Geolocation and Imagery OSINT

Geolocation and Imagery OSINT
Discipline	GEOINT / IMINT within open-source intelligence
Core questions	Where was it taken? When? Is it authentic?
Reference cases	Bellingcat’s MH17 Buk investigation (2014–2015)
Typical tools	Google Earth, Sentinel Hub EO Browser, SunCalc, reverse image search
Key risk	Stripped metadata; AI-generated and recycled imagery

Geolocation is the process of determining where a photograph or video was captured, and chronolocation the process of determining when. Together with media verification they form the imagery branch of OSINT disciplines (GEOINT and IMINT). In financial-crime and trafficking work they are used to confirm that a facility exists and operates, that goods or assets are where documents say, that a claimed site visit or inspection occurred, and that images offered as evidence are what they claim to be. The approach is the one popularised by Bellingcat and by the Verification Handbook: treat every image as a claim, extract every observable clue, and corroborate with independent sources.^[1] It is a methods discipline; locating private individuals' homes or movements is outside the scope of ethical OSINT, and the examples here involve public events, infrastructure and commercial sites.

1 Satellite and aerial imagery sources

Free sources include Google Earth (whose desktop version has a historical-imagery slider showing earlier captures), Sentinel Hub EO Browser with Copernicus Sentinel-2 imagery at roughly 10 metre resolution and a revisit of a few days, and mapping services with street-level coverage. Commercial providers such as Planet Labs and Maxar offer sub-metre to daily-revisit products at a cost. Resolution drives what is answerable: 10 m imagery shows a field or a large warehouse but not a vehicle; 30–50 cm imagery shows vehicles, shipping containers and building details. Bellingcat’s Online Investigations Toolkit catalogues these tools with their limitations.^[2] Always record the capture date shown by the viewer, because map tiles blend imagery of different ages.

2 The Bellingcat approach

Bellingcat’s investigation of the Buk missile launcher linked to the downing of MH17 is the standard teaching case. Using videos and photographs shared on social media, the team matched distinctive features in the background, such as buildings, road layout and signage, to satellite imagery to fix where each image of the convoy was recorded, and used shadow analysis with SunCalc to estimate the time of day.^[3] The method generalises to any chain of images: each geolocated and dated image becomes a point on a timeline, and the chain’s strength comes from many independent images that agree. Public sources of this kind later informed formal findings, but a reader should treat each open-source claim as only as strong as its documented steps, which is why the method emphasises showing the work.

3 Forensic examination techniques

Technique 1: Clue inventory and ranking. Before searching, list every observable feature and rank it by how location-specific it is: (1) unique landmarks and skyline; (2) road geometry, intersections, bridges; (3) signage, language, script, phone-number formats; (4) utility poles, bollards, road-marking style, driving side, licence-plate format; (5) vegetation, soil, climate; (6) vehicles and architecture style. Highly specific features are searched first. Output: a clue table that lets another analyst reproduce the reasoning.

Technique 2: Progressive narrowing. Country (driving side, language, plate style), then region (climate, architecture), then city or district (landmarks), then the exact vantage point (match skyline and building edges to satellite and street-level views). Confirm by matching at least three fixed features whose relative geometry agrees: a bend, a building footprint and a utility pole line, say. A single matching feature is only a candidate.

Technique 3: Shadow-based chronolocation. Measure an object’s height H and its shadow length L in the image, in the same plane. The sun’s elevation angle is arctan(H/L). Worked example: a 6.0 m pole casts a 9.0 m shadow, so elevation = arctan(0.667) ≈ 33.7 degrees. At a known location and date, a sun calculator such as SunCalc lists the times of day when the sun reaches that elevation, typically one morning and one afternoon time; shadow direction then selects which. Conversely, with a known time the date can be estimated, since at mid-latitudes elevation at the same clock time changes with season by tens of degrees. Uncertainty is substantial where height or the ground plane is estimated, so report a time window, not a minute.

Technique 4: Imagery-date bracketing. Compare historical satellite imagery to find when a feature appeared or disappeared (new construction, a cleared field, a vessel at a berth). If the feature is absent on 2 March and present on 18 April, the photograph showing it is no earlier than 2 March and the build occurred in that 47-day window. Cross-check with seasonal cues (leaf cover, snow, crops) and weather records for the claimed date.

Technique 5: Reverse image search and earliest-appearance analysis. Run the image through several engines (Google Images, Yandex, TinEye, Bing) and crop to distinctive regions. TinEye is useful for finding the earliest indexed instance; Yandex is often effective for places and faces, but searching for faces raises privacy questions that OSINT Ethics addresses. For video, extract keyframes and search those. If an image predates the claimed event, it is recycled. Output: a log of engines, queries, dates and earliest dated hit.

Technique 6: Metadata (EXIF) examination. Inspect Exchangeable Image File Format fields: capture timestamp, device make/model, software, GPS coordinates, lens and orientation, and thumbnail. Compare them with the visible content: a file claimed as phone photography whose software field shows an editor, a thumbnail that differs from the main image, or a capture time that conflicts with shadows are warning signs. Most social platforms and messaging apps strip or rewrite metadata on upload, so absent EXIF is normal, not suspicious, while intact EXIF on a file obtained directly from a source is high-value but also trivially editable. Treat metadata as a lead, never as proof, and hash the original file before examining a copy (see Digital Forensics Tools and Chain of Custody).

Technique 7: Image-integrity analysis. Look for inconsistent lighting and shadow directions, repeated texture (clone stamping), edge halos, and mismatched noise or compression between regions; error-level analysis and noise-residual views assist but produce false positives on recompressed images, so they support but do not decide. For video, see Video Forensics, which covers frame analysis and authentication in more depth.

Technique 8: Corroboration matrix. For each conclusion record location confidence, time confidence and authenticity confidence separately, with the independent items supporting each (satellite match, shadow estimate, second angle of the same event, local weather, eyewitness or official statement). A claim supported by one line of evidence is reported as unconfirmed.

4 AI-generated imagery and provenance

Generative models can produce photorealistic scenes, which means the question “is this real?” now comes before “where is this?”. Visual tells (malformed hands, garbled text, inconsistent reflections, implausible architecture) are unreliable as models improve. Provenance technologies help but have gaps: C2PA Content Credentials are cryptographically signed metadata recording a file’s origin and edits, while SynthID is an invisible watermark embedded in pixels at generation; in May 2026 OpenAI and Google jointly endorsed pairing the two because each alone is insufficient.^[4] Platforms commonly strip embedded metadata on upload, so credentials usually survive only on files obtained from the source, and the absence of a credential or watermark proves nothing. Detection classifiers produce both false positives and false negatives and should not be cited as conclusive. The robust approach is to geolocate and chronolocate: a fabricated scene will usually fail to match real satellite and street-level geometry, and a real one will match in several independent respects. Authenticity findings for court use belong with a qualified examiner (see Evidence and Testimony and the Daubert standard).

5 Documentation, limits and ethics

• Preserve first. Save the original file and the page it came from, hash it, and capture the URL and time; sources vanish (see Web Archives and Domain Intelligence).
• Show the work. Annotated side-by-side comparisons, coordinates, imagery dates and calculation steps let others reproduce the finding.
• State uncertainty. Use confidence levels and time windows.
• Confirmation bias. Try to disprove the hypothesis; a peer reviewer should repeat the geolocation blind where possible.
• Do not target individuals. Do not geolocate private residences or track private persons; blur faces and licence plates in anything published; consider that publication can place people in danger.
• Imagery limits. Cloud cover, old tiles, seasonal change and low resolution can produce wrong matches; satellite imagery shows a surface, not intent.

See also: OSINT Disciplines, Video Forensics, Digital Forensics, OSINT Tools, Web Archives and Domain Intelligence.

References

1. Silverman, C. (ed.). Verification Handbook, Chapter 6, “Building expertise through UGC verification.” verificationhandbook.com
2. Bellingcat. Online Investigations Toolkit and “Searching the Earth: Essential Geolocation Tools for Verification” (2015). bellingcat.com
3. Bellingcat. “MH17 – The Open Source Evidence.” 8 October 2015. bellingcat.com
4. SoftwareSeni. “How C2PA Content Credentials Work and What Their Limits Are”; coverage of the May 2026 OpenAI/Google dual-layer endorsement (secondary source). softwareseni.com