Cruz Photo of Rubio and Obama is a Sham

Sham photo doctored up featuring Rubio and Obama Shaking Hands – Photo Forensics Reveals Forgery

Forensicon performed forensic analysis on the photo used on the
https://www.therealrubiorecord.com/images/dems.jpg website.

Forensicon performed both EXIF metadata analysis and ELA photo analysis, both which reveals the photo is a forgery.

Therealrubiorecord.com features doctored up photo. Marco Rubio allegedly shaking hands with President Obama in front of the U.S. Capitol.

Fake photo of Marco Rubio shaking hands with President Obama

Photo taken from website https://www.therealrubiorecord.com/images/dems.jpg (Note Photo was later swapped out after this post went live with a replacement photo)

The doctored up photo appears above.

EXIF Photo Forensic Analysis Findings

EXIF Embedded Metadata was extracted and appears at the bottom of this post.  The EXIF info revealed that there were 30 document ancestors (objects inserted into the picture via copy and paste operations), showing significant manipulation of the original photo used to insert the fabricated content.

Document Ancestors

  1. 04C003FCFD3519A967CC87185BA2B281
  2. 16FAC6CC44A68A3F28F9D2F2E8D013EE
  3. 1935C7AA4392AC1B95439296141D00E5
  4. 28C3241E82ED6EEBC41751BA2BC9E57D
  5. 37C078566A4212B614EA3D24D8917E95
  6. 3A16467E05C91F092065338D90B0313A
  7. 44412102F92D6C56BE7FD7066E6A2D62
  8. 4C84955A6FCD72A2428B8EEF87EFE0A2
  9. 59611E2B5C1B3B60087D319D243AD2D6
  10. 5F5B19D22E86B067A3F99A79F39BB036
  11. 603D56DBAAE2CC85B370408D7ED5E190
  12. 661131CE59C4C232BA9CA6A09DAD1530
  13. 7025449EC4816361DA9522FB3AB48EB2
  14. 75A8CE5857A77298A757F1AB153573F5
  15. 80518A5FDD17B2A2B60BC111BB482471
  16. 8D7ED3EE2568408B7210AC7A8DEEE3FD
  17. 8ECCAE45526C595E60B7B1DD04432C56
  18. B02AA4D26F4E2E90947CF6EAA5F73D16
  19. B416506982D4D4C5B9A090238943D49C
  20. BCCE274397833E6CF85A0F50EB9ED045
  21. CD8B86E0F6C2676278B0738D6AF81F73
  22. DBD21A3A01DBEAABB26BFF8A7049B0BE
  23. E537B8F8C45D3312B903C5E9C9F6C2E4
  24. EB5EF63DC19DFCA2D5D06CFFDAEA41D9
  25. adobe:docid:photoshop:54488843-0f73-1179-beae-a3923e9e7aeb
  26. adobe:docid:photoshop:79051033-0f74-1179-beae-a3923e9e7aeb
  27. adobe:docid:photoshop:af33eaec-0f74-1179-beae-a3923e9e7aeb
  28. xmp.did:42add93a-8bbe-483a-8425-ad12903e4e3e
  29. xmp.did:50ac0321-876d-42b5-9c79-444adb653d69
  30. xmp.did:F17C069D702268118083CC5D20C1A989

The majority of the discernable edits appear to have taken place on February 9th, 2016 using Photoshop on a Macintosh computer.  The EXIF Metadata shows that the original photo reports an initial creation time on August 16th, 2015 in the Eastern Time Zone (-05:00)  2015:08:16 03:24:32-05:00.  The photo reports a last modified date and time of  2016:02:09 22:03:18-06:00 which suggests the photo was edited by someone in the Central Time Zone.

 

ELA Error Level Analysis Findings

The original photo was processed using an Error Level Analysis tool.  The following screenshot depicts the results of ELA, indicating that the background picture, the picture of Marco Rubio, and the picture of President Obama were assembled from different sources.

ELA Forensic analysis involves evaluating the compression rates of different regions of a photo.  In this example, President Obama has a red tone to much of his body, which is distinctly different than the blueish tone across the front of the U.S. Capitol.  Marco Rubio’s chin has irregularities in coloring around the edges that strongly suggests editing.  The level of brightness on the objects also shows different degrees of darkness.  More recent and less edited photo elements often appear brighter and whiter, than areas that were original to the photo.  This is because with each save of a jpg photo, compression algorithms attempt to reduce the size of the file and as a result, a loss of detail happens with each subsequent save.  Older areas or areas of a photo that have been resaved several times often become very dark or all black.

ELA Photo Forensic rendering of Marco Rubio shaking hands with President Obama in front of the U.S. Capitol.

ELA (Error Level Analysis) Rendering of sham originating from https://www.therealrubiorecord.com/images/dems.jpg depicting Marco Rubio shaking hands with President Obama in front of the U.S. Capitol

EXIF Metadata follows:

EXIF embedded Meta Data was extracted from the photo, which revealed numerous edits using Photoshop.

Basic Image Information
Target image: https://www.therealrubiorecord.com/images/dems.jpg
Date: August 16, 2015 3:24:32AM (timezone is 5 hours behind GMT) (6 months, 2 days, 10 hours, 22 minutes, 44 seconds ago)

File: Color Encoding:

1,400 × 736 JPEG (1.0 megapixels) 374,360 bytes (366 kilobytes)

XMP Toolkit

Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16

Original Document ID

xmp.did:5EB2525BFE86E311B4FADE1B34BE7FA7

Document ID

xmp.did:42add93a-8bbe-483a-8425-ad12903e4e3e

Instance ID

xmp.iid:45e46721-6129-4fb0-beca-216801e70b7d

Creator Tool

Adobe Photoshop CS6 (Windows)

Create Date

2015:08:16 03:24:32-05:00
6 months, 2 days, 10 hours, 22 minutes, 44 seconds ago

Modify Date

2016:02:09 22:03:18-06:00
8 days, 15 hours, 43 minutes, 58 seconds ago

Metadata Date

2016:02:09 22:03:18-06:00
 8 days, 15 hours, 43 minutes, 58 seconds ago
Format
image/jpeg
Color Mode

RGB

Derived From Instance ID

xmp.iid:018a782f-de39-4afc-a0a1-f67c55cc7658

Derived From Document ID

xmp.did:42add93a-8bbe-483a-8425-ad12903e4e3e

Derived From Original Document ID

xmp.did:5EB2525BFE86E311B4FADE1B34BE7FA7

History Action

saved, converted, derived, saved, saved, converted, derived, saved

History Instance ID

xmp.iid:294c7195-e3d1-426c-9fef-1d2844270ae1, xmp.iid:42add93a-8bbe-483a-8425-ad12903e4e3e, xmp.iid:018a782f-de39-4afc-a0a1-f67c55cc7658, xmp.iid:45e46721-6129-4fb0-beca-216801e70b7d

History When

2016:02:09 13:18:56-06:00, 2016:02:09 13:18:56-06:00, 2016:02:09 22:03:18-06:00, 2016:02:09 22:03:18-06:00

History Software Agent

Adobe Photoshop CC (Macintosh), Adobe Photoshop CC (Macintosh), Adobe Photoshop CC (Macintosh), Adobe Photoshop CC (Macintosh)

History Changed

/, /, /, /

History Parameters

from image/jpeg to application/vnd.adobe.photoshop, converted from image/jpeg to application/vnd.adobe.photoshop, from application/vnd.adobe.photoshop to image/jpeg, converted from application/vnd.adobe.photoshop to image/jpeg

Document Ancestors

04C003FCFD3519A967CC87185BA2B281 16FAC6CC44A68A3F28F9D2F2E8D013EE 1935C7AA4392AC1B95439296141D00E5 28C3241E82ED6EEBC41751BA2BC9E57D 37C078566A4212B614EA3D24D8917E95 3A16467E05C91F092065338D90B0313A 44412102F92D6C56BE7FD7066E6A2D62 4C84955A6FCD72A2428B8EEF87EFE0A2 59611E2B5C1B3B60087D319D243AD2D6 5F5B19D22E86B067A3F99A79F39BB036 603D56DBAAE2CC85B370408D7ED5E190 661131CE59C4C232BA9CA6A09DAD1530 7025449EC4816361DA9522FB3AB48EB2 75A8CE5857A77298A757F1AB153573F5 80518A5FDD17B2A2B60BC111BB482471 8D7ED3EE2568408B7210AC7A8DEEE3FD 8ECCAE45526C595E60B7B1DD04432C56 B02AA4D26F4E2E90947CF6EAA5F73D16 B416506982D4D4C5B9A090238943D49C BCCE274397833E6CF85A0F50EB9ED045 CD8B86E0F6C2676278B0738D6AF81F73 DBD21A3A01DBEAABB26BFF8A7049B0BE E537B8F8C45D3312B903C5E9C9F6C2E4 EB5EF63DC19DFCA2D5D06CFFDAEA41D9 adobe:docid:photoshop:54488843-0f73-1179-beae-a3923e9e7aeb adobe:docid:photoshop:79051033-0f74-1179-beae-a3923e9e7aeb adobe:docid:photoshop:af33eaec-0f74-1179-beae-a3923e9e7aeb xmp.did:42add93a-8bbe-483a-8425-ad12903e4e3e xmp.did:50ac0321-876d-42b5-9c79-444adb653d69 xmp.did:F17C069D702268118083CC5D20C1A989

Tags: , , , , ,

    Related Posts

  • Staff Recognized for Departing Employee Investigations - The first issue of Corporate Counsel Business Journal, CCBJ,  includes an interview with our Director of Digital Forensics, Yaniv Schiff, and Solutions Architect, Curtis Collette, on the evolution of departing employee investigations. Departing Employee: When Do Investigations Become Necessary? appeared in the print publication, online edition, and on CCBJ’s In-House Tech website. For Increasing Numbers of Employers, Departing Employee Investigations[...Read More]
  • Chicago Office Food Drive – The Results Are In - QDiscovery’s Chicago Office collected nearly 1,000 containers of food for the local food bank this Holiday Season!  Our office competed with sister offices in Indiana and Connecticut.  Alas, we came in third.  Our sister offices each collected nearly 2,000 containers for their local food banks.  Relatively new to the company-wide food drive, the Forensics Division[...Read More]
  • QDiscovery Forensics Team Develops Award Winning App! - QDiscovery is winner of a 2017 Relativity Innovation Award.  Presented at Relativity Fest, the award celebrates organizations that create apps or integrations that extend the functionality of Relativity’s eDiscovery software.   Our development team created an application that makes the analysis of mobile collections much more manageable.  Relativity users can now produce and review mobile device data[...Read More]
  • Moving and Changing - Acquired by Connecticut-based QDiscovery in 2016, Forensicon’s capabilities multiplied overnight, both in forensics brain power and eDiscovery expertise.  As part of a leading provider of end to end litigation support, moving to larger offices that are more central to the Chicago legal community was inevitable.
  • QDiscovery Named One of the Top 20 Providers of Legal Services! - Leading industry publication, CIO Magazine, has named Forensicon’s parent company, QDiscovery, to it’s  Top 20 Providers of Legal Services.  The annual listing includes 20 companies that are at the forefront of providing legal solutions and impacting the marketplace.  Read the whole article here.  Featured in the publication alongside QDiscovery President, Dave Barrett, is Director of Digital Forensics, Yaniv[...Read More]
No comments yet.

Leave a Reply