Google Lens’s reverse image search won’t help us with this one. Let’s analyze the video.

The video was uploaded in 2007. This will come in handy later.

The title shown in the title card is “Helping the displaced in North Kivu”. This is a Congolese province shown here in the map.

Starting at 1:09, the voice over says “Those who recently arrived in Bulengo camp west of Goma are saying the rebel soldiers are forcibly conscripting any man they find.” before cutting to eye witness Madis Bakunsi Faustin sitting in the tent that we want to find.

Some notes one the location: the tent is much longer than wide. On the left side we can see a small building further away from the camera. There is a empty land with a bit of gras between the spot where the eye witness sits and the tent. In the background we can see the outline of a mountains. We can see two mountains and a bit of sky where the mountains overlap. Behind the tent are trees.

Let’s try to find the camp.

Because this is an ongoing problem in the DR Congo, my conjecture is that any of the current displacement camps in that area could have evolved from the camp we want to find.

Just searching for Bulengo camp on Google doesn’t give us proper results. It just gives a place in the middle of Goma city, but not a refugee camp. But searching for images and looking for maps finally gives us a location.

Just as we suspected, camp Bulengo still exists.

There is our Bulengo camp. Now we need to find the tent from 2007.

Google Maps doesn’t have this feature (yet?), but Google Earth does: historical satellite footage.

The earliest footage is from 2005 but it’s too blurry to see any buildings, same for 2008.

In 2010 we start to see more detailed footage but it’s cut off right where things get interesting for us.

In 2014 we finally have sufficient footage.

Assuming the tent is still present in 2014, we can analyze all the buildings. We’re looking for a long building with trees directly behind it, a little bit of gras in front, and a small building to the left behind the tent. The tent with the coordinates 1°37'19"S 29°07'36"E is a good candidate and with the 3D view we can confirm that there are mountains visible in the distance.

Task briefing:
Sometimes the fastest way to geolocate an image is to track down the movements of the person behind the lens. I took the photo below, on 20 September 2023, at 08:11 local time.

Your task is to determine:
a) What device I used to take the photograph.

Let’s see what the EXIF data says about this file. I used the online version of EXIF.tools.

“Make” is samsung, “Camera Model” is SM A125F. That’s code for a Samsung Galaxy A12.

Your task is to determine:
b) Where I was headed.

Having been to the Netherlands before, I think the building in the picture fits the Dutch architecture. This is congruent with the offset time “+02:00” from the EXIF data because the netherlands is still in daylight savings time in september.

Googling “Sofia Santos Netherlands” yields this public LinkedIn post by Santos herself. Last year she travelled to the netherlands, The Hague to be exact.

But we can only see that it was posted “1 year ago”, we need it pinpoint the exact date. Here we can use the LinkedIn Post Date Extractor by Trevor Fox.

The post was uploaded on 24th of September, which was a Sunday. In the post she writes that “Last Wednesday I finally travelled to The Hague”. The Wednesday before would therefor be the 20st of September. Which matches the date of the photo.

In another picture accompanying the LinkedIn post, we can see a screen of a presentation happening on the 20st, so we can safely assume at 8:11 in the morning she was on her way to this event.

In conclusion: Santos was on her way to Europol Headquarters in The Hague. See it here on the map.

Your task is to determine:
c) How far I was from the entrance of my destination.

Let’s determine her exact location to measure the distance to the Europol headquarters.

Thankfully, the picture gives us a few clues. The building is either stand-alone or at a corner lot. It or its neighbor has the number “55”. It is within walking distance to Europol. This reduces the number of possibilities significantly. Zooming in on GoogleMaps shows you the numbers, which makes the search quite easy.

Here we can see a corner lot on Eisenhowerlaan 55 that looks promising. Let’s see how it looks on StreetView.

And we have a winner! It matches the building in the picture. It has the same slanted building corner, the same letterbox, the same tree stump and even the same gate with the number 55.

GoogleMaps can measure the distance for us as well.

It’s about 80 meters from Eisenhowerlaan 55 to Europol. But depending on which entrance she had to take, she might have to walk a bit more.

Task briefing:
The large photo below was taken from a page of the Epoch Times, a Chinese newspaper.

Please answer the following questions:
a) What was the audience applauding?
b) When was the photo taken?
c) What is the name of the venue?

Let’s see what an reverse image search on the picture yields.

Between answers to this challenge and similar looking venues, a chinese page stands out.

My browser’s built-in translation tool gives us all the answers.

The audience was applauding the Shen Yun North American Art Troupe on January 7th 2023 (also the year doesn’t get translated correctly we can see 2023 in the print version) in the Chrysler Hall, Norfolk, Virginia.

Task briefing:
In April 2017 Mohamed Abdullahi Farmaajo, the then president of Somalia, visited Turkey. A news agency published a photo where he was seen shaking hands with Recep Tayyip Erdoğan, the country’s president. The article did not disclose where the photo was taken. Your task is to find out the name and coordinates of the location seen below.

Let’s see what GoogleLens’s reverse image search has to say about this picture.

We quickly find that this image has been used on the website of the Turkish president and it does mention a location: the presidential complex.

Let’s see what the Turkish presidential complex is all about to locate where exactly the men where standing.

From images on the internet we can see that it is indeed the correct location. We see pictures of Erdoğan shaking hands at the same spot. We recognize the minty blue carpet that gets rolled out for special occasions. We can see that the carpet extends all the way across an empty courtyard. We see the complex itself consisting of 3 multistory connected buildings.

Let’s see if we can pinpoint it on the map.

At the coordinates 39.93114, 32.79967 all the criteria are matched: It’s in front of the middle section of a 3-building complex and has a big empty courtyard in front of it. Other parts of the presidential complex lack the geographical relation to the courtyard.

Task briefing:
This is a photo of a resort located on an island.

Task briefing:
a) What is the name of the resort?

Like with the other exercises, let’s put that picture into our trusty friend, GoogleLens’s reverse image search.

Between a A LOT of similar photos, there was one that has the same island in the background and even the same clouds in the background. The same picture, but cropped! Jackpot.

It leads to the website of the Oan Resort, located in Indonesia.

Task briefing:
b) What are the coordinates of the island?

Luckily the website has a GoogleMap widget on their contact page.

Clicking on the “Google” logo opens the location on Google Maps where with the coordinates in the web URL:
https://www.google.com/maps/@7.363467,151.755744,8973m/data=!3m1!1e3?hl=en&entry=ttu&g_ep=EgoyMDI0MDkyMi4wIKXMDSoASAFQAw%3D%3D

The island is located at 7.363467, 151.755744.

Task briefing:
c) In which cardinal direction was the camera facing when the photo was taken?

While we’re in GoogleMaps already, let’s use their 3D feature.

With ctrl+mouse movements we can line up the resort island such that the islands in the background match up with the photo given.
The islands in the background seem to be Eot and Udot, located north west from the resort island, meaning the camera is facing north west as well.

If you want to know it even more precisely, the URL gives you the direction in angles and we can see it’s not exactly north west (315 degrees), but about 323 degrees.

https://www.google.com/maps/@7.3578525,151.7604735,110a,35y,323.31h,79.16t/data=!3m1!1e3?hl=en&entry=ttu&g_ep=EgoyMDI0MDkyMi4wIKXMDSoASAFQAw%3D%3D

Task briefing:
The image below shows a group of people sitting in front of a large screen that reads “Lectura en Movimiento en Lima”. A speaker can be seen standing on the left-hand side in front of three large flags.

Your task is to:
a) Name the speaker.

Searching for “Lectura en Movimiento en Lima” on Google leads us to an article about the event on the website of the OEI, one of the host organizations visible on the screen. The speaker we want to identify wears a dark suit with a light blue tie.

This picture of the man we want to identify accompanies the paragraph about the speech the director of OEI Juan Carlos Ruiz held.

A quick check later we can verify that it is indeed Juan Carlos Ruiz we are looking for.

Your task is to:
b) Identify what he was wearing on his lapel.

The same google image search we did to verify the name of the speaker also yields a picture from the event where we can clearly see the pin on his lapel.

Here we can see clearly an OEI pin the lapel of the speaker Juan Carlos Ruiz.

Your task is to:
c) Find footage of his speech.

YouTube is our trusty friend for all things video related. And it doesn’t disappoint: Searching for “Lectura en Movimiento en Lima” on YouTube yields a video about the event.

You can watch Mr. Ruiz speech here, it starts at 9:38.

Task briefing:
Maps can appear in the most unusual places. The figure below contains a chocolate bar featuring a map. Next to it you will find the satellite view of the same location.

Your task is to:
a) Find the coordinates of the location seen in both images.

Using the mission statement embossed onto the chocolate bar, a Google search for “do it right chocolate” leads us to the manufacturer of the chocolate bar.

This chocolate is made by a company called Puchero, which is located in Valladolid, Spain.

Looking at the location of that business in Google Maps, we can recognize the two very distinct lines in the chocolate map as the river Eresma and street N-601 and realize we tried looking for a map rotated by 180°.

A right click on the location reveals the coordinates: 41.35282, -4.69000

Task briefing:
On January 19, 2023, a journalist with almost 140k followers on Twitter shared an image of a destroyed vehicle amidst a large cloud of smoke and fire. The tweet said: “BREAKING: TTP carried out a suicide attack on a police post in Khyber city of Pakistan that killed three Pakistani police officers.“

The photo is not of the event described by the journalist.
a) Verify the statement above.

This is the perfect opportunity for an reverse image search with Google Lens.

Make sure to filter for exact matches, as the other results are wildly different images.

Besides a walkthrough for this exercise, this picture is featured on Wikipedia as “WaziriyaAutobombeIrak.jpg”. Waziriya is a neighboorhood in Baghdad, Irak and “Autobombe” is German for car bomb. Our first clues that this has nothing to do with a suicide attack in Khyber City, Pakistan.

The metadata from Wikipedia confirms this suspicion:

The picture is from 2006, long before the suicide attack in Khyber City, Pakistan. The photographer is affiliated with the US Navy and while the link to the exact source is broken, there are a lot more photos by Eli J. Medellin on military pages.

Conclusion:
The picture shown in the Twitter post is not linked to the suicide attack in Pakistan, but is instead a photo from 2006 from a car bomb attack in Baghdad, Irak by US Navy photographer Eli J. Medellin.

Let’s tackle OSINT Exercise #023 made available by gralhix / Sofia Santos.

Task briefing:
Sometimes online footage contains more information than meets the eye. In October 2023, I uploaded a video to my YouTube channel where, for a split second between minute 3 and 4, my desktop wallpaper is partially visible.

Let’s have a look at her Youtube-Channel, which videos she uploaded in October of 2023. Luckily it’s only one.

Now let’s find the desktop wallpaper that snook into the video.
I found it at 3:38 and learned a neat little trick: <.> and <,> let you scroll through a video on YouTube frame-wise.

Task a)
Find the title of the illustration, as given by the artist.

The Reverse Image Search by Google Lens gives you, besides many solutions to this exercise, a reddit link from the user Adam-Scythe, with the a picture called “Involuntary Rat Queen”, which looks sufficiently similar to our wallpaper.

To verify that this user is who they claim to be, we quickly find a portfolio page connected to an Adam Scythe (https://adamscythe.my.canva.site/) which features the same image in it’s About-Me-section.

To conclude the first task: The illustration is “Involuntary Rat Queen” by digital artist Adam Scythe.

b) Find how much it would cost for the artist to create a similar piece, in size and detail.

On the portfolio website, the artist links to their instagram account, which in turn has a link to a commission site:

The artist hast listed commission prices for characters, backgrounds, and full illustrations.

As the illustration in question pictures a character with a detailed background, I would classify it as a full illustration. The example pictures are in similar size and detail, which confirms my assessment.

To conclude the answer to the second task: A similar picture by the same artist would start at $190.

My thoughts on the difficulty:
This was my first OSINT exercise. I was able to do it quick and easy, therefore I agree with the difficulty level “easy even for beginners”

My lessons learned:
The buttons <.> and <,> let you scroll through a video on YouTube frame-wise.

And of course, there have to be snakes in here somewhere.

Syntax

Whether you are learning python as your first language or as an experienced programmer, you’ll notice some things that make python unique.

Semicolons and Braces

For example, you’ll notice all the stuff you DON’T have to use, most notably semicolons and braces:

But still. The compiler has to know what is what. Everything comes with a price. And with python, that price is measured in indentation errors.

Indentation

And there we have it: a perfectly good reason to make fun of python for camp “I’d rather use semicolons and braces”. And the memes are full of it.

But why spaces? Can’t I just use tabs like I always have? Yes. But. PEP8 defines the Style Guide for Python Code. It strongly recommends spaces over tabs:

Spaces are the preferred indentation method.

Tabs should be used solely to remain consistent with code that is already indented with tabs.

Python 3 disallows mixing the use of tabs and spaces for indentation.

Python 2 code indented with a mixture of tabs and spaces should be converted to using spaces exclusively.

When invoking the Python 2 command line interpreter with the -t option, it issues warnings about code that illegally mixes tabs and spaces. When using -tt these warnings become errors. These options are highly recommended!

While tabs aren’t forbidden, spaces are recommended for new code. Just make sure you don’t mix the two!

Truths

Then there is something that annoys every new python programmer: true isn’t true. Only True™ is true.

And while it is really annoying the first 3 or 37 times, annoying things make great memes. Common pain and laughter will always unite people all over the world.

But why does Python use “True” instead of “true”? We can find the answer in the Python Enhancement Proposal for Bool Types.

Should the constants be called ‘True’ and ‘False’ (similar to None) or ‘true’ and ‘false’ (as in C++, Java and C99)?

=> True and False.

Most reviewers agree that consistency within Python is more important than consistency with other languages.

As it turns out, earlier versions of Python didn’t have a bool type and used 0 or 1 instead. But Python had already set a precedent for naming built-in constants with the None constant. Having to chose between a rock and a hard place, most reviewers agreed in favor of consistency within Python.

Brevity and Neat Tricks

Python is famous for the ability to do a whole in just a few lines of code.

And every uniqueness can be made into a meme.

Maybe you use the methods mentioned all the time, but especially for beginners, it is helpful to see what the community thinks of the most elegant way to a certain thing. Especially if you have been corrupted by other languages and would never think about a shorter way of doing things.

The Awesome Python Community

As it’s custom with (almost) every language: There are hardcore and loyal python fans who love coding in python. And yes, that comes with some shade towards other languages. But in the end, we’re all programmers.

I have got to know the python community as an open and fun group of people who love to share knowledge. The events from different python user groups have always been fun and interesting, even as a programming beginner. So don’t be hesitant, find out when the next Python user group is gathering and get in touch with the community. In a lot of cities, there are even PyLadies-Chapters focused on helping more women become active participants and leaders in the Python open-source community.

See you at the next MeetUp!