Following the Applewhite document

I have been trying to recreate the likely work flow of Applewhite’s photograph, identified by DCSA103. Since Hermitian is having problems extracting the jpeg from the PDF, here are the necessary steps, including the jpeg itself. I feel that I should lend him a helping hand every now and then.

I have been consulting the following documents

    • The PDF found a this Muscatine Journal website. Note that Muscatine appears to be in Iowa, a detail which relevance will become clear in a moment. The page shows a PDF which can be downloaded from this linkd: 4db82608b486f.pdf
    • The AP PDF found at this link called ap_obama_certificate_dm_110427.pdf

Remember that PDF’s embed often images such as JPEGS which can be extracted. JPEGS contain telltale signs left behind by the software/hardware that touched the image.

In addition, PDF’s often contains create and modification tags which give as a hint as to the original creation and modification times/dates. We need to be careful in interpreting the time as tools often ‘localize’ them. So the best format is something like yyyy-mm-ddTHH:MM:SSxx:00 where xx:00 describes the GMT offset and can be both a negative and positive number.

Some further references

GMT-06:00 – Indicates a time consistent with Iowa (central time) EST

GTM-05:00 – Indicates east-coast time CST

GMT-0:400 – Atlantic time zone AST

But if things were only this simple… The United States observes Daylight Savings Time which starts on the second Sunday in March.

Now all the time zones switch

GMT-06:00 – Now becomes Mountain Daylight Time MDT

GTM-05:00 – Now becomes Central Daylight Time CDT

GMT-0:400 – Now becomes Eastern Daylight Time EDT

Things become incredibly interesting and confusing when looking at these time stamps as they depend on whether or not the software/hardware supports daylight savings time adjustments. For instance, what are the time settings on the camera used? Are all the other computers set up correctly as well and do the tools insert the correct time stamps? So when interpreting these data, we need to be very careful as we may be one hour off.

Step 1:

Extract jpeg from ap_obama_certificate_dm_110427.pdf and call it ap_obama_certificate_dm_110427.-000jpg

Obama

Now check out the Metadata. The caption indicates that it is a photo (AP Photo J. Scott Applewhite) and the date/time shows that the photo was captured (EXIF)  Date Time Original: Apr 27, 2011 8:53:21 AM. So let’s look at a plausible workflow: Applewhite used Raw Camera Capture to import the RAW photograph into Photoshop and saved it as a JPEG. The resulting JPEG was sent to the DC office or alternatively, the conversion was done at the DC office based on the raw data. Note how the Creator is Adobe Acrobat 8.26 and the Produced Adobe Acrobat 8.26 Image Conversion Plug-in. Someone created a PDF from a converted image.

Visual inspection Hex Editor

0XFFED APP13 Tag Photoshop @Offset 38

01 96 50 68 6F 74 6F 73 68 6F 70 20 33 2E 30 00 38 42 49 4D 04 04 00 00 00 00 01 7A 1C 02 00 00 02 00 01 1C 02 05 00 05 4F 62 61 6D 61 1C 02 0A 00 02 35 20 1C 02 0F 00 01 41 1C 02 28 00 29 48 41 4E 44 4F 55 54 20 49 4D 41 47 45 20 50 52 4F 56 49 44 45 44 20 42 59 20 54 48 45 20 57 48 49 54 45 20 48 4F 55 53 45 1C 02 37 00 08 32 30 31 31 30 34 32 37 1C 02 3C 00 06 30 38 35 33 32 31 1C 02 50 00 13 4A 2E 20 53 63 6F 74 74 20 41 70 70 6C 65 77 68 69 74 65 1C 02 55 00 03 53 54 46 1C 02 5A 00 0A 57 61 73 68 69 6E 67 74 6F 6E 1C 02 5F 00 02 44 43 1C 02 65 00 03 55 53 41 1C 02 67 00 07 44 43 53 41 31 30 33 1C 02 6E 00 02 41 50 1C 02 73 00 02 41 50 1C 02 78 00 A7 54 68 69 73 20 68 61 6E 64 6F 75 74 20 69 6D 61 67 65 20 70 72 6F 76 69 64 65 64 20 62 79 20 74 68 65 20 57 68 69 74 65 20 48 6F 75 73 65 20 73 68 6F 77 73 20 61 20 63 6F 70 79 20 6F 66 20 74 68 65 20 6C 6F 6E 67 20 66 6F 72 6D 20 6F 66 20 50 72 65 73 69 64 65 6E 74 20 42 61 72 61 63 6B 20 4F 62 61 6D 61 27 73 20 62 69 72 74 68 20 63 65 72 74 69 66 69 63 61 74 65 20 66 72 6F 6D 20 48 61 77 61 69 69 2E 20 28 41 50 20 50 68 6F 74 6F 2F 4A 2E 20 53 63 6F 74 74 20 41 70 70 6C 65 77 68 69 74 65 29 20 1C 02 7A 00 0D 4A 53 41 20 52 43 4C 2A 2A 44 43 2A 2A

01 96 – Length tag

50 68 6F 74 6F 73 68 6F 70 20 33 2E 30 – Photoshop 3.0

00 38 42 49 4D –

04 04 – IPTCData (IPTC Tags) Read specification IPTC

Underlined data IPTCData

IPTC

Application Record Version 1
Object Name Obama
Urgency Normal Urgency (5 )
Category A
Special Instructions HANDOUT IMAGE PROVIDED BY THE WHITE HOUSE
Date Created 2011:04:27
Time Created 08:53:21 No time zone provided
By-line J. Scott Applewhite
By-line Title STF
City Washington
Province-State DC
Country-Primary Location Name USA
Original Transmission Reference DCSA103
Credit AP
Source AP
Caption-Abstract This handout image provided by the White House shows a copy of the long form of President Barack Obama’s birth certificate from Hawaii. (AP Photo/J. Scott Applewhite)
Writer-Editor JSA RCL**DC**

File — basic information derived from the file.

File Type JPEG
MIME Type image/jpeg
Current IPTC Digest b015085645ec2f47bc93d5c65cb4b3f7
Encoding Process Baseline DCT, Huffman coding
Bits Per Sample 8
Color Components 3
File Size 1039 kB
Image Size 2,698 × 3,234 (8.7 megapixels)
Image compression: 96%
Y Cb Cr Sub Sampling YCbCr4:2:0 (2 2)
Quantization table
  Precision=0; Table index=0 (luminance)
       7   5   6   6   6   5   7   6
       6   6   8   8   7   9  11  18
      12  11  10  10  11  23  16  17
      13  18  27  23  28  28  26  23
      26  25  29  33  42  36  29  31
      40  32  25  26  37  50  37  40
      44  45  47  48  47  29  35  52
      56  52  46  55  42  46  47  46
  Estimated quality level = 73.25%

Quantization table
  Precision=0; Table index=1 (chrominance)
       8   8   8  11  10  11  22  12
      12  22  46  30  26  30  46  46
      46  46  46  46  46  46  46  46
      46  46  46  46  46  46  46  46
      46  46  46  46  46  46  46  46
      46  46  46  46  46  46  46  46
      46  46  46  46  46  46  46  46
      46  46  46  46  46  46  46  46
  Estimated quality level = 59.56%
Average quality: 77.55% (78%)

General

Color Model: RGB
Depth: 8
DPI Height: 200
DPI Width: 200
Pixel Height: 3,234
Pixel Width: 2,698

EXIF

Date Time Original: Apr 27, 2011 8:53:21 AM

IPTC

Creator: J. Scott Applewhite
Creator’s Jobtitle: STF
Caption/Description: This handout image provided by the White House shows a copy of the long form of President Barack Obama’s birth certificate from Hawaii. (AP Photo/J. Scott Applewhite)
Category: A
City: Washington
Country: USA
Provider: AP
Date Created: Apr 27, 2011
Title: Obama
Job Identifier: DCSA103
Province/State: DC
Source: AP
Instructions: HANDOUT IMAGE PROVIDED BY THE WHITE HOUSE
Time Created: 8:53:21 AM
Urgency: 5
Caption/Description Writer: JSA RCL**DC**

JFIF

Density Unit: 1
JFIF Version: 1.1
X Density: 200
Y Density: 200

TIFF

Artist: J. Scott Applewhite
Image Description: This handout image provided by the White House shows a copy of the long form of President Barack Obama’s birth certificate from Hawaii. (AP Photo/J. Scott Applewhite)

The Quantization Matrices do not match the Photoshop CS format… Still the APP13 shows it was created by Photoshop 3.0. An Error Level Analysis (ELA: Neal Krawetz) shows no evidence of manipulation in this image.

4db82608b486f.jpg Manually extracted using hex editor

File:1,243 × 1,043 JPEG (1.3 megapixels)

The jpeg contains no information as to the date or time it was created.

APP14 (Adobe Tag)

DCT Encode Version 100
APP14 Flags 0 Encoded with Blend=1 downsampling
APP14 Flags 1 (none)
Color Transform YCbCr

File — basic information derived from the file.

File Type JPEG
MIME Type image/jpeg
Encoding Process Baseline DCT, Huffman coding
Bits Per Sample 8
Color Components 3
File Size 5.6 MB
Image Size 1,043 × 1,243
Y Cb Cr Sub Sampling YCbCr4:2:0 (2 2)
Quantization table
  Precision=0; Table index=0 (luminance)
       4   3   3   4   3   4   6   5
       5   6   8   7   7   7   8   9
       8   8   8   8   9  12  10  10
      10  10  10  12  14  12  12  12
      12  12  12  14  12  13  13  13
      13  13  12  14  16  16  16  16
      14  18  20  20  20  18  20  20
      20  20  20  20  20  20  20  20
  Estimated quality level = 87.67%
  Precision=0; Table index=1 (chrominance)
       4   4   4   5   5   5  12   9
       9  12  20  14  14  14  20  20
      17  17  17  17  20  20  20  20
      20  20  20  20  20  20  20  20
      20  20  20  20  20  24  24  24
      24  24  20  27  27  27  27  27
      27  27  27  27  27  27  27  27
      27  27  27  27  27  27  27  27
  Estimated quality level = 79.65%
Average quality: 90.18% (90%)

Color Model: RGB
Depth: 8
DPI Height: 72
DPI Width: 72
Pixel Height: 1,243
Pixel Width: 1,043

The following data shows how the JPEG embedded in the Muscatine Journal’s PDF and the DCSA103 jpeg embedded in the AP PDF  share a lot in common.

<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?>
<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="3.1.1-111">
<rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#">
<rdf:Description rdf:about="" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/">
   <photoshop:Source>AP</photoshop:Source>
   <photoshop:Country>USA</photoshop:Country>
   <photoshop:Credit>AP</photoshop:Credit>
   <photoshop:City>Washington</photoshop:City>
   <photoshop:CaptionWriter>JSA RCL**DC**</photoshop:CaptionWriter>
   <photoshop:DateCreated>2011-04-27</photoshop:DateCreated>
   <photoshop:TransmissionReference>DCSA103</photoshop:TransmissionReference>
   <photoshop:State>DC</photoshop:State>
   <photoshop:Urgency>5</photoshop:Urgency>
   <photoshop:Instructions>HANDOUT IMAGE PROVIDED BY THE WHITE HOUSE</photoshop:Instructions>
   <photoshop:Category>A</photoshop:Category>
   <photoshop:AuthorsPosition>STF</photoshop:AuthorsPosition>
   <photoshop:ColorMode>3</photoshop:ColorMode>
   <photoshop:ICCProfile>QCT RGB settings</photoshop:ICCProfile>
   <photoshop:History/>
</rdf:Description>
<rdf:Description rdf:about="" xmlns:dc="http://purl.org/dc/elements/1.1/">
   <dc:format>application/pdf</dc:format>
   <dc:title>
      <rdf:Alt>
         <rdf:li xml:lang="x-default">Obama</rdf:li>
      </rdf:Alt>
   </dc:title>
   <dc:creator>
      <rdf:Seq>
         <rdf:li>J. Scott Applewhite</rdf:li>
      </rdf:Seq>
   </dc:creator>
   <dc:description>
      <rdf:Alt>
         <rdf:li xml:lang="x-default">This handout image provided by the White House shows a copy of the long form of President Barack Obama's birth certificate from Hawaii. (AP Photo/J. Scott Applewhite)</rdf:li>
      </rdf:Alt>
   </dc:description>
   <dc:rights>
      <rdf:Alt>
         <rdf:li xml:lang="x-default">AP2011</rdf:li>
      </rdf:Alt>
   </dc:rights>
</rdf:Description>
<rdf:Description rdf:about="" xmlns:xapMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#">
   <xapMM:DocumentID>uuid:407BCEBAD670E011A7CCFF16F5ECB385</xapMM:DocumentID>
   <xapMM:InstanceID>uuid:7e1f163c-6f1d-42e9-ada7-df067f93f5c2</xapMM:InstanceID>
   <xapMM:DerivedFrom rdf:parseType="Resource">
      <stRef:instanceID>uuid:92A2FF353970E011A7CCFF16F5ECB385</stRef:instanceID>
      <stRef:documentID>uuid:92A2FF353970E011A7CCFF16F5ECB385</stRef:documentID>
   </xapMM:DerivedFrom>
</rdf:Description>
<rdf:Description rdf:about="" xmlns:xap="http://ns.adobe.com/xap/1.0/" xmlns:xapGImg="http://ns.adobe.com/xap/1.0/g/img/">
   <xap:CreateDate>2011-04-27T09:00:38-05:00</xap:CreateDate>
   <xap:ModifyDate>2011-04-27T09:01:39-05:00</xap:ModifyDate>
   <xap:MetadataDate>2011-04-27T09:01:39-05:00</xap:MetadataDate>
   <xap:CreatorTool> Adobe Photoshop CS2 Windows</xap:CreatorTool>
   <xap:Thumbnails>
      <rdf:Alt>
         <rdf:li rdf:parseType="Resource">
            <xapGImg:format>JPEG</xapGImg:format>
            <xapGImg:height>256</xapGImg:height>
            <xapGImg:width>215</xapGImg:width>
            <xapGImg:image>
             ...Deleted...
            </xapGImg:image>
         </rdf:li>
      </rdf:Alt>
   </xap:Thumbnails>
</rdf:Description>
<rdf:Description rdf:about=""  xmlns:tiff="http://ns.adobe.com/tiff/1.0/">
   <tiff:Orientation>1</tiff:Orientation>
   <tiff:XResolution>2000000/10000</tiff:XResolution>
   <tiff:YResolution>2000000/10000</tiff:YResolution>
   <tiff:ResolutionUnit>2</tiff:ResolutionUnit>
   <tiff:NativeDigest>256,257,258,259,262,274,277,284,530,531,282,283,296,301,318,319,529,532,306,270,271,272,305,315,33432;CCABA71D56CC7C0AED63B699FAD11072</tiff:NativeDigest>
</rdf:Description>
<rdf:Description rdf:about="" xmlns:exif="http://ns.adobe.com/exif/1.0/">
   <exif:PixelXDimension>1739</exif:PixelXDimension>
   <exif:PixelYDimension>2071</exif:PixelYDimension>
   <exif:ColorSpace>-1</exif:ColorSpace>
   <exif:NativeDigest>36864,40960,40961,37121,37122,40962,40963,37510,40964,36867,36868,33434,33437,34850,34852,34855,34856,37377,37378,37379,37380,37381,37382,37383,37384,37385,37386,37396,41483,41484,41486,41487,41488,41492,41493,41495,41728,41729,41730,41985,41986,41987,41988,41989,41990,41991,41992,41993,41994,41995,41996,42016,0,2,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,20,22,23,24,25,26,27,28,30;9C9628BCF865807A6FAE92CB93FF1601</exif:NativeDigest>
</rdf:Description>
<rdf:Description rdf:about="" xmlns:pdf="http://ns.adobe.com/pdf/1.3/">
   <pdf:Producer>Adobe Photoshop for Windows -- Image Conversion Plug-in</pdf:Producer>
</rdf:Description>
</rdf:RDF>
</x:xmpmeta>

The ap_obama_certificate_dm.pdf document shows that it was created with Adobe Acrobat 8.26 as the Creator and Adobe Acrobat 8.26 Image Conversion Plug-in as the Producer. The date formats are interesting

  • /CreationDate(D:20110427092848-04’00’)
  • /ModDate       (D:20110427092901-04’00’)

The -04’00 timezone only makes sense as EDT (Eastern Daylight Time)

We have another bluish jpg 20110427_DCSA103_AP.jpg showing the following data, also created on 08:53:21

XMP

Urgency Unknown (5 )
Category A
Date Created 2011:04:27
City Washington
Credit AP
Source AP
XMP Toolkit XMP Core 4.4.0
Country USA
Caption Writer JSA RCL**DC**
Transmission Reference DCSA103
State DC
Instructions HANDOUT IMAGE PROVIDED BY THE WHITE HOUSE
Authors Position STF
ICC Profile Name Adobe RGB (1998)
Color Mode RGB
Instance ID uuid:3A23939F1C32431C 96095F13E79E0361
Modify Date 2011:04:27 15:33:34+02:00
Metadata Date 2011:04:27 15:33:34+02:00
Creator Tool FotoWare ColorFactory
XMP File Stamps 2011:04:27 15:08:02+02:00, 2011:04:27 15:08:02+02:00, 2011:04:27 15:33:35+02:00, 2011:04:27 15:33:35+02:00
Created Time 085321+0000
Unique Id 7A0200BBE279463C BD5166979FEFE0A6
Short Unique Id 3855470820
Content Value 9D99DEE99DD9999EDE
Custom Field 1 AP
Title Obama
Description This handout image provided by the White House shows a copy of the long form of President Barack Obama’s birth certificate from Hawaii. (AP Photo/J. Scott Applewhite)
Creator J. Scott Applewhite

EXIF — this group of metadata is encoded in 10,090 bytes (9.9k)

Compression JPEG (old-style)
X Resolution 72
Y Resolution 72
Thumbnail Length 9,864
Color Space Adobe RGB
Exif Image Size 855 × 1,024
Orientation Horizontal (normal)
Resolution 180 pixels/inch

Photoshop

Displayed Units X inches
Photoshop Resolution 0x0003 2
Displayed Units Y inches
Photoshop Resolution 0x0007 2
IPTC Digest 1e61b1d57ab925460c8a897bf4f6138b
X Resolution 180
Y Resolution 180

IPTC

Application Record Version 2
Object Name Obama
Urgency Unknown (5 )
Category A
Special Instructions HANDOUT IMAGE PROVIDED BY THE WHITE HOUSE
Date Created 2011:04:27
Time Created 08:53:21+00:00
Originating Program FotoWare ColorFactory
By-line J. Scott Applewhite
By-line Title STF
City Washington
Province-State DC
Country-Primary Location Name USA
Original Transmission Reference DCSA103
Credit AP
Source AP
Caption-Abstract This handout image provided by the White House shows a copy of the long form of President Barack Obama’s birth certificate from Hawaii. (AP Photo/J. Scott Applewhite)
Writer-Editor JSA RCL**DC**
IPTC Application Record 183 CP_1252
Short Document ID 3855470820
Unique Document ID 7A0200BBE279463C BD5166979FEFE0A6
Object Preview File Format Unknown (16720)
Similarity Index 9D99DEE99DD9999EDE

JFIF

JFIF Version 1.01
Resolution 180 pixels/inch

File — basic information derived from the file.

File Type JPEG
MIME Type image/jpeg
Exif Byte Order Little-endian (Intel, II)
Current IPTC Digest 1e61b1d57ab925460c8a897bf4f6138b
Comment AppleMark
Encoding Process Baseline DCT, Huffman coding
Bits Per Sample 8
Color Components 3
File Size 185 kB
Image Size 855 × 1,024
Y Cb Cr Sub Sampling YCbCr4:2:0 (2 2)

Composite
This block of data is computed based upon other items. Some of it may be wildly incorrect, especially if the image has been resized.

Date/Time Created 2011:04:27 08:53:21+00:00
Date/Time Original 2011:04:27 08:53:21+00:00
Thumbnail Image (9,864 bytes binary data)

ICC_Profile — this block of data describes the color space used to encode pixel colors.

Profile CMM Type ADBE
Profile Version 2.1.0
Profile Class Display Device Profile
Color Space Data RGB
Profile Connection Space XYZ
Profile Date Time 2000:08:11 19:51:59
Profile File Signature acsp
Primary Platform Apple Computer Inc.
CMM Flags Not Embedded, Independent
Device Manufacturer none
Device Model
Device Attributes Reflective, Glossy, Positive, Color
Rendering Intent Perceptual
Connection Space Illuminant 0.9642 1 0.82491
Profile Creator ADBE
Profile ID 0
Profile Copyright Copyright 2000 Adobe Systems Incorporated
Profile Description Adobe RGB (1998)
Media White Point 0.95045 1 1.08905
Media Black Point 0 0 0
Red Tone Reproduction Curve (14 bytes binary data)
Green Tone Reproduction Curve (14 bytes binary data)
Blue Tone Reproduction Curve (14 bytes binary data)
Red Matrix Column 0.60974 0.31111 0.01947
Green Matrix Column 0.20528 0.62567 0.06087
Blue Matrix Column 0.14919 0.06322 0.74457

Now back to the workflow

20 thoughts on “Following the Applewhite document

  1. NBC

    ““There is something weird, the PDF is 5.9 Mb, the jpeg 294 Kb…””

    You’re right something is weird alright.

    Let’s take it by the numbers.

    1. At 09:00:38 Scott Applewhite created the Muscatine Journal PDF by scanning an paper original of unknown source. Most likely the PDF file was created by a direct scan to Photoshop CS2. Alternatively the scan first created a TIFF file which was then opened in Photoshop and the saved as a Photoshop PDF file.

    See: http://muscatinejournal.com/pdf_6a633f26-70d9-11e0-8729-001cc4c002e0.html

    The METADATA indicates that two images were created.

    1. A JPEG thumbnail embedded as an xmpGImg:image within the METADATA.
    This image was 256 x 215 pixels.

    You totally missed this thumbnail Dude. Doesn’t your MAC OS open Photoshop thumbnails on your Explorer page (or what ever you call Explorer on a MAC OS — probably Kitty or something like that). Maybe you should take a quick peek at the PDF METADATA before you start ripping it up with your freetoy JPEG extractor.

    2. A TIFF image which was embedded into Photoshop and subsequently saved as a Photoshop PDF. This image was 1739 x 2071 pixels with a pixel resolution of 200 PPI x 200 PPI.

    The file-size of the Muscatine Journal Photoshop PDF file is 1046 Kb.

    This image shows no bleedthrough along the bottom edge of the page.

    We also know that it was created on a digital scanner because the image exhibits color fringes. If Applewhite had used a camera and microcopy stand then the image would not exhibit color fringes.

    —————————-

    The so called AP PDF that Applewhite created at 9:28:48 AM has the pale Blue background and the bleedthrough of the Obama short-form COLB along the bottom edge of the page.

    This is the one that NBC is pulling his eye teeth over. I really don’t know why NBC is extracting JPEGS from a PDF which has it’s own METADATA. As I stated previously, all of the extraction tools that I use ask the user what format to use for the extracted file. What do you want to bet that NBC’s extraction tool can only do JPEGS ?

    The point is that copies of the AP Blue background are a dime a dozen on the internet. And since it was the second PDF copy that Scott Applewhite scanned on 04/27/2011 and it was from one of the press corp handouts I could care less.

    And then there is the PDF METADATA from the Blue Copy:

    Created: 4/27/2011, 9:28:48 AM
    Modified $/27/2011, 9:29:01 AM
    File Size 1,071,451 bytes.

    That is 28 minutes after Applewhite scanned the Muscatine PDF.

    ——————————

    But that Muscatine PDF is a one-of-a-kind in so many ways. And we don’t know where Applewhite got his original GrayScale White background paper copy to scan.

  2. Our poor Hermitian still cannot apply proper logic.

    Hermitian: 1. At 09:00:38 Scott Applewhite created the Muscatine Journal PDF by scanning an paper original of unknown source. Most likely the PDF file was created by a direct scan to Photoshop CS2. Alternatively the scan first created a TIFF file which was then opened in Photoshop and the saved as a Photoshop PDF file.

    Why would Applewhite be creating PDF’s for the Muscatine Journal? The Journal, like so many other sites, subscribes to AP feeds and they took the image, imported it into the PDF, cropped it and removed the bluish hue. Remember also that the 09:00:38

    A much simpler workflow which is supported by the -06:00 time zone offset, pointing to Iowa, indicates that the PDF was created in the Central Time Zone.

    We also know that it was created on a digital scanner because the image exhibits color fringes. If Applewhite had used a camera and microcopy stand then the image would not exhibit color fringes.

    While Hermitian provides no evidence of color fringes, the fringes come from the attempt to correct the bluish tint. He should look at the image that was created by Applewhite on 08:53 or so and which I provided to him. The image used by the Muscatine journal is the same image just cropped and with color levels adjusted.

    And then there is the PDF METADATA from the Blue Copy:

    Created: 4/27/2011, 9:28:48 AM
    Modified $/27/2011, 9:29:01 AM
    File Size 1,071,451 bytes.

    That is 28 minutes after Applewhite scanned the Muscatine PDF.

    The Muscatine Journal used the picture taken by Applewhite on 08:53 which was embedded in the Muscatine PDF at 9:00AM Central Time or 10 O’Clock Eastern time 32 minutes after the blue copy PDF had been created. Did you miss the -06:00 in the time?

    But that Muscatine PDF is a one-of-a-kind in so many ways. And we don’t know where Applewhite got his original GrayScale White background paper copy to scan.

    Common sense suggests that Scott Applewhite attended the press briefing, received a grayscale copy and took a photograph which he sent to the AP offices. The Muscatine PDF hardly can be considered a ‘one of a kind’ in any meaningful manner. It clearly contains all the hints that it was created from the DCSA103 image that was created on 08:53 Eastern Time…

    Your research has become sloppier and sloppier. You no longer post relevant time tags, you ignore common sense and reasoning when again a simple workflow explains it all…

  3. NBC


    Hermitian: 1. At 09:00:38 Scott Applewhite created the Muscatine Journal PDF by scanning an paper original of unknown source. Most likely the PDF file was created by a direct scan to Photoshop CS2. Alternatively the scan first created a TIFF file which was then opened in Photoshop and the saved as a Photoshop PDF file.

    Why would Applewhite be creating PDF’s for the Muscatine Journal? The Journal, like so many other sites, subscribes to AP feeds and they took the image, imported it into the PDF, cropped it and removed the bluish hue. Remember also that the 09:00:38

    A much simpler workflow which is supported by the -06:00 time zone offset, pointing to Iowa, indicates that the PDF was created in the Central Time Zone.

    Here’s the PDF METADATA:

    [rdf:Description rdf:about=””
    xmlns:photoshop=”http://ns.adobe.com/photoshop/1.0/”
    xmlns:dc=”http://purl.org/dc/elements/1.1/”
    xmlns:xmpMM=”http://ns.adobe.com/xap/1.0/mm/”
    xmlns:stRef=Tittp://ns.adobe.com/xap/1.0/sType/ResourceRef#”
    xmlns:xmp=”http://ns.adobe.com/xap/1.0/”
    xmlns:xmpGImg=Tittp://ns.adobe.com/xap/1.0/g/img/”
    xmlns:pdf=”http://ns.adobe.com/pdf/1.3/”
    xmlns:pdfx=”http://ns.adobe.com/pdfx/1.3/”
    xmlns:tiff=”http://ns.adobe.com/tiff/1.0/”
    xmlns:exif=”http://ns.adobe.com/exif/1.0/”
    xmlns:xmpRights=”http://ns.adobe.com/xap/1.0/rights/”>
    [photoshop:Source>APUSAAP
    [photoshop:City>WashingtonJSA RCL**DC**2011-04-27DCSA103DC5HANDOUT IMAGE PROVIDED BY THE WHITE
    HOUSEASTF3QCT RGB settingsapplication/pdfObamaJ. Scott Applewhite2011-04-27T09:00:38-05:002013-06-20T15:47:57-04:002011-04-27T09:01:39-05:00 Adobe Photoshop CS2 Windows JPEG 256215 1 2000000/100002000000/100002256,257,258,259,262,274,277,284,530,531,282,2^^^
    [exif: PixelXDimension > 17392071-1 36864,40960,40961,37121,37122,40962,40963,37510,40964,36867,36
    868,33434,33437,34850,3485
    [pdf: Producer >Adobe Photoshop for Windows — Image Conversion Plug-in
    [/pdf: Producer ]
    [pdfx:PXCViewerInfo>PDF-XChange Viewer;2.5.210.0;Feb 25
    2013;15:35:42;D:20130620154757-04’00′</pdfx:PXCViewer
    [/rdf: Description ]
    [/rdf:RDF]
    [/x:xmpmeta]

    —————————-

    Notice that the GMT offset is -5:00 NOT -6:00. Maybe you could explain how, under your scenario, your imaginary JPEG was created one hour after it was embedded into the Photoshop PDF ? You just put Applewhite one time zone further West than Muscatine Iowa when he scanned an original paper copy to your imaginary JPEG.

    And then maybe you should acknowledge that the original scanned bitmap image was TIFF and not JPEG.

  4. P.S.

    My METADATA entry was a work of art until your comment editor chewed it up again.

    Your site is still reporting unsecure data. No telling what your comment window is putting on your site.

    You should alert WordPress and tell them that the template under the WordPress theme that your site is using has bugs.

    I don’t have access to the unsecure data that is polluting your site.

  5. NBC

    Here’s the METADATA for the JPEG and the TIFF:

    [/xmpMM: DerivedFrom ]
    [xmp:CreateDate>2011-04-27T09:00:38-05:002013-06-20T15:47:57-04:002011-04-27T09:01:39-05:00 Adobe Photoshop CS2 Windows JPEG 256215 1 2000000/100002000000/100002256,257,258,259,262,274,277,284,530,531,282,2^^^
    [exif: PixelXDimension > 17392071-1 36864,40960,40961,37121,37122,40962,40963,37510,40964,36867,36868,33434,33437,34850,3485
    [pdf: Producer >Adobe Photoshop for Windows — Image Conversion Plug-in [/pdf: Producer ]
    [pdfx:PXCViewerInfo>PDF-XChange Viewer;2.5.210.0;Feb 25 2013;15:35:42;D:20130620154757-04’00′</pdfx:PXCViewer
    [/rdf: Description ]
    [/rdf:RDF]
    [/x:xmpmeta]

    Just to test your methodology, I extracted a JPEG from the PDF file. Now the original bitmap was a TIFF.

    The first line of the JPEG contains the label JFIF and the word Ducky is in Line 2. I hardly think that the label JFIF would be found in the TIFF. Consequently, the file extraction step created that label.

    The bottom line is that if you don't know the original format of the bitmap then JPEG extraction can add JPEG related labels. Maybe even your smoking gun "YCbCr".

  6. NBC

    P.S.

    This time I entered 32 lines of METADATA and 13 mangled lines survived in my post.

    Have you checked with the NSA yet ?

  7. NBC

    Looks like your WordPress Theme is “Mystique”.

    Appropriately named for sure…

  8. Then again operator error is a distinct possibility. Might I suggest that the inequality symbols could be a problem since they are used for HTML commands and the comment editor is stripping out what appears to be non-allowed HTML commands. Word has a nifty feature called “replace” that might be of use.

  9. The bottom line is that if you don’t know the original format of the bitmap then JPEG extraction can add JPEG related labels. Maybe even your smoking gun “YCbCr”.

    Of course it can, but I have a much simpler explanation. A simple workflow…

  10. RC

    “Then again operator error is a distinct possibility. Might I suggest that the inequality symbols could be a problem since they are used for HTML commands and the comment editor is stripping out what appears to be non-allowed HTML commands. Word has a nifty feature called “replace” that might be of use.”

    Nope !

    1. NBC posted lots of METADATA with inequalities on this same page with no problem. I have tried 1 inequality then 1 dash and then 3 inequalities with no luck.

    2 The last two METADATA lists that I posted above, I had replaced all the leading and trailing inequalities with square brackets and the comment editor still chewed them up.

    You Figure…

  11. Hermitian: Looks like your WordPress Theme is “Mystique”.

    Appropriately named for sure…

    Had not noticed…Yeah..

  12. I tried a test comment on my WordPress.com blog and the comment editor strips out anything inside the inequality brackets. I am using a different theme. There is a way to do it. Let’s see if it works here:

    Test

  13. Notice that the GMT offset is -5:00 NOT -6:00. Maybe you could explain how, under your scenario, your imaginary JPEG was created one hour after it was embedded into the Photoshop PDF ? You just put Applewhite one time zone further West than Muscatine Iowa when he scanned an original paper copy to your imaginary JPEG.

    There are two sets of conflicting metadata in the PDF
    The Created and Modified Time in the Info block in the trailer and the modification times of the Page.

    I wish I had CS2 and the plugin so that I could do some experiments here. Furthermore, while the Muscatine Journal appears to be using CS2, I find it unlikely that AP would still use such software. So there is no logical reason to believe that the author of the Muscatine PDF was Applewhite. The only logical explanation is that the plugin transferred some of the metadata contained in the original photograph from the AP. We already know that this is based on the DCSA103 JPEG as it matches all the metadata. We also know, that this document was created on 08:53AM local DC time. Tracking all this metadata takes some time and careful analysis especially since we do not know all the tools involved in the workflow. For instance, to give you a taste

    The following TIFF data was found in an online site’s AP photograph

    TIFF
    Artist: J. Scott Applewhite
    Date Time: Apr 27, 2011 11:06:17 AM
    Image Description: This handout image provided by the White House shows a copy of the long form of President Barack Obama’s birth certificate from Hawaii. (AP Photo/J. Scott Applewhite)
    Orientation: 1 (Normal)
    Resolution Unit: inches
    Software: Adobe Photoshop Elements 8.0 Macintosh
    X Resolution: 300
    Y Resolution: 300

    and

    TIFF
    Artist: J. Scott Applewhite
    Date Time: Apr 27, 2011 3:33:34 PM
    Image Description: This handout image provided by the White House shows a copy of the long form of President Barack Obama’s birth certificate from Hawaii. (AP Photo/J. Scott Applewhite)
    Orientation: 1 (Normal)
    Resolution Unit: inches
    Software: FotoWare ColorFactory
    X Resolution: 180
    Y Resolution: 180

    Fotoware ColorFactory is an expensive workflow tool
    There is also an IPTC tag referring to APTOPIX

    Some careful analysis is necessary, or otherwise, one would be all over the place with one’s arguments. There are so many variables here that one may easily come to the conclusion that all these were created by Scott Applewhite…

  14. I also noticed that when I cut and paste from a hex editor, the text may end up garbled as well because of problems with non-displayable characters. You need to clean up.

    When I create posting WordPress provides me with a WYSIWYG editor as well as a pure HTML editor.

    I tend to switch back and forth to get the layout I want.

    Comments however do not support this functionality, it’s all HTML tags.

  15. Hermitian: 2 The last two METADATA lists that I posted above, I had replaced all the leading and trailing inequalities with square brackets and the comment editor still chewed them up

    It must not like you🙂 Or more likely, the format you are using still contains characters that confuse the editor which will strip a lot of stuff to make sure it does not interfere with the rest of the page.

    I have struggled occasionally with the same problem when responding to comments. You really need to make sure that there is no garbage in the data. In one occasion, I was cut and pasting zero bytes between every character (Unicode/UTF8) and WordPress ate all but the first character.

  16. The bottom line is that if you don’t know the original format of the bitmap then JPEG extraction can add JPEG related labels. Maybe even your smoking gun “YCbCr”.

    You now understand why some careful analysis is necessary…
    Metadata can be added quite unexpectedly, creating the impression that something or someone else created the document.

    The real important issue is that Adobe Software uses JFIF format and XMP, and not JPEG Comments which are an old standard…

    Since I have shown how Xerox Workcenters do add the information, my workflow again beats anything you have proposed.

  17. NBC | July 30, 2013 at 17:10

    “”The bottom line is that if you don’t know the original format of the bitmap then JPEG extraction can add JPEG related labels. Maybe even your smoking gun “YCbCr”””.

    “Of course it can, but I have a much simpler explanation. A simple workflow…”

    If you are so enamored with workflows then one would think that you could at least get the workflow for the Muscatine PDF 4db82608b486f.pdf correct. The PDF METADATA clearly indicate that the bitmap was a TIFF rather than a JPEG. I have extracted the TIFF from the PDF and there is no JFIF or YCbCr labels. The TIFF is actually rather unremarkable.

    As for your proposed “simple” workflow for your Xerox/Preview combo— you have posted many different workflows with different actions for the Xerox and Preview operators.

    You can’t explain the zero-rotation six vectors and the missing clipping elements in the Xerox scan to file PDF. Your Forger produces only two levels in the layer tree rather than three.

    And you still haven’t posted any Preview PDFs.

  18. If you are so enamored with workflows then one would think that you could at least get the workflow for the Muscatine PDF 4db82608b486f.pdf correct. The PDF METADATA clearly indicate that the bitmap was a TIFF rather than a JPEG. I have extracted the TIFF from the PDF and there is no JFIF or YCbCr labels. The TIFF is actually rather unremarkable.

    Fascinating how Hermitian ignores that I have a simpler workflow for the WH LFBC PDF… Still in denial. As to the Muscating workflow, I checked the PDF in question for embedded images. No TIFF found. Now perhaps you can export anything you want as a TIFF from your high level tools, but the evidence needs to be supported by the raw PDF which shows

    The JPEG file itself is quite interesting..

    width 1043, height 1243 components 3
    width 43362, height 30870 components 242
    width 38369, height 55377 components 243
    width 7931, height 13675 components 217
    width 59281, height 1033 components 238
    width 11481, height 57154 components 255
    width 47268, height 25466 components 113

    Never boring moment. This is why we get a negative compression…

    Note: JPEG-based compression (TIFF compression scheme 7) uses the DCT (Discrete Cosine Transform) introduced in 1974 by N. Ahmed, T.Natarajan and K.R. Rao; see Reference 1 in Discrete cosine transform. For more details see Adobe document.

    So we have a TIFF file saved as a JPEG… Very interesting… But the quality of the resulting file is not very impressive, or am I missing something… So did they use the image converter plugin to import a jpeg into TIFF format and then save it as compressed TIFF, aka JPEG?

    The embedded file is still a JPEG but I can see why Adobe Tools can happily move between them. I looked at a side by side comparison of the two files as JPEGs and the Muscatine does not appear to have any higher resolution, just a much higher size…

    This is fun stuff But I have not yet seen that the input file was TIFF.

    1,243 × 1,043 JPEG (1.3 megapixels)
    5,888,578 bytes (5.6 megabytes) Image compression: -51%

    So what do we have here?… Can one embed TIFF in a DCTDecode stream?

    As for your proposed “simple” workflow for your Xerox/Preview combo— you have posted many different workflows with different actions for the Xerox and Preview operators.

    In my response to you I have clearly outlined the workflow which I believe best fits the data so far.

    You can’t explain the zero-rotation six vectors and the missing clipping elements in the Xerox scan to file PDF. Your Forger produces only two levels in the layer tree rather than three.

    Nope, you are looking at the Xerox file not the Preview created file.

    And you still haven’t posted any Preview PDFs.

    So how can you make the claim that I can’t explain when I can… Still unable to convert the PDF to preview I notice… No worries, eventually you will figure it out.

  19. I did a side by side comparison and the AP jpeg is of higher quality than the larger Muscatine JPEG/TIFF. Perhaps Hermitian can share the tiff with us?

Comments are closed.