Case No. 1000-01

Conducted by: The Grave Hunters Society, LLC

Presented to: The Public

Researcher: Jonathan Batteas

Revision History

Current Version: 1.0

Confidential Information This report shall not be excerpted without prior written permission of The Grave Hunters Society, LLC

Table of Contents

• Executive Summary

  • part 1.1 - Summary of reasons for report

• Background

  • part 2.1 - In-depth background surrounding the creation of the evidence

• Objectives

  • part 3.1 - Specifics about purpose of report

• Evidence Analyzed

  • part 4.1 - Primary evidence including descriptions and classifications

  • part 4.2 - Secondary evidence including descriptions and classifications

• Methodology

  • part 5.1 - Tests performed and tools used

• Conclusions

  • part 6.1 - Conclusion statement

  • part 6.2 - Conclusion evidence

• Signature

  • part 7.1 - Researcher Signature

• Exhibits

  • part 8.1

    • Exhibit A - Chain of Custody

  • part 8.2

    • Exhibit B - Reference table for further explanation of tools and methods

Executive Summary

part 1.1

On October 25, 2014, Andrea Batteas captured an image that contains an unidentifiable mass. This report was written to preempt claims of digital manipulation, and as a continuation of original EXIF data and Error Level Analysis that was undertaken initially on October 26, 2014. This report is not meant to offer any explanation of what is visible within the photograph, only whether digital artifacts exist that might indicate any kind of digital manipulation.

Background

part 2.1

Originally recorded on October 26, 2014, by Jonathan Batteas.

Andrea and Jonathan Batteas went on the Ghosts and Goblets Quaker Hill Tour in Waynesville on Oct. 25, 2014. The tour ended around nine or 9:30, and they went back to the Museum in the Friends Home for a while, conversing with Linda and Mary at length.

Afterward, they went to the McDonalds on Main St. and had some ice cream. Later, they decided to walk to 237 S. Main St. to take pictures. The time was approximately 10:30. (The last photo at the museum has a timestamp of 10:08:05 from Andrea’s iPhone. Then, the next correct timestamp is 10:45:10 from Jonathan's iPhone. So, this picture was taken sometime between 10:08 and 10:45.

Objectives

part 3.1

To present evidence to determine whether any digital manipulation of the image in question has taken place. The purpose of this report is not to offer an explanation, nor to determine what is pictured, only that the photograph itself is genuine.

Evidence Analyzed

part 4.1

The jpeg image extracted from the camera media titled DSCF0096.JPG (renamed to DSCF0096.jpg for file format recognition by Sherloq.) on October 25, 2014, which was immediately compressed in a zip format titled Oct 25 2014.zipalong with the rest of that evening's photographs by myself (Jonathan Batteas). This zip file was kept in sync between multiple machines via Dropbox and Resilio Sync. Any analysis done on the image was performed on copies, verified by MD5 or SHA512 hash comparison.

Image Identification

Image Classifications

A nighttime photograph, illuminated by a flash, containing an angled view of the facade of the building located at 237 S. Main St., Waynesville, OH. The front steps are visible. A gaseous shape of unknown substance and origin is located near the roof of the named building in the upper-left of the image. In the lower-right of the image foreground, a bush of purple flowers is visible. There is a white, diagonal shape in the extreme foreground along the right side of the image, making the edges of the image appear as if they are not square.

part 4.2

Secondary evidence exists in the form of contemporaneous photographs taken with an iPhone. These photographs are not considered in this report and will be the subject of their statement.

Methodology

part 5.1

Timeline

Conclusions

part 6.1

It is my expert opinion that based upon the evidence available in and around the image, that this image is in its original state as created by the camera, and has not undergone any secondary, digital manipulation.

part 6.2

The points supporting the above conclusion:

• EXIF information is consistent with the model of camera and indicates no software manipulation

• Quantization Table analysis matched no well-known software packages including Photoshop and IJG Standard tables

• Quantization Table did match tables from other images produced by the same camera

• Error Level Analysis shows a consistent level of compression throughout the image

• Principal Component Analysis shows very high consistency throughout the image

• The luminance gradient shows consistent lighting and no smooth areas. The edges of the buildings are very sharp, as expected in a photo brightly illuminated from a single direction (like a flash)

• Edge Filter shows no hard edges where they shouldn't be

• Noise Estimation does show some blocking. However, this seems to be highlighted not by one area, but throughout the entire photo, based on very little noise being applied to the very hard edges of objects. Because of the consistency of noise away from edges, this could be indicative of the way the camera compressed the image

Signature

part 7.1

Exhibits

part 8.1

Exhibit A – Chain of Custody

Chain of Custody

part 8.2

Exhibit B – Reference