where-was-this-taken

Where was this taken

Input: an image or video file, or a URL to one. Output: a location with a confidence radius, a time window, an authenticity assessment, and the evidence chain for each.

This workflow orchestrates. The technique detail lives in secrets-in-file-metadata, find-the-original-image, geolocate-from-pixels and is-this-photo-real — run those, don't reimplement them here.

The order matters more than anything else in this file. Metadata before analysis, because analysis destroys metadata. Provenance before geolocation, because the original's caption often is the location. Authenticity checks before you commit, because geolocating a composite gives you a confident answer to the wrong question.

Step 1 — Authorized scope

Read ../../ETHICS.md. Then state, in writing, before you open the file:

• Subject — what the media is, and who appears in or is affected by it.
• Objective — verification, disinformation research, missing persons, threat assessment, due diligence, litigation support, or showing someone their own exposure. If you cannot name a legitimate objective, stop.
• In and out of bounds — specifically: are you permitted to publish a precise coordinate, or only a region? Is face search permitted? Is anyone in the frame a private individual?
• Jurisdiction — yours, the subject's, and the platform's. Precise historical location data about an identifiable person is regulated personal data in most of them.
• Publication floor — decide now what precision you will publish, before you know the answer. Geolocating a private individual's home from their own photos is the mechanic of stalking regardless of your intent, and conflict imagery can make the people in frame a target. Rounding a coordinate is a decision to make cold.

Done when subject, objective, bounds, jurisdiction and publication floor are written down in the case file.

Step 2 — Secure a pristine copy

Everything downstream is worthless if you contaminate the original.

• Work from the file, not a screenshot of it. For platform video, pull the best rendition with yt-dlp and keep the sidecar JSON.
• Hash it immediately and record the hash: sha256sum evidence.jpg. A second algorithm costs nothing and pre-empts an argument.
• Set the original read-only, store it unmodified, and do all work on copies. Name derivatives so the transform is legible: evidence_crop-sign.png, evidence_flop.jpg.
• Record provenance of your own acquisition: the URL, the timestamp you fetched it, who gave it to you, and the platform it came from. Archive the source page before it changes.
• Note whether the file is an original capture, a platform re-encode, or a screenshot. This single fact determines which later tests are valid at all, and you will need it in the report.

Done when the original is hashed, read-only, and its acquisition path recorded, and every subsequent step is operating on a named copy.

Step 3 — Metadata

Run secrets-in-file-metadata before any transformation. Cropping, rotating, upscaling or even opening the file in some editors rewrites tags.

Prioritise: GPS coordinates and GPSHPositioningError; GPSImgDirection, which gives you the camera's bearing and lets you reproduce the exact view; GPSDateStamp/GPSTimeStamp in UTC as the only timezone-anchored clock; the timestamp triplet; device make, model and serial; the software chain; and the embedded thumbnail for comparison against the main image.

If GPS is present you have a lead, not an answer. It is a writable field. Continue to step 5 and verify it visually; a metadata coordinate that a visual check confirms is a far stronger finding than either alone.

Done when metadata is extracted and recorded, or confirmed absent — and you have written "no EXIF present" rather than "EXIF removed".

Step 4 — Provenance

Run find-the-original-image. For video, extract keyframes first and search several of them.

You are looking for an earlier appearance, a different caption, a photographer credit, and a date you can corroborate independently through read-deleted-pages. Open the match pages and read them — the caption on the earliest copy frequently names the place outright, which collapses steps 5 and 6 into a verification exercise instead of a search.

If the media is older than the claim, or from a different country than the claim, you have your answer and it is a stronger answer than a coordinate.

Done when you have either an earliest-known publication with its date and caption, or a documented null across at least three engines including crops and a mirrored search.

Step 5 — Visual geolocation

Run geolocate-from-pixels. Inventory clues before searching, rank them by geographic specificity, fix the country from language, plates, driving side and road markings, then narrow to a site and confirm in satellite and street-level imagery.

If step 3 gave you coordinates, do this anyway as an independent test rather than navigating straight to the coordinate and confirming what you were told. Use GPSImgDirection to reproduce the camera bearing and check that the view matches what a camera at that position pointing that way would see. A bearing that points at a blank wall means the coordinate is wrong.

Done when you have a candidate location with a stated radius and a written list of the specific features you matched — or a documented region-only result with the reason you could not narrow further.

Step 6 — Chronolocation

Still in geolocate-from-pixels, using its chronolocation reference. Shadow azimuth for the sun's bearing, shadow-length ratio for its elevation, then solve against a sun-position calculator for the confirmed location. Expect two date bands, not one, and break the tie with foliage, snow, crop stage, or a dated object in frame. Corroborate against a weather archive and note which station you used and how far away it is.

Reconcile the result against the metadata timestamps from step 3. Agreement between an unanchored EXIF datetime and an independently derived sun position is one of the strongest corroborations available in this whole workflow, because the two have no common failure mode.

Done when you have a time-of-day range and a date band, each graded, with the discriminator you used named — or an explicit statement that the date remains two-banded.

Step 7 — Authenticity

Run is-this-photo-real. At minimum: the physical-consistency checks — shadow convergence across multiple objects, reflection geometry, perspective and scale — and the internal-consistency sweep against your own step 5 findings.

The specific failure this step is here to catch: you have just geolocated a scene that was assembled from two photographs, or generated. A composite geolocates beautifully and means nothing. If shadow convergence fails or an element carries no optical signature, your location finding applies to the background plate only, and you must say so.

Done when manipulation and synthesis are assessed, each graded, with signal-level tests either run or explicitly marked invalid for the copy you hold.

Step 8 — Decide whether the claim is corroborated

Lay the independent lines of evidence side by side and ask what agrees.

The standard: three mutually independent non-transient features matching reference imagery makes a location. Independence is the requirement people fudge. Three photographs of the same sign is one feature. A building footprint, a utility pole line and a ridgeline profile are three. Metadata GPS plus a visual match plus a sun-position-consistent shadow are three, and they are independent because forging all three coherently is hard.

Then run the falsification test you should have written in step 5: name the single observation that would kill your candidate, go look for it, and record that you did. A finding nobody tried to break is not a finding.

Grade the composite honestly:

• Confirmed — three independent features align, the falsification test was run and failed to break it, and no line of evidence contradicts another.
• Probable — two independent features, or three with one resting on undated or low-resolution reference imagery.
• Region only — country or province established, no site. A respectable result.
• Excluded — you can affirmatively rule out the claimed location. Needs only one hard contradiction, and is often more useful than finding the true site.
• Unresolved — say so. An honest gap beats a confident guess that gets rebutted.

Done when each of location, time and authenticity carries a grade and the evidence it rests on, and any contradiction between lines of evidence is stated rather than reconciled away.

Step 9 — Express the finding

• Coordinates plus a radius in metres, always. A bare six-decimal coordinate claims sub-metre precision you do not have. Derive the radius from what actually bounds you: GPSHPositioningError if the finding rests on metadata, the resolution of the reference imagery if it rests on a satellite match, the size of the area consistent with your matched features if it rests on visual work.
• Camera position and bearing, separately from the subject's position. These are different places and reports routinely conflate them.
• Time as a range in local clock time, saying whether you converted from solar time and what offset you applied.
• Date as one or two bands, naming the discriminator that dropped the second — or reporting both if nothing did.
• The specific features you matched, listed, with links to the reference imagery and its capture dates.
• Your assumptions: assumed object heights, ground flatness, which reference bearing you used, which weather station.
• Apply the publication floor from step 1. If it says region-only, round the coordinate before it leaves your notes, not after someone asks.

Done when the finding is written with a radius, a grade, its matched features and its assumptions, at the precision step 1 authorised.

Step 10 — Handoff

Run write-the-intel-brief with the graded findings, the evidence chain, the hashes from step 2, and the archived reference links.

New selectors this workflow produces, and where they go: business names and municipal bodies to x-ray-a-company; phone numbers from signage to whose-number-is-this; domains on signs or vehicles to who-owns-this-domain; named or credited individuals to find-anyone; posting accounts to hunt-a-handle and pattern-of-life-from-socials; aircraft or vessels in frame to track-planes-and-ships; several related locations to graph-the-network.

Done when the brief is delivered, the case file retains the original hash and the derivative chain, and data you no longer need for the stated objective is deleted.