Geolocating MW-OSINT
Note: this blogpost was created with written permission of MW-OSINT. I always try to ask before posting personal information.
Hello everyone, I hope you found my previous article “My (simple) first geolocation” interesting! After my first investigation, I started looking for a new topic to investigate. Via the Bellingcat website, I read in the article titled First Steps to Getting Started in Open Source Research that Twitter is a very important social media for open source investigators.
“Twitter is the primary medium for identifying, debating, and disseminating open source research. It’s full of practitioners who are eager to engage in discussions with others about best methods and practices, and to share their own work and that of others. Having a Twitter account will allow you to follow researchers so that you can learn from their work, as well as ask questions and engage in discussions with like-minded researchers.”
After reading this I created a new Twitter account under the name of Daan2K21 and started following all kinds of people I knew from the open source investigations community. In addition, I read in the same Bellingcat article that “One easy way to find open source researchers is to follow Twitter lists.” So I did.
I was following Twitter in the background for a few days and was already working on some other small projects until I came across the following post from MW-OSINT.
I immediately started searching because the message had only just been posted and no one had shared a solution yet. The assignment was clear:
- Where did MW-OSINT take this picture?
- At what time was the photo taken?
Let’s start with where the photo was taken!
Geolocating MW-OSINT
The image is a selfie and selfies are almost always flipped, so the first thing I did was to flip the image the other way around and started searching with the two pictures opened on my screen.
Then I started gathering some more infromation about what I can see on the picture and the person who took it (MW-OSINT).
When I was seeing the image for the first time I immediately thought about the mountain range in the bankground being part of the Alps in Europe. I just had a feeling because I have seen the alps a lot in person and it was very recognisable. To verify if this picture could have been taken in the Alps I started searching for information about where MW-OSINT is from.
On his Twitter page MW-OSINT says he is from Germany which already indicated that the picture could indeed have been taken in the Alps (part of the Alps are in the south of Germany). But it is also very easy to fake your location on Twitter so I needed to verify this with more information.
When doing a simple search on MW-OSINT’s Twitter account I found that he retweets a lot of posts from the German Open Source Intelligence Conference. This is one hint to look out for when searching for MW-OSINT on Google.
And surprise surprise I found the website of the GOSINTCon with his Twitter username on the page. Then I visited the website to look if I could find some more information about MW-OSINT.
When scrolled down on the homepage I already found a “meet the team” section where MW-OSINT could be found under the name of Matthias Wilson.
Important note!
On the Bellingcat website I found that “open source research often relies on social media posts that contain videos and images. However, these posts can be taken down by platforms or deleted by those posting them.” This also counts for websites and actually all information on the internet. Saving the screenshots in this investigation proved to be very important bacause today the “meet our team” section on the website of the GOSINTCon website does not contain any information anymore.
Now we had the name of Matthias Wilson it was time to do a Google search on that name. The first search result is the LinkedIn page from Matthias and most of the time people share their location on LinkedIn so I was taking a look there.
Here we can see that also here Matthias says that he is from Germany and more specifically from Munich in the Bundesland of Bayern. So this was my second verification and I hoped the information was true. Also we can see that he has linked the German OSINT Conference to his profile. With this information I started looking in the south of Germany for possible locations.
What I always do before looking for a location is analysing the original image. In this case we see in the foreground a mountaintop with a cross on top of it (in the Alps, as it is in other places, it is very common to put a cross on the summit of a mountain). In the background we can see a road, a big part of a hill with no trees, some part that looks like a skiing slope on the first row of mountains and a second row of mountains with steep, high and rocky mountains.
In the satellite image from Google Earth Pro I was looking to the south of Germany (top of the image is the south) and I found three locations that fitted the basic requirements of my search. These places were Berchtesgaden, Garmisch-Partenkirchen and Oberstdorf.
Then I started searching for big skiing resorts at these locations to try and find a fitting one.
On Google Maps most the lifts and slopes of skiing resorts in the Alps are fully mapped . This is how I was able to find a big skiing resort in Garmisch-Partenkirchen. My searcharea was now narrowed down to this area on the German side of the border with Austria.
Then I went searching on Google Maps for summits two rows of mountains away from the high and rocky ones towards the north. I checked every summit and went looking for 360 views untill I found the summit I was looking for.
In the 360 image I recognised a lot of elements from the original image. We can see two rows of mountains, a skiing slope, a road in the valley and a big area with no trees on the mountain to the right.
To verify if this was the summit I was looking for I searched for additional images of the cross and the view.
In this picture I was able to confirm that I found the right summit. The mountain is called the Krottenkopf and is located in Garmisch-Partenkirchen, Bayern. Coordinates 47.544383, 11.191428
I also like to confirm my locations with peakvisor.com if possible. So I uploaded the image and did the mountain overlay.
Peakvisor conformed the second verification of the location. In the middle of the picture the mountains perfectly allign. Because of distortion in the selfie the mountains on the left and right of the image do not perfectly allign.
At what time was the selfie taken?
If you look closely to the original image you can see that the moon is visible. Because this is easier to use instead of the shadow I went with the moon to determine the exact time.
The first thing I did was mapping the location of the moon in Google Earth Pro so that I knew the exact angle from the Krottenkopf. For reference I used the Rotenkopf mountain in the first row of mountains visible from the Krottenkopf.
For determining the exact time I used mooncalc.org. This is a very handy tool you can use in an investigation if the moon is visible. In mooncalc.org I dragged the position of the moon exactly to the position of the moon in the original image and I found that the picture was taken at 07:47 AM CET.
Conclusion
Where did MW-OSINT take this picture?
Coordinates: 47.544383, 11.191428
At what time was the photo taken?
Time: 07:47 AM CET
The time and location were later confirmed by MW-OSINT himself (the exact time was 07:39 AM CET).
I hope you enjoyed reading this investigation and untill the next one!
Follow me on twitter for more! https://twitter.com/Daan2k21
