Image Analysis Report 1000-01


Case No. 1000-01

Conducted by: The Grave Hunters Society, LLC

Presented to: The Public

Researcher: Jonathan Batteas

Revision History

Date Revision History Comments
2014/26/10 0.01 Draft of Background Information
2020/06/03 0.1 First Report Draft
2020/06/24 1.0 Final Report

Current Version: 1.0

Confidential Information This report shall not be excerpted without prior written permission of The Grave Hunters Society, LLC

Table of Contents

Executive Summary

part 1.1

On October 25, 2014, Andrea Batteas captured an image that contains an unidentifiable mass. This report was written to preempt claims of digital manipulation, and as a continuation of original EXIF data and Error Level Analysis that was undertaken initially on October 26, 2014. This report is not meant to offer any explanation of what is visible within the photograph, only whether digital artifacts exist that might indicate any kind of digital manipulation.


part 2.1

Originally recorded on October 26, 2014, by Jonathan Batteas.

Andrea and Jonathan Batteas went on the Ghosts and Goblets Quaker Hill Tour in Waynesville on Oct. 25, 2014. The tour ended around nine or 9:30, and they went back to the Museum in the Friends Home for a while, conversing with Linda and Mary at length.

Afterward, they went to the McDonalds on Main St. and had some ice cream. Later, they decided to walk to 237 S. Main St. to take pictures. The time was approximately 10:30. (The last photo at the museum has a timestamp of 10:08:05 from Andrea’s iPhone. Then, the next correct timestamp is 10:45:10 from Jonathan’s iPhone. So, this picture was taken sometime between 10:08 and 10:45.


part 3.1

To present evidence to determine whether any digital manipulation of the image in question has taken place. The purpose of this report is not to offer an explanation, nor to determine what is pictured, only that the photograph itself is genuine.

Evidence Analyzed

part 4.1

The jpeg image extracted from the camera media titled DSCF0096.JPG (renamed to DSCF0096.jpg for file format recognition by Sherloq.) on October 25, 2014, which was immediately compressed in a zip format titled Oct 25 2014.zipalong with the rest of that evening’s photographs by myself (Jonathan Batteas). This zip file was kept in sync between multiple machines via Dropbox and Resilio Sync. Any analysis done on the image was performed on copies, verified by MD5 or SHA512 hash comparison.


Image Identification

Filename DSCF0096.jpg
Size 1.2 MB
MD5 5af3897622be5bb259354c38518b0141
SHA512 02bcf7c1b2354f943c61899c528370b314d49a92efa79f01b1d37b7359946faeaba3d251d4a0f4dd91e4ef62e35b94416d12b496d436b1484943475004ee3c58

Image Classifications

A nighttime photograph, illuminated by a flash, containing an angled view of the facade of the building located at 237 S. Main St., Waynesville, OH. The front steps are visible. A gaseous shape of unknown substance and origin is located near the roof of the named building in the upper-left of the image. In the lower-right of the image foreground, a bush of purple flowers is visible. There is a white, diagonal shape in the extreme foreground along the right side of the image, making the edges of the image appear as if they are not square.

part 4.2

Secondary evidence exists in the form of contemporaneous photographs taken with an iPhone. These photographs are not considered in this report and will be the subject of their statement.


part 5.1


Date Time Process Result Comments
2020/04/19 18:51 Ghiro Automated Digital Image Forensics Report Automated report attached
2020/06/12 15:29 Check Quantization Table Matrix Against Known Table Database Report Comparing the quantization table of the image against a database of tables which contains known tables from: The Dresden Digital Image Set, The VISION Digital Image Set, The HDR Digital Image Set, Independent Jpeg Group Standard Tables, and Photoshop Tables.
2020/06/12 15:29 Check Quantization Table Matrix Against Quantization Table Database from the Same Device Report Since this camera is owned and operated by us, we have a backlog of 3268 photos against which we can run a quantization table comparison.
2020/06/13 12:30 Error Level Analysis using Sherloq Report Look for bright, white areas, or purple-red patterns around edges. These indicate a higher potential error level. The overall color should be consistent across the image.
2020/06/13 12:50 Principal Component Analysis Decomposition using Sherloq Report Examine first, second, and third principal components looking for mosaic artifacts, or differences in quality among areas of photograph.
2020/06/13 12:22 Luminance Gradient using Sherloq Report Look for consistent bumps representing noise, or at higher levels, consistent jagged lines. Flat areas and straight lines could indicate manipulation. Also, pay attention to the light direction and distribution to see that they are consistent.
2020/06/24 22:40 Echo Edge Filter using Sherloq Report Look for edges where there should be none, and artificial blurring.
2020/06/13 12:34 Noise Estimation using Sherloq Report Look for any pattern at all. Noise should appear consistent and have no underlying shape to indicate that noise was artificially added.


part 6.1

It is my expert opinion that based upon the evidence available in and around the image, that this image is in its original state as created by the camera, and has not undergone any secondary, digital manipulation.

part 6.2

The points supporting the above conclusion:


part 7.1

Printed Name Signature Date
Jonathan Batteas Signature 2020/06/12


part 8.1

Exhibit A – Chain of Custody

Chain of Custody

part 8.2

Exhibit B – Reference

Name Link
Using JPEG Quantization Tables to Identify Imagery Processed by Software
VISION: a video and image dataset for source identification
A Picture’s Worth: Digital Image Analysis and Forensics
Digital Image Ballistics from JPEG Quantization
Body by Victoria