WH-LFBC and the embedded JPEG

The White House PDF of President Obama’s Long Form birth certificate, contains a DCTDecode encoded embedded stream, which in simple language means: A jpeg.

Simple tools allow you to extract the jpeg and with the right jpeg tools, it is possible to detect the following features:

  1. The jpeg is rotated 90 degrees counter clockwise
  2. The jpeg dimensions are 1652×1276 pixels
  3. The jpeg does not contain any metadata or exif of XIFF data
  4. The jpeg does contain a single comment tage “YCbCr”
  5. The jpeg contains Quantization matrices
  6. The jpeg is encoded in a 4-2-2 format where for each 4 8×8 bit blocks of “Y” data there is one 8×8 block of Cb and one block of Cr data
  7. The jpeg is highly compressed (~47.48% quality)

These observations are all important when one tries to establish the possible origin of the jpeg. The lack of any metadata indicating who or what created the jpeg is at odds with the jpeg being created by Adobe tools as they typically add a lot of metadata information. Of course, the metadata could have been stripped.

Now lets look at the WH 7535 jpeg, which is the jpeg extracted from the PDF created on a Xerox WorkCentre 7355

  1. The jpeg is rotated 90 degrees counter clockwise
  2. The jpeg dimensions are 1652×1276  1664 x 1280 pixels
  3. The jpeg does not contain any metadata or exif of XIFF data (identical to the WH LFBC PDF)
  4. The jpeg does contain a single comment tage “YCbCr” (Identical to the WH LFBC PDF)
  5. The jpeg contains Quantization matrices (identical to the WH LFBC PDF)
  6. The jpeg is encoded in a 4-2-2 format where for each 4 8×8 bit blocks of “Y” data there is one 8×8 block of Cb and one block of Cr data (identical to the WH LFBC PDF)
  7. The jpeg is highly compressed (~47.48% quality) (identical to the WH LFBC PDF)

The Details

1. the width is larger than the height WH LFBC is rotated counter clockwise, Xerox document clockwise

bc-000

WH LFBC

WH7535-000

Xerox WorkCentre 7355

2, 3, 4.

jpeginfo -C birth-certificate-long-form-000.jpg

birth-certificate-long-form-000.jpg 1652 x 1276 24bit n/a   N  299366 "YCbCr"

jpeginfo -C  wh/wh-lfbc-scanned-xerox-7535-wc-000.jpg

wh/wh-lfbc-scanned-xerox-7535-wc-000.jpg 1664 x 1280 24bit n/a   N  235646 "YCbCr"

5. The jpeg contains Quantization matrices

#File: birth-certificate-long-form-000.jpg

Quantization table
  Precision=0; Table index=0 (luminance)
       8  10  11  13  11   9  14  13
      12  13  16  15  14  17  22  36
      23  22  20  20  22  44  32  33
      26  36  52  46  55  54  51  46
      50  50  58  65  83  70  58  61
      78  62  50  50  72  98  73  78
      86  88  93  94  93  56  69 102
     109 101  90 108  83  91  93  89
  Estimated quality level = 47.48%

Quantization table
  Precision=0; Table index=1 (chrominance)
       8  10  11  13  11   9  14  13
      12  13  16  15  14  17  22  36
      23  22  20  20  22  44  32  33
      26  36  52  46  55  54  51  46
      50  50  58  65  83  70  58  61
      78  62  50  50  72  98  73  78
      86  88  93  94  93  56  69 102
     109 101  90 108  83  91  93  89
  Estimated quality level = 47.48%
Average quality: 47.48% (47%)
#File: wh/wh-lfbc-scanned-xerox-7535-wc-000.jpg

Quantization table
  Precision=0; Table index=0 (luminance)
       8  10  11  13  11   9  14  13
      12  13  16  15  14  17  22  36
      23  22  20  20  22  44  32  33
      26  36  52  46  55  54  51  46
      50  50  58  65  83  70  58  61
      78  62  50  50  72  98  73  78
      86  88  93  94  93  56  69 102
     109 101  90 108  83  91  93  89
  Estimated quality level = 47.48%

Quantization table
  Precision=0; Table index=1 (chrominance)
       8  10  11  13  11   9  14  13
      12  13  16  15  14  17  22  36
      23  22  20  20  22  44  32  33
      26  36  52  46  55  54  51  46
      50  50  58  65  83  70  58  61
      78  62  50  50  72  98  73  78
      86  88  93  94  93  56  69 102
     109 101  90 108  83  91  93  89
  Estimated quality level = 47.48%
Average quality: 47.48% (47%)

3 thoughts on “WH-LFBC and the embedded JPEG

  1. NBC

    So does Preview rotate your Xerox Workcenter 7535 JPEG image 180 degrees counterclockwise?

    “Spin your partner all around…”

    Hmmm… Hmmm.. Do Dah !…Do Dah !

  2. Of course, as a diligent researcher I did the experiment and noticed that while the orientation of the embedded images remains the same, opening up the document and rotating it to correct for the upside down scan, does restore sanity while still maintaining the original images in their rotated form (90 degrees)

    Rather than ridicule, you should do some research my friend. It would leave you less embarrassed when you make an issue out of something. We now also understand why the document was last touched by preview.

    So I can show you a complete work flow and all the supporting evidence.

    You… Nothing…
    Oh yes, I am writing a blog post on my findings… Fascinating how the data continues to support my hypotheses. Of course, I am still waiting on you deducing another hypothesis… I provided you with enough hints that would allow one to formulate and test it.

    Well? Time to show what you are made of?

  3. NBC

    “Of course, as a diligent researcher I did the experiment and noticed that while the orientation of the embedded images remains the same, opening up the document and rotating it to correct for the upside down scan, does restore sanity while still maintaining the original images in their rotated form (90 degrees)”

    A diligent researcher, seeking the support of the public, publishes his findings along with his data. So I don’t accept your claim that you have verified the images on MAC OS Preview.

    [NBC: You do not have to accept them. A diligent researcher would have the tools to prove me wrong…]

    It would be better if you posted your extracted bitmap images from the Preview print-to-PDF file. Also if you posted a link to this PDF then others could check the Preview file against the Xerox file to identify all of the changes that Preview makes to the Xerox PDF.

    [NBC: There is nothing preventing a diligent researcher from creating this file themselves]

    In the interim, until your results are verified by a third party, I will assume that you are now claiming that the forger is the Xerox plus the MAC OS Preview.

    In that case your claim that the WH LFCOLB was forged by the Xerox is misleading.

    [NBC: ROTFL… It should have been clear that Preview was an essential part of the workflow. Did you not notice the producer/creator tags? You’re funny…]

Comments are closed.