. But which floor? The corner was too big for the first floor. There is a Spicymama restaurant on the ground floor, but I couldn’t find photos of the interior that matched the original image. I thought that when you want to know where something is in a mall, you just go there and look at the floor plan. I decided that the best way to find the exact location was to find a plan of the Centrum Chodov building and then try to find photos of the interior by name of the possible locations until I found the right one.

I started with the knowledge that this place was either Spicymama or very close to it. The interactive floor plan showed that there were only cafes on the first and second floors, so there wasn’t much to choose from.

Spicymama’s interior just didn’t fit. Like the Kobe Fusion on the floor above.

We look at the interiors of the premises.

I checked out a nearby place that sold groceries, Page Cafe. A quick Facebook photo search of “Page Cafe Centrum Chodov” returned the following match:

We find the room we need.

Perfectly! The tables and chairs match, you can see the roof of the bus station from the outside, and even the cells are the same. I was very pleased to find this place, because it was a difficult challenge. My guess about Eastern Europe was correct, and despite the initial disappointment, the big-to-small (or global-to-local) search method paid off again.

Other related articles
Found an error?
If you find an error, take a screenshot and send it to the bot.