Reality Check – We accept your challenge Mr Zullo

Reality check has challenged Mr Zullo

What will Zullo do? He can chose to show how a ‘criminal investigation’ deals with information that contradicts its findings, or he can ignore it.

Either way, Zullo is faced with quite an unfortunate situation of his own creation.

Continue reading

PDF Images

I never really gave it much thought but my recent research into the images supported by Xerox WorkCentres caused me to ponder the issue of DCTDecode. DCTDecode is used to encode an image using the JPEG compression, and is also a fully functional JPEG image, however, in PDF, one should consider the object as a TIFF bitmap, encoded using JPEG compression. I recently noticed the relevance of the notation in the Xerox 7655 specification:

It helps understand why JFIF is not a required format, as the PDF format itself contains the information that would typically be encoded in the APP14 tag.

A minor mystery laid to rest. Also note that the YCbCr tag is obviously inserted by some older software to help with managing the JPEG encoding, as JPEG itself failed to provide for ways to indicate the colorspace used. While PDF resolved this by encoding this in the PDF data   (/ColorSpace tag), JFIF was proposed to extend the original JPEG standard.

Now it makes all much better sense as the relevance of DCTDecode objects, which are JPEG encoded data streams used to encode a TIFF image.

The YCbCr comment tag is likely added to inform the PDF generator as to the nature of the DCTDecode object. It all starts to make sense

This also makes sense, realizing that Xerox uses the same DCTDecode object to encode LinearGray images which is a color space not supported by JPEG.

Wherever the data takes us…

A challenge for Hermitian

Hermitian: Did anybody else notice that the purported Xerox added comment YCbCr happens to be placed at the exact end of a string that gets tons of Google hits all over the internet ?

Can Hermitian explain this, because the explanation is quite trivial

So why does the following string


Or Hex

0x24 0x34 0xE1 0x25 0xF1 0x17 0x18 0x19 0x1A 0x26 0x27 0x28 0x29 0x2A 0x35 0x36
0x37 0x38 0x39 0x3A 0x43 0x44 0x45 0x46 0x47 0x48 0x49 0x4A 0x53 0x54 0x55 0x56 
0x57 0x58 0x59 0x5A 0x63 0x64 0x65 0x66 0x67 0x68 0x69 0x6A 0x73 0x74 0x75 0x76 
0x77 0x78 0x79 0x7A 0x82 0x83 0x84 0x85 0x86 0x87 0x88 0x89 0x8A 0x92 0x93 0x94 
0x95 0x96 0x97 0x98 0x99 0x9A 0xA2 0xA3 0xA4 0xA5 0xA6 0xA7 0xA8 0xA9 0xAA 0xB2 
0xB3 0xB4 0xB5 0xB6 0xB7 0xB8 0xB9 0xBA 0xC2 0xC3 0xC4 0xC5 0xC6 0xC7 0xC8 0xC9 
0xCA 0xD2 0xD3 0xD4 0xD5 0xD6 0xD7 0xD8 0xD9 0xDA 0xE2 0xE3 0xE4 0xE5 0xE6 0xE7 
0xE8 0xE9 0xEA 0xF2 0xF3 0xF4 0xF5 0xF6 0xF7 0xF8 0xF9 0xFA

Show up in Google so often

This is going to be a fun test of Hermitian’s skills. Come on Hermitian, I have full confidence in you.

PS: I found another YCbCr match with the above string. Venture to guess what created the PDF?

A 7345… Xerox WorkCentre. Thank you so much Hermitian… I told you, that you were going to help me prove my thesis.


I am tracking a score sheet for features explained versus objections raised.

Confirmation Documents

August 28 A sad day as I have decided to no longer allow Hermitian to submit comments on this blog as he has now, several times accused me of behavior for which he has no evidence (hinting that I may be the forger, work for Obama, that I withhold data or manipulate data and other non sequiturs). I feel saddened because, despite his short comings, he did serve a useful purpose. I wish him well and will continue to address issues he raises, to help him understand better why the Xerox workflow stands unassailed. Thank you Hermitian for your efforts to debunk the work flow, helping further strengthen it.

Continue reading

Butterdezillion – Some good questions

From the FreeRepublic we receive some good feedback from a poster named Butterdezilion.

Butterdezilion: If the Xerox machine is substituting exact replicas every time a certain “blob” (such as a box) appears, then that should happen with every box, every letter, etc. If the Xerox is switching 6’s for 8’s then where are those numbers switched around in the White House PDF?

A good question but as I have shown and found out, the Mixed Raster Compression is all but exact as it appears to be extremely sensitive to small variations. I have seen examples with anywhere from 4 to 17 foreground images. The same for JBIG2, it is based on how similar the two blobs, such as a box are, and in the samples I have, I have found JBIG2 to fail to capture the boxes, but it does capture other letters.

Continue reading