Subject:The Case of the Wall-Eyed Girl 
Duration:20 minutes (estimated)
Having both eyes look inward is called "esotropia" or "cross-eyed". But what is it called when both eyes look outward? Exotropia, or having both eyes look outward, is sometimes called "cock-eyed" or "wall-eyed".

Plenty of people can cross their eyes, but few people can look in opposite directions at the same time. Is this picture of a wall-eyed girl real?

Wall-Eyed Girl

Click on the picture to view the analysis page. Then answer the following questions:

  1. Starting with the metadata. What type of camera took this picture?
  2. When was this picture taken?
  3. This type of camera has a configuration setting that permits you to set a nearby hometown. (Selecting a city in the same time zone is easier than forcing users to select a time zone.) What is the hometown?
  4. Based strictly on the metadata, is there anything to suggest that this is anything other than a camera-original picture?
  5. Using Error Level Analysis to evaluate the JPEG compression level, are there any inconsistencies, or does this picture appear unmodified?
  6. Bonus question: (Very difficult) Can you tell what happened with this picture?

Hint #1
Look at the metadata for the camera's make and model.
Hint #2
Look at the metadata for the timestamps. This includes the creation date, modified date, and date/time original.
Hint #3
Look in the metadata's MakeNotes for the city.
Hint #4
Look for inconsistent timestamps, metadata fields that only come from applications, or other inconsistencies. See the metadata tutorial.
Hint #5
With ELA, look for consistencies. Do similar edges have similar intensities? Are similar surfaces at similar intensities? Are similar textures at similar intensities?

Or is there something inconsistent? Inconsistencies can be used to identify tampering or modifications.
Hint #6
Identifying how the picture was created is a really difficult problem. You want to find a scenario that is consistent with both the ELA and metadata findings.

For this picture, first look at the metadata for anything about camera modes or specific camera settings. Then look through the camera's user manuals and technical manual for information about the modes identified in this picture's metadata.

Warning: While this overall challenge has a difficulty of ●●●○○, this question, by itself, should be a ●●●●●.

Answer #1
The make identifies this as a "Casio Computer Co., LTD" camera. The model is a EX-Z3.

If you look up this camera, you will find that it is a small point-and-shoot camera with a 3 megapixel sensor. It first came out in 2003.
Answer #2
The creation date, modify date, and original date/time all say the same thing. The picture was photographed on 24-June-2006 at 7:51pm (2006:06:24 19:51:05).
Answer #3
The metadata "Hometown City" is "Stockholm". This picture was likely taken in the same time zone as Stockholm, Sweden.
Answer #4
The timestamps are consistent. The metadata sections appear consistent for metadata from a camera. There is no indication of tampering or third-party applications altering this picture.

Based only on the metadata, this appears to be a camera-original picture.
Answer #5
The ELA result shows a dark vertical line down the center of the picture. Compared to the rest of the picture, this line is inconsistent across all edges, surfaces, and textures.

This inconsistency identifies an edit that was made to the picture. The wall-eyed girl appears to be made from two photos that were spliced together. The vertical line shows where the two pictures were blended together.
Answer #6
The metadata has a MakerNotes field called "Record Mode" and is set to "Best Shot". The metadata also says that it used Best Shot Mode #4.

The manual for this camera says that the "Best Shot" function is used for in-camera modifications to the picture. Mode #4 is a "Coupling Shot: Uses separate areas to combine two shots." This is a splicing of two pictures.

So how did the photographer create this image? They took two pictures. One picture has her looking left, and the other has her looking right. Then, using the in-camera splicing, the pictures were combined.

The ELA result shows where the pictures were spliced together. And since it was all done in-camera, the metadata reflects a camera-original picture.

Copyright 2012-2017 Hacker Factor, All Rights Reserved.System StatusBlogFAQContact