Chronolocation: Determining When a Photo was Taken Using Facebook, Google Street View and Assorted Tiny Details

How can open source investigators determine when a photograph or video was taken?

Observing the length of shadows visible in an image or clip and employing tools like Suncalc offers one useful method.

But this process of “chronolocation” – determining when a picture was taken rather than just where (which is known as geolocation) –  isn’t always feasible. For a start, it has to be daytime and there must be a shadow cast somewhere in the video or image of interest.

If these options aren’t available, looking for other clues in a “source” image that can be cross-referenced with contextual “reference” images or other related information can also help narrow down a date range.

Bellingcat has used such chronolocation techniques to determine when undated photos in a museum archive were taken and to find out when a Czech politician’s son (who claimed to be kidnapped) had been photographed. 

Clues to look for in a source image may include:

• Buildings (especially their façades)
• Construction sites
• Storefronts (similar to buildings but might be even more useful as this changes more frequently).
• Seasonal indicators such as weather, foliage etc.
• Natural landmarks
• Clock towers
• Public transport stops, bus lines etc.
• Graffiti and murals
• Banners
• Advertisements

Essentially, any aspect of a source image could be of use, provided that it has changed over time. Sometimes clues will be so obvious that it’s possible to immediately figure out the rough date of the source image from one detail alone.

This picture taken in front of CitiField, a baseball stadium in New York that serves as the home of the New York Mets, offers an example. 

Fans gather outside CitiField in New York (photo: Youri van der Weide).

Firstly, there are many features in this picture that can narrow down time and date. 

The most obvious is the banners on the lampposts in front of the stadium. The year is detailed as 2017. 

A close up image of banners on display outside CitiField in New York (photo: Youri van der Weide).

To determine the exact date, however, we need more information. 

There is a wooden structure on the left with a banner that reads, “Home is the Key” while the name of a non-profit, Habitat for Humanity, is also displayed prominently. Googling Habitat for Humanity in combination with the Mets yields only a few results. 

A page on Habitat’s website is one of those results. It explains that their Home is the Key campaign launched on April 3, 2017, on the opening day of the new baseball season for the New York Mets.

Text visible on a page of Habitat’s website details the “Home is the Key” campaign.

Another website visible in the same Google search results also reported on the topic and shared a picture of the same wooden frame that is visible in the source image. We can further confirm the date of April 3 by looking for the Mets’ 2017 season schedule, indeed the first game of the 2017 season was on April 3. 

It appears that a couple of key details and a quick Google search was all that was required to find a probable correct date for the image. Calling up or emailing Habitat to ask them whether this image was indeed captured on this date can provide further cast iron assurances.

Narrowing Down Dates

Unfortunately, chronolocation isn’t always that simple.

In most cases there will be a few extra steps and it will only be possible to figure out the earliest possible date or latest possible date that an image was taken, rather than the precise date and time.

Researchers will often already have a latest possible date when they start the chronolocation process. This will likely be the date an image was uploaded to the platform they found it on.

Of course, it may be possible to refine the latest upload date down to an earlier time frame with some investigation.

In 2018, Bellingcat published an article looking at claims that GRU officer “Ruslan Boshirov” (the cover identity for  one of the men accused of poisoning former Russian spy Sergei Skripal and his daughter Yulia) made a trip to Prague back in 2014.

A Facebook account using the name of Ruslan Boshirov had indeed posted from Prague on 11 October 2014.

A screen grab of a Facebook post by an account bearing the name of Ruslan Boshirov.

Yet while it was not possible to say for sure that this indeed was the Facebook account of the GRU spy, it was possible to confirm that the image it displayed had indeed been taken in Prague between mid to late 2014.

This would become relevant several years later when it became apparent that Boshirov, whose real name is Anatoliy Chepiga, had indeed flown to Prague around this time and was linked with attacks on munitions depots by Czech police. 

The picture clearly shows Prague’s popular Old Town square, a site that will be familiar to any tourist who has visited the Czech capital.

Yet other, more subtle details allowed Bellingcat to confirm that the photograph had in fact been taken in Prague around that time.

Firstly, it is not possible that the image could have been taken after 11 October, 2014, given that’s when it was posted to Facebook.

But by zooming in on a cream coloured building in the background, a number of large black letters flanked by two black squares can just about be made out.

A number of letters can be made out on the frontage of a building in the distance of a picture uploaded by the Facebook account of an individual named Ruslan Boshirov.

By looking at other images of this building, which Google Maps shows is called the Central Gallery, that appear on search engines or that were posted on social media sites during the European summer and autumn of 2014, we can begin to piece together a timeframe of when this photo was likely taken.

An image of the exterior of the Central Gallery in Prague uploaded on 17 June 2014.

The above image was uploaded on 17 June 2014 and shows the names of artists (Alphonse) Mucha, (Andy) Warhol and (Salvador) Dali, flanked by two black squares. This makes sense as the building has long hosted exhibits by these artists, as detailed in Trip Advisor reviews stretching back to 2014.

The position of the names and black squares also matched the 11 October Facebook photo and other photos posted online around mid-June.

However, photos that were uploaded in early June show a different signage on the building.

Images of the Central Gallery in Prague taken on 4 June and 14 June 2014.

Only the names of two artists appear and there are no black boxes in images uploaded on June 4 and 14.

We may now be able to state that the photograph was dated sometime between mid June and 11 October when it was posted on Facebook. As with the CitiField stadium example earlier, a call to the museum could help confirm these details.

Hanging out in Istanbul

Let’s look at another example, this time a picture taken in Istanbul.

A picture taken on İstiklal Avenue in Istanbul (credit: Youri van der Weide)

Geolocating this image isn’t too difficult, but readers can check the exact spot where it was taken here on İstiklal Avenue, a popular street in Istanbul,  if they so wish. 

There are lots of reference points to look at in this image, including:

• The pavement
• The mural and the construction site to the right
• The banners on lamp posts
• Stores and businesses (Lefon, Flormar, English Time, Zara)
• Advertisements
• Weather 

One big hint is contained in the banner that is visible in the top left corner of the image.

A banner on İstiklal Avenue in Istanbul appears to show the dates of an event.

Two dates appear to be written on the banner “28 eylül” (September) to “12 kas…”.

The full word beginning “kas” is not completed, but Googling “months of the year in Turkish” shows that the only month that begins with these three letters is “kasım” (November).

This could suggest that the picture was taken in the run up to or in between these months, although in which year is not clear. 

We just need to look for corroborating information to help confirm or reject this hypothesis. As with the Prague example above, reference images can begin to narrow down possible timeframes of when the image was taken

Some handy tools that can provide reference imagery include Google Street View, which is extremely useful in most cities. However, in more rural areas or even in less visited areas of big cities there is less street level imagery. For example, compare the number of pictures that you can find from Times Square in New York City with what is available for a residential neighbourhood in the city, for example.  

There are, of course, alternatives to Google Maps or Street View, including Yandex Maps, Bing Maps, Mapillary and Open Street Cam (as detailed in the below thread).

Hallo, here is your unroll: @y_vdw: 🗓️🎄 Day 18 of the @quiztime Advent Calendar: I present you alternatives for Google Street View. As of today… https://t.co/ggsT01gFr9 Have a good day. 🤖

— Thread Reader App (@threadreaderapp) December 18, 2020

Some countries also have their own mapping services, such as Baidu in China and Mappy in France. 

In Istanbul, however,  there are plenty of resources that can help identify when the street image above was taken. These include:

• Satellite imagery
• Google Street View
• Yandex Panorama
• Istanbul city council’s own mapping service that provides something similar to Street View

As with the Prague and New York examples above, there are also other options that can help narrow down a timeframe, including:

• Instagram, Facebook pictures
• Foursquare, TripAdvisor etc. 
• YouTube, Facebook videos from the area

In short, there is lots to dig into to help us find reference imagery that we can compare to the source image which we are trying to date.

Starting with Google Street View, the latest available image that can be seen (at time of publication) is from August 2019. There are clearly significant differences from the source image.

The mural isn’t there for one, nor is the scaffolding. We can also see that the pavement appears different.

A Google Street View image from İstiklal Avenue in Istanbul captured in 2019.

One of the many useful features offered by Google Street View is the ability to look back through older images by clicking on the “see more dates” option in the left upper corner.

Google Street View offers users the opportunity to see other dates images have been captured at the same location.

This brings up images from a range of other dates when Google Street View images have been captured.

Google Street View shows other dates where images have been captured on İstiklal Avenue in Istanbul.

Immediately, it’s possible to match the graffiti image on the scaffolding in the October 2015 image on the far right of the above screen grab (and below).

Google Street View shows an image of İstiklal Avenue in Istanbul captured in October 2015.

Obviously, October does fall within the 28 September to 12 November period we noticed were detailed on the blue and yellow banners earlier.

But some aspects of the Street View image and our source image don’t match. For example, those very banners with the dates aren’t there in the Street View image.

Other details also don’t quite match up. For example, the style of the lettering of the “Lefon” storefront is different. The advertisement on the side of the store next door is also different. 

A side-by-side view of a Google Street View image (left) of İstiklal Avenue and our source image (right), with several differences visible.

To help us keep track of the earliest and latest possible dates, we can create a timeline and update it as we go. Though not always necessary during a process of chronolocation, this can be a useful mental aid.

We can also update the timeline as new details are discovered. Here’s what we know so far:

• We know that the source picture was taken before the mural was removed and the construction ended. 
• We also know the picture was taken after the artist painted the mural. 

We also have a provisional latest possible date as we can see the graffiti and scaffolding had been removed in the 2018 Google Street View image. But we don’t know if the source image was taken before or after the October 2015 Street View image. At this stage, our timeline will look something like this.

A timeline detailing what we know about when the image could have been taken so far.

Thinking laterally, could searching for the artist provide more useful contextual details?

Using the artist’s handle (Omeria) that is visible on the graffiti, we can find his Instagram account. Scrolling back through the images, we can see a picture of the same graffiti was posted on October 10, 2015.

Of course, this could be an old picture, uploaded at a later date. But the image does appear far fresher than the Street View image. There are also no stickers or smudges on it, unlike the source image.

Omeria also published a now unavailable Instagram post on October 8, 2015, that shows him in the process of creating the image.

While we must still acknowledge that the Instagram post could possibly be depicting events that happened before the 8 October 2015 upload date, it still provides us an initial date to work with as this is the earliest record of the graffiti that we have. 

Google Maps further tells us the Yapı Kredi Culture and Art centre is located where the scaffolding (and graffiti) was. 

A press release on the centre’s website shows that it re-opened in September 2017. If the scaffolding was removed upon re-opening (taking the graffiti with it as would appear necessary) that would mean we have further narrowed down the latest possible date the picture could have been taken. 

Our timeline now looks like this:

An updated timeline detailing what we know about when the image could have been taken so far.

We can further narrow down the date range using our powers of deduction.

We know the banners in the original picture said September to November. But as we discovered earlier, October 2015 was most likely too early as while the graffiti was present, there were no banners.

A Google Street View image of İstiklal Avenue in 2015. While this image shows the graffiti, there are none of the banners that are visible in our source images.

September to November 2017 would most likely have been too late because the scaffolding bearing the graffiti would have been removed with the re-opening of the building. 

This leaves 2016 as a potential option.

Our timeline now appears as follows.

An updated timeline detailing what we know when the image could have been taken so far.

Unfortunately, Google Maps, Yandex and other street view services do not provide any imagery for 2016.

So, as with the Prague example, we can begin to check out user-uploaded content. 

Luckily, İstiklal Avenue is a busy street with lots of visitors every day. Therefore the probability of finding footage is relatively high.

Facebook, YouTube, Instagram, TripAdvisor, Four Square or any other website where people can tag footage to a place is worth researching. 

To keep things simple, we can stick to YouTube and Facebook for the purpose of this exercise as they are easier to search.

Both Facebook and YouTube videos can be filtered by dates (a full explanation on how you can do that can be found here, although it is worth noting the section detailing Instagram in this link is now outdated). Using Google and filtering by the date function, we can see a video was uploaded on 6 November 2016 titled “Night walk around[sic]Istanbul Taksim Istiklal Galata Bridge”.

Google search results for videos on İstiklal Avenue.

It’s 37 minutes long, but at 12 minutes and 21 seconds the uploader passes the same section of the street (although, looking in the opposite direction to our source image) where banners can be seen.

The arrow on the left shows the area where the source image was taken from, while the arrow and box on the right show the yellow and blue banners also visible in the source picture.

For live streamed videos we can be sure about their upload time and date. Hovering over the details of when the video was streamed will show the precise broadcast date.

Live streamed videos can be recognized by the word “streamed” as in “Streamed two years ago”. A video that wasn’t live streamed will only say “two years ago”, without the word streamed.

However, videos that weren’t live streamed aren’t guaranteed to have been filmed around their upload date. Someone could, of course, have filmed a video months before only to upload it later. For walking videos, uploaders sometimes give a precise date for when the video was filmed.

If not, you must assess whether the video was filmed close to its upload date.

Luckily, Facebook videos that live streamed from late October and early November show the same yellow and navy blue banners as our source image. We can now be confident the image was likely taken around this time given we already know it could not have been taken in 2015 or 2017.

A Facebook Live video broadcast on 22 October 2016 shows blue and yellow banners on İstiklal Avenue.

Going back a little further we can start to narrow down our timeline even more.

Live videos and photos from Facebook that were taken in late September – shortly before the event detailed in the banners seen in our source picture was due to begin – show Turkish flags instead of  yellow and navy blue banners on lamp posts and throughout the street. 

For example, this is the scene in a live video from 23 September:

Turkish flags can be seen in the top right of a live video filmed on İstiklal Avenue and streamed on Facebook on 23 September 2016.

On September 28, 2016, the first date mentioned on the banners, we found live videos, as well as news reports, of the opening of a festival together with the first appearance of banners that appear to match those in the source image.

A Facebook Live video posted on 28 September 2016 shows bronze and navy blue banners on İstiklal Avenue.

Though similar, the banners are bronze and navy blue as opposed to the yellow and navy blue that can be seen in the source image.

Further investigation shows that images throughout the period between 28 September to 12 November show the colours of the banners regularly changed. This news article about a bomb scare at the same section of the street on 14 October showed the banners displayed were light blue and navy blue.

Light blue and navy blue banners can be seen in a Live video from İstiklal Avenue that was streamed on YouTube on 14 October, 2016.

The first videos and photos that showed the colour of the banners had changed to yellow and navy blue appeared on October 18. By 10 November, these had been replaced by white and yellow banners which were there until at least the end of the festival (12 November).

White banners can be seen in the top left of a live video filmed on İstiklal Avenue and streamed on Facebook on 12 November, 2016.

Given the abundance of reference material, we can now narrow  down the possible date range the photo was taken to an even shorter period (18 October to 10 November) as can be seen in the updated timeline below detailing the colours on the banners.

An updated and colour-coded timeline detailing what we know about the the image and when it could have been taken.

The frequency at which the colours of the banners changed also appeared to tally largely with an event calendar for the festival that was detailed in local media reports:

A screen grab of event details taken from the Dunya news site.

With all this information at hand, we can now confidently state that our reference image was taken at some point between October 18 and November 10, 2016.

Of course, in other situations investigators might not be able to narrow the date down to such a narrow period. But this isn’t always necessary in an investigation. Often, all that is required is to confirm whether a picture or video could have been taken in a certain year, or before or after a certain period.

The chronolocation techniques detailed here can be extremely helpful in such circumstances. In this instance it allowed us to go from having no idea of when a source image was taken, to narrowing the possible timeframe down to just a few weeks.

lingcat is a non-profit and the ability to carry out our work is dependent on the kind support of individual donors. If you would like to support our work, you can do so here. You can also subscribe to our Patreon channel here. Subscribe to our Newsletter and follow us on Twitter here and Mastodon here.

Source: Bellingcat*

*СМИ, выполняющее в России функции иностранного агента и признано нежелательной организацией