Arsenly_OSINTby XowiaLabs

Geoint & Images

Investigation Techniques
Browse the interactive, filterable tools for this domainOpen tools →

6.1 Metadata

exiftool -a -u foto.jpg | grep -i "gps\|date\|camera"
# strip before publishing
exiftool -all= foto_sanitizada.jpg

6.2 Geolocate

6.3 Satellite / Drone

6.4 Video OSINT & Chronolocation

Video as a specific OSINT source plus chronolocation (determining when material was recorded). Does not duplicate 6.1-6.3 (metadata, geolocation, satellite).

6.4.1 Video Geolocation Workflow — 12 Steps

# Step Tool
1 Identify the geolocation objective (humanitarian/journalistic/military) —
2 Extract keyframes with FFmpeg: ffmpeg -i video.mp4 -vf "fps=1/10" frame_%04d.png FFmpeg
3 Extract EXIF metadata: exiftool video.mp4 ExifTool
4 Analyse audio: language, accent, calls to prayer (adhan = time + orientation to Mecca) —
5 Identify visual anchors: signs, licence plates, architecture, vegetation —
6 Geolocate anchors individually with Google Lens / Yandex Images + Overpass Turbo —
7 Trace sight lines from each anchor Google Earth Pro
8 Validate with Street View Google Street View
9 Validate with historical satellite imagery Google Earth Pro + Copernicus Browser
10 Determine camera cardinal orientation with SunCalc SunCalc
11 Triangulate date (chronolocation) See 6.4.2
12 Document with BLUF + evidence package (each anchor with frame + screenshot + URL + hash) —

6.4.2 Shadow-Based Chronolocation — 8 Steps

  1. Geolocate first (6.4.1). Without lat/long, solar position cannot be calculated.
  2. Identify vertical object with a sharp projected shadow. Pole, column, standing person.
  3. Measure cardinal direction of the shadow (azimuth in degrees from Google Earth Pro).
  4. Measure relative length: ratio shadow/object_height. Solar elevation = arctan(h/l).
  5. Compute solar position with SunCalc.org (move slider until azimuth+elevation match).
  6. Resolve symmetric date ambiguity with contextual clues (vegetation, snow, datable events).
  7. Validate with historical weather. Visual Crossing Weather History (free tier).
  8. Document margin of error. Typically ±30-90 min of time, ±2-7 days of date. Report with confidence level.

6.4.3 Verified Video OSINT Tools

Tool URL Function
FFmpeg https://ffmpeg.org Video analysis and processing
FotoForensics https://fotoforensics.com ELA image analysis
Forensically https://29a.ch/photo-forensics Visual analysis suite
ExifTool https://exiftool.org Metadata
SunCalc https://www.suncalc.org Solar position
Google Earth Pro https://www.google.com/earth Historical satellite
Sentinel Hub https://www.sentinel-hub.com Sentinel-2 imagery
yt-dlp https://github.com/yt-dlp/yt-dlp Video download
GeoConfirmed https://geoconfirmed.org Collaborative geolocation

6.4.4 Real Case — Bellingcat Bucha 2022

Following the withdrawal of Russian troops from Bucha (Ukraine) in March 2022, images of civilian bodies in Yablunska Street appeared. Russia denied responsibility. Bellingcat and The New York Times published on 4 April 2022 an analysis demonstrating that the bodies were already present during the Russian occupation, using Maxar satellite imagery from 19 March.

Methodology:

  1. Geolocation of each frame with a visible body in Yablunska Street.
  2. Acquisition of Maxar imagery from 19 March (during Russian occupation).
  3. Frame-by-frame comparison: dark objects on the street in the same locations where the 2 April video showed bodies. One-to-one correspondence.
  4. Validation with second satellite (Planet Labs, 21 March).
  5. Conclusion: bodies were already on the street on 19 March (Russian control). High confidence (cross-corroboration of satellite + video + testimonies).

Sources:

← Explore the toolkit