Sham photo doctored up featuring Rubio and Obama Shaking Hands – Photo Forensics Reveals Forgery
Forensicon performed forensic analysis on the photo used on the
Forensicon performed both EXIF metadata analysis and ELA photo analysis, both which reveals the photo is a forgery.
Therealrubiorecord.com features doctored up photo. Marco Rubio allegedly shaking hands with President Obama in front of the U.S. Capitol.
The doctored up photo appears above.
EXIF Photo Forensic Analysis Findings
EXIF Embedded Metadata was extracted and appears at the bottom of this post. The EXIF info revealed that there were 30 document ancestors (objects inserted into the picture via copy and paste operations), showing significant manipulation of the original photo used to insert the fabricated content.
The majority of the discernable edits appear to have taken place on February 9th, 2016 using Photoshop on a Macintosh computer. The EXIF Metadata shows that the original photo reports an initial creation time on August 16th, 2015 in the Eastern Time Zone (-05:00) 2015:08:16 03:24:32-05:00. The photo reports a last modified date and time of 2016:02:09 22:03:18-06:00 which suggests the photo was edited by someone in the Central Time Zone.
ELA Error Level Analysis Findings
The original photo was processed using an Error Level Analysis tool. The following screenshot depicts the results of ELA, indicating that the background picture, the picture of Marco Rubio, and the picture of President Obama were assembled from different sources.
ELA Forensic analysis involves evaluating the compression rates of different regions of a photo. In this example, President Obama has a red tone to much of his body, which is distinctly different than the blueish tone across the front of the U.S. Capitol. Marco Rubio’s chin has irregularities in coloring around the edges that strongly suggests editing. The level of brightness on the objects also shows different degrees of darkness. More recent and less edited photo elements often appear brighter and whiter, than areas that were original to the photo. This is because with each save of a jpg photo, compression algorithms attempt to reduce the size of the file and as a result, a loss of detail happens with each subsequent save. Older areas or areas of a photo that have been resaved several times often become very dark or all black.
EXIF Metadata follows:
EXIF embedded Meta Data was extracted from the photo, which revealed numerous edits using Photoshop.
Basic Image Information
Target image: https://www.therealrubiorecord.com/images/dems.jpg
Date: August 16, 2015 3:24:32AM (timezone is 5 hours behind GMT) (6 months, 2 days, 10 hours, 22 minutes, 44 seconds ago)
File: Color Encoding:
1,400 × 736 JPEG (1.0 megapixels) 374,360 bytes (366 kilobytes)
Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16
Original Document ID
Adobe Photoshop CS6 (Windows)
6 months, 2 days, 10 hours, 22 minutes, 44 seconds ago
8 days, 15 hours, 43 minutes, 58 seconds ago
2016:02:09 22:03:18-06:00 8 days, 15 hours, 43 minutes, 58 seconds ago
Derived From Instance ID
Derived From Document ID
Derived From Original Document ID
saved, converted, derived, saved, saved, converted, derived, saved
History Instance ID
xmp.iid:294c7195-e3d1-426c-9fef-1d2844270ae1, xmp.iid:42add93a-8bbe-483a-8425-ad12903e4e3e, xmp.iid:018a782f-de39-4afc-a0a1-f67c55cc7658, xmp.iid:45e46721-6129-4fb0-beca-216801e70b7d
2016:02:09 13:18:56-06:00, 2016:02:09 13:18:56-06:00, 2016:02:09 22:03:18-06:00, 2016:02:09 22:03:18-06:00
History Software Agent
Adobe Photoshop CC (Macintosh), Adobe Photoshop CC (Macintosh), Adobe Photoshop CC (Macintosh), Adobe Photoshop CC (Macintosh)
/, /, /, /
from image/jpeg to application/vnd.adobe.photoshop, converted from image/jpeg to application/vnd.adobe.photoshop, from application/vnd.adobe.photoshop to image/jpeg, converted from application/vnd.adobe.photoshop to image/jpeg
04C003FCFD3519A967CC87185BA2B281 16FAC6CC44A68A3F28F9D2F2E8D013EE 1935C7AA4392AC1B95439296141D00E5 28C3241E82ED6EEBC41751BA2BC9E57D 37C078566A4212B614EA3D24D8917E95 3A16467E05C91F092065338D90B0313A 44412102F92D6C56BE7FD7066E6A2D62 4C84955A6FCD72A2428B8EEF87EFE0A2 59611E2B5C1B3B60087D319D243AD2D6 5F5B19D22E86B067A3F99A79F39BB036 603D56DBAAE2CC85B370408D7ED5E190 661131CE59C4C232BA9CA6A09DAD1530 7025449EC4816361DA9522FB3AB48EB2 75A8CE5857A77298A757F1AB153573F5 80518A5FDD17B2A2B60BC111BB482471 8D7ED3EE2568408B7210AC7A8DEEE3FD 8ECCAE45526C595E60B7B1DD04432C56 B02AA4D26F4E2E90947CF6EAA5F73D16 B416506982D4D4C5B9A090238943D49C BCCE274397833E6CF85A0F50EB9ED045 CD8B86E0F6C2676278B0738D6AF81F73 DBD21A3A01DBEAABB26BFF8A7049B0BE E537B8F8C45D3312B903C5E9C9F6C2E4 EB5EF63DC19DFCA2D5D06CFFDAEA41D9 adobe:docid:photoshop:54488843-0f73-1179-beae-a3923e9e7aeb adobe:docid:photoshop:79051033-0f74-1179-beae-a3923e9e7aeb adobe:docid:photoshop:af33eaec-0f74-1179-beae-a3923e9e7aeb xmp.did:42add93a-8bbe-483a-8425-ad12903e4e3e xmp.did:50ac0321-876d-42b5-9c79-444adb653d69 xmp.did:F17C069D702268118083CC5D20C1A989
- Staff Recognized for Departing Employee Investigations - The first issue of Corporate Counsel Business Journal, CCBJ, includes an interview with our Director of Digital Forensics, Yaniv Schiff, and Solutions Architect, Curtis Collette, on the evolution of departing employee investigations. Departing Employee: When Do Investigations Become Necessary? appeared in the print publication, online edition, and on CCBJ’s In-House Tech website. For Increasing Numbers of Employers, Departing Employee Investigations[...Read More]
- Chicago Office Food Drive – The Results Are In - QDiscovery’s Chicago Office collected nearly 1,000 containers of food for the local food bank this Holiday Season! Our office competed with sister offices in Indiana and Connecticut. Alas, we came in third. Our sister offices each collected nearly 2,000 containers for their local food banks. Relatively new to the company-wide food drive, the Forensics Division[...Read More]
- QDiscovery Forensics Team Develops Award Winning App! - QDiscovery is winner of a 2017 Relativity Innovation Award. Presented at Relativity Fest, the award celebrates organizations that create apps or integrations that extend the functionality of Relativity’s eDiscovery software. Our development team created an application that makes the analysis of mobile collections much more manageable. Relativity users can now produce and review mobile device data[...Read More]
- Moving and Changing - Acquired by Connecticut-based QDiscovery in 2016, Forensicon’s capabilities multiplied overnight, both in forensics brain power and eDiscovery expertise. As part of a leading provider of end to end litigation support, moving to larger offices that are more central to the Chicago legal community was inevitable.
- QDiscovery Named One of the Top 20 Providers of Legal Services! - Leading industry publication, CIO Magazine, has named Forensicon’s parent company, QDiscovery, to it’s Top 20 Providers of Legal Services. The annual listing includes 20 companies that are at the forefront of providing legal solutions and impacting the marketplace. Read the whole article here. Featured in the publication alongside QDiscovery President, Dave Barrett, is Director of Digital Forensics, Yaniv[...Read More]