Dissecting the White House PDF

User avatar
nbc
Posts: 4228
Joined: Thu Mar 19, 2009 12:38 am

Dissecting the White House PDF

#1

Post by nbc » Sat Jun 22, 2013 3:34 am

I have been conducting a systematic analysis of the PDF at the raw data level, and since the PDF contains a rotated JPEG of the background of the birth certificate, I extracted the jpeg and used various tools to explore the contents. I have reached several tentative conclusions:1. The compression resulted in a quality drop of 53%, which is extremely high2. There is not metadata that suggests creation by Photoshop and I am exploring others3. There is one comment in the file “YCbCr” which is the coding scheme for the color space.4. Error level analysis shows no evidence of tampering5. It’s unfortunate that we have not seen anyone apply these tools to look in more depth at the raw dataIf we can identify the software which generates such a comment, we can reach additional conclusions.[/break1]wordpress.com/2013/06/21/jpeg-the-gory-details-part-1-introduction/]JPEG – The Gory Details – Part 1 – Introduction[/break1]wordpress.com/2013/06/22/jpeg-the-gory-details-part-2-file-contents/]JPEG – The Gory Details – Part 2 – File ContentsEnjoy, it is a bit technical but I believe it is still clear enough for one to follow the dissection of the JPEG which was embedded in the long form birth certificate PDF.Next step: Finding a Xerox work station and see if I can create a pdf with JPEG and see what if it contains the magic string...

GCharlotte
Posts: 229
Joined: Fri Jun 21, 2013 6:55 pm

Dissecting the White House PDF

#2

Post by GCharlotte » Sat Jun 22, 2013 3:41 am

Can you provide the URL? I don't want to assume I find the same JPG.

User avatar
Lani
Posts: 4726
Joined: Fri Nov 16, 2012 4:01 pm
Location: Some island in the Pacific

Dissecting the White House PDF

#3

Post by Lani » Sat Jun 22, 2013 3:50 am

Why are you spending time on the White House pdf? Hawaii has confirmed that the information is accurate. End of story. Move along....
Insert signature here: ____________________________________________________

User avatar
nbc
Posts: 4228
Joined: Thu Mar 19, 2009 12:38 am

Dissecting the White House PDF

#4

Post by nbc » Sat Jun 22, 2013 4:09 am

I obtained a Xerox Work Station PDFAnd the "YCbCr" tag is in the document...However the Quantization tables are different for Cb and Cr so we have not found the complete answer but we have reasonable certainty that the document may have been generated on a Xerox Work StationIn addition, the document contains 1 JPEG background and several monochrome bitmaps.I am feeling quite certain that we have found the workflow.

User avatar
nbc
Posts: 4228
Joined: Thu Mar 19, 2009 12:38 am

Dissecting the White House PDF

#5

Post by nbc » Sat Jun 22, 2013 5:03 am

Found a Xerox workstation document with background JPEG and multiple foreground text monochrome bitmaps.[/break1]beatesmindevej.dk/bitcache/9235018b9157b47baff4a839b824128414c8fb1e?vid=36&disposition=attachment&op=download]http://www.beatesmindevej.dk/bitcache/9 ... p=downloadSomeone with Illustrator may want to double check. Page 1 has several text bitmaps.I think we have found the work flow.Would that not be hilarious?Matches up with so many of the features found in Obama's birth certificate. Will have to look at the alignment of the layers, but several markers align up already.

User avatar
nbc
Posts: 4228
Joined: Thu Mar 19, 2009 12:38 am

Dissecting the White House PDF

#6

Post by nbc » Sat Jun 22, 2013 5:07 am

[anchor= goto=][/anchor]Why are you spending time on the White House pdf? Hawaii has confirmed that the information is accurate. End of story. Move along....Because I like minor mysteries and I believe that I may have figured out the work flow involved. Now even the compressed PDF has no evidence of forgery anymore...Call it intellectual curiosity that drives me to find a more reasonable explanation for the document. I believe I have found such evidence.

User avatar
nbc
Posts: 4228
Joined: Thu Mar 19, 2009 12:38 am

Dissecting the White House PDF

#7

Post by nbc » Sat Jun 22, 2013 5:12 am

Can you provide the URL? I don't want to assume I find the same JPG.Excellent suggestion. I will make it available on my site and provide a linkOr you install pdf-parser.py and runpdf-parser.py -object 7 -d test.jpg birth-certificate-long-form.pdf:-)

GCharlotte
Posts: 229
Joined: Fri Jun 21, 2013 6:55 pm

Dissecting the White House PDF

#8

Post by GCharlotte » Sat Jun 22, 2013 11:25 am

I just wasn't sure you meant embedded within the PDF. Thanks.

User avatar
Dr. Blue
Posts: 904
Joined: Sat Jan 07, 2012 10:01 am
Occupation: Call the doctor!

Dissecting the White House PDF

#9

Post by Dr. Blue » Sat Jun 22, 2013 1:05 pm

I have been conducting a systematic analysis of the PDF at the raw data level, and since the PDF contains a rotated JPEG of the background of the birth certificate, I extracted the jpeg and used various tools to explore the contents. I have to agree with Lani asking "why"? It's only a marginal question with absolutely zero impact on anything real. I suppose it's not any worse than people wasting time playing computer games, but still...I will add one comment:...3. There is one comment in the file “YCbCr” which is the coding scheme for the color space....If we can identify the software which generates such a comment, we can reach additional conclusions.You may know this, but YCbCr is the standard color space for JPEG images. EVERY piece of software that works with JPEG works with YCbCr color space, and since PDF documents tag images with colorspace info, that's not going to narrow things down.From a later post:we have reasonable certainty that the document may have been generated on a Xerox Work Station"certainty" that it "may have been"?!? Enough weasel words in there not to make it completely false, but I'd disagree with any more definitive statement - there's really nothing unusual or distinctive about the PDF that would allow one to conclude that it comes from any particular equipment.And from yet another post:Now even the compressed PDF has no evidence of forgery anymore..."Now"?!?!? Seriously? There was no evidence of forgery on April 27, 2011 - the day that PDF was posted - and there has been no evidence of forgery at any time since then either.Geez....I don't mean to sound too harsh nbc - you've certainly done a lot of good things over the years - but this is really just silly, and gives the bizarre birther conspiracies about a "forged PDF" far more weight than they deserve (which is none).

User avatar
MRich
Posts: 784
Joined: Sun Aug 22, 2010 4:07 pm

Dissecting the White House PDF

#10

Post by MRich » Sat Jun 22, 2013 1:20 pm

I don't mean to sound too harsh nbc - you've certainly done a lot of good things over the years - but this is really just silly, and gives the bizarre birther conspiracies about a "forged PDF" far more weight than they deserve (which is none).He's challenging falsehoods.

User avatar
Whatever4
Posts: 12083
Joined: Tue Sep 08, 2009 6:36 am
Location: Mainely in the plain
Occupation: Visiting doctors.

Dissecting the White House PDF

#11

Post by Whatever4 » Sat Jun 22, 2013 1:21 pm

I don't mean to sound too harsh nbc - you've certainly done a lot of good things over the years - but this is really just silly, and gives the bizarre birther conspiracies about a "forged PDF" far more weight than they deserve (which is none).He's challenging falsehoods.Right. That's what we do.
"[Moderate] doesn't mean you don't have views. It just means your views aren't predictable ideologically one way or the other, and you're trying to follow the facts where they lead and reach your own conclusions."
-- Sen. King (I-ME)

User avatar
nbc
Posts: 4228
Joined: Thu Mar 19, 2009 12:38 am

Dissecting the White House PDF

#12

Post by nbc » Sat Jun 22, 2013 1:56 pm

"certainty" that it "may have been"?!? Enough weasel words in there not to make it completely false, but I'd disagree with any more definitive statement - there's really nothing unusual or distinctive about the PDF that would allow one to conclude that it comes from any particular equipment.Uh, you did not read my postings then as the raw data certainly contains some indicators. Enough to lead me to a Xerox Work Station as the most likely candidate.

User avatar
nbc
Posts: 4228
Joined: Thu Mar 19, 2009 12:38 am

Dissecting the White House PDF

#13

Post by nbc » Sat Jun 22, 2013 2:12 pm

I don't mean to sound too harsh nbc - you've certainly done a lot of good things over the years - but this is really just silly, and gives the bizarre birther conspiracies about a "forged PDF" far more weight than they deserve (which is none).He's challenging falsehoods.Indeed, the artifacts in the Whitehouse document require an explanation, as they allow birthers to claim that the document shows evidence of forgery and fraud.It's one of the most powerful arguments, not for court but for 'public opinion' and removing this pillar will cause some interesting responses by the birthers.Some have placed quite a bit of weight on the Cold Case Posse's findings....That by itself gives me enough satisfaction, however, the fact that, despite lots of efforts on my part, and the part of others, we were never really able to find software that has multiple monochrome bitmap layers. Now, through a stroke of luck, and that's what it was, I found several hints that allowed me to dot the i-s and cross the t-s.I really do not care much what others think about this, it's a minor personal victory to find, with the recent help of Vicklund, a likely identity for the 'forger' and her name is Xerox Work Station.I found some relevant hints by looking at the raw, hex data of the PDF and the embedded graphics and found that some hints had been left as to the nature of the 'forger'.What settles it for me is that the JPEG contains a comment YCrCb which indicates that it uses luma/chroma color space, and the lack of any other metadata. This not only excluded many software but also led me to Xerox where I found the same string embedded as a comment. Note that the comment is not necessary for the JPEG to work.Of course, there may be other software out there that behaves the same.Oh and I also found, much to my surprise, that Xerox's PDF producer is identified as OS/X Quartz... Producer: Mac OS X 10.6.7 Quartz PDFContextZullo and his posse will have some explaining to do...

GCharlotte
Posts: 229
Joined: Fri Jun 21, 2013 6:55 pm

Dissecting the White House PDF

#14

Post by GCharlotte » Sat Jun 22, 2013 3:42 pm

I think this is an OK exercise for the sake of science but it shouldn't be used as a presentation. That gives the other side a chance to say "see, they know something was wrong and they are now trying to disprove".As long as they are attacking eligibility AT ALL they will make no progress. Their minds cannot be changed. And that's why I wonder why Obama hasn't made an appearance at the CA 4 after the judge warned that if they didn't respond it would be judged on the case documents. Good. Don't even show up as long as you're not risking a default judgement. Let her lose with no one even defending.Correct me if I'm wrong on this because I'm new but birth certificate goes to eligibility and every single one of those cases, past, present and future are moot.

jamese777
Posts: 88
Joined: Thu Mar 31, 2011 12:22 pm

Dissecting the White House PDF

#15

Post by jamese777 » Sat Jun 22, 2013 3:51 pm

I for one want to thank NBC for his diligence. Any time that any of us walk into a courtroom, anything can happen. There are no sure things in courts of law and I've seen all the scientific evidence one could muster fail to convince a judge of " the truth." I urge NBC to ignore the naysayers and keep right on keeping on. I appreciated NBC's restrained responses to the critics of his work.What does anyone posting here think that right wing Justices in Alabama like Tom Parker and Roy Moore would do with birther claims of forgery regarding the whitehouse.gov PDF?

User avatar
Dr. Blue
Posts: 904
Joined: Sat Jan 07, 2012 10:01 am
Occupation: Call the doctor!

Dissecting the White House PDF

#16

Post by Dr. Blue » Sat Jun 22, 2013 5:19 pm

I don't mean to sound too harsh nbc - you've certainly done a lot of good things over the years - but this is really just silly, and gives the bizarre birther conspiracies about a "forged PDF" far more weight than they deserve (which is none).He's challenging falsehoods.Indeed, the artifacts in the Whitehouse document require an explanation, as they allow birthers to claim that the document shows evidence of forgery and fraud.Except I would contend that this is perhaps one of the most preposterous of their ridiculous claims. Maybe it's a background thing - I am an actual expert in data compression (not in document formats like PDF, but there are very few people who know the internals of JPEG as well as I do), and I look at the PDF and my reaction is that it's a perfectly normal PDF file, with nothing exceptional or even slightly suspicious about it.Perhaps I find the "lawyer discussions" on natural born citizenship to be more interesting, because that's not my background, so I'm learning new things. I look at all the "PDF is a forgery" stuff and think that it's all just a big waste of time.What settles it for me is that the JPEG contains a comment YCrCb which indicates that it uses luma/chroma color space, and the lack of any other metadata. This not only excluded many software but also led me to Xerox where I found the same string embedded as a comment. Note that the comment is not necessary for the JPEG to work.No, the comment is not necessary for JPEG to work, and in fact you generally won't find a comment like that in a JPEG file. As I said before, ALL JPEGs are YCbCr color space - that's just the way JPEG works. Backing out of the embedded JPEG, PDF objects often have a colorspace specification, so that's not very unusual either.While I was typing that, I had my laptop check PDFs on my system for a "YCrCb" tag - it found 12 different PDFs containing that. One was, in fact, a copy of Obama's LFBC that I have stored, but there were 11 others - and looking at them, I can tell you with some degree of certainty that none of those 11 were created on a Xerox machine.Oh and I also found, much to my surprise, that Xerox's PDF producer is identified as OS/X Quartz... Producer: Mac OS X 10.6.7 Quartz PDFContextI actually find that pretty hard to believe - are you looking at documents that were created by the Xerox machine and then were not processed further? I would think that's a sign that the PDF was post-processed on a Mac.

User avatar
Dr. Blue
Posts: 904
Joined: Sat Jan 07, 2012 10:01 am
Occupation: Call the doctor!

Dissecting the White House PDF

#17

Post by Dr. Blue » Sat Jun 22, 2013 5:37 pm

Oh, wait. I just looked - I see what you're saying now - the YCbCr string is actually in the embedded JPEG, not as a PDF tag. That is actually a lot more unusual - I apologize for misinterpreting what you said. A colorspace tag in a PDF really doesn't tell you much of anything about the source of the document. But as a JPEG comment it IS a little more significant. Now you've got me curious (damn you).

User avatar
nbc
Posts: 4228
Joined: Thu Mar 19, 2009 12:38 am

Dissecting the White House PDF

#18

Post by nbc » Sat Jun 22, 2013 6:09 pm

Oh, wait. I just looked - I see what you're saying now - the YCbCr string is actually in the embedded JPEG, not as a PDF tag. That is actually a lot more unusual - I apologize for misinterpreting what you said. A colorspace tag in a PDF really doesn't tell you much of anything about the source of the document. But as a JPEG comment it IS a little more significant. Now you've got me curious (damn you).Haha... Well, it reminded me of Kevin Vicklund's comments about Xerox work stations. So I looked more carefully at the information embedded within the PDF, inside the 'external objects' XObjects.This is where I found that:1. There are no 'exif' like headers, which are typically generated by software to include information of the tools used2. The quantization tables were identical, which is quite unusual3. The quantization tables suggest a compression of around 50%, quite hight4. There was an embedded JPEG comment tag which I also found in a Xerox Work Station PDF5. The presence of a single JPEG background image and many layers consisting of monochrome bitmapsEven the PDF format contains some hints as to the ordering of the data and the naming of the objects. But you are right, the PDF is a nightmare for forensics. There are additional features that I need to explore1. 8 bit alignment of the top and left side of the images2. The images in the PDF are rotated CW instead of CCW in the Whitehouse PDF3. The JPEG appears to be compressed at the same rate as the monochrome bitmaps4. No JBIG2 encoding, although I have found that any such coding is removed by Preview and the data are represented as a simple FlateDecode encoded streamSo I believe that with the right experiment we can at least identify the scanner, as a Xerox work station is highly likely. In addition, we may even narrow down on the actual model numbers as they need to support MRC encoding and JBIG2.Little steps but by going to the next encoding level of the data, I may have found some interesting hints.No, the comment is not necessary for JPEG to work, and in fact you generally won't find a comment like that in a JPEG file. As I said before, ALL JPEGs are YCbCr color space - that's just the way JPEG works. Backing out of the embedded JPEG, PDF objects often have a colorspace specification, so that's not very unusual either.The JPEG I found in the B&W/Greyscale Danish document shows another embedded string "grayLinear". The tables for Chroma are missing, so there are some interesting variations and from these we may be able to learn more about the software used.

User avatar
nbc
Posts: 4228
Joined: Thu Mar 19, 2009 12:38 am

Dissecting the White House PDF

#19

Post by nbc » Sat Jun 22, 2013 6:14 pm

Producer: Mac OS X 10.6.7 Quartz PDFContextI actually find that pretty hard to believe - are you looking at documents that were created by the Xerox machine and then were not processed further? I would think that's a sign that the PDF was post-processed on a Mac.I am 99% certain. I found it in the PDF from a Xerox Work Station as well as in the Danish PDF. The Whitehouse PDF was post processed by preview which added the masking layer and likely overwrote the Producer information as well. I will report further on this one as it is a minor mystery. What processor/OS do the Xerox machines use?

User avatar
Dr. Blue
Posts: 904
Joined: Sat Jan 07, 2012 10:01 am
Occupation: Call the doctor!

Dissecting the White House PDF

#20

Post by Dr. Blue » Sat Jun 22, 2013 6:41 pm

The JPEG I found in the B&W/Greyscale Danish document shows another embedded string "grayLinear". The tables for Chroma are missing, so there are some interesting variations and from these we may be able to learn more about the software used.OK, I should have said all COLOR JPEGs...I did notice the grayLinear in the PDF you had on your web site - it is pretty unusual to have color info like that in a JPEG comment field. I assume the other Xerox PDF that you're using for comparison has a color JPEG in it? I'll look through scanned PDFs that I have and see if any are interesting or relevant. Looking at the ones from my office copier, they all come out as bi-level images (no grayscale, and definitely no color). But surely someone has sent me a color scan in a PDF at some point, and I just have to find one.But that will be later - other things to do now. After chastising you for wasting your time with this, now you've got me curious so I'll go off and waste some of my time later... :D

User avatar
nbc
Posts: 4228
Joined: Thu Mar 19, 2009 12:38 am

Dissecting the White House PDF

#21

Post by nbc » Sat Jun 22, 2013 6:45 pm

Okay, I found a JBIG2 encoded B&W pdf which shows multiple monochrome bitmaps and the JBIG2 is converted to flatedecode. I now need to get a color background and text and off we go... So far so good :-)

User avatar
nbc
Posts: 4228
Joined: Thu Mar 19, 2009 12:38 am

Dissecting the White House PDF

#22

Post by nbc » Sat Jun 22, 2013 6:53 pm

I also think I figured out the producer tag showing OSX. As you suggested it comes from a tricky workflow.The Xerox Work Centre mails the pdf to your email address, on Mac you can open it in preview and then save it which of course enters the Mac Quartz as producer and keeps the Xerox Work Centre for the Creator. I hypothesize that printing it to PDF will generate the Preview as creator..Checking now:Yes, I figured it out... Lovely.Ok so we know the full workflow right now...Found a scan from the Xerox WorkCentre with the YCbCr. All it needs is some color in the document :-)

User avatar
Lani
Posts: 4726
Joined: Fri Nov 16, 2012 4:01 pm
Location: Some island in the Pacific

Dissecting the White House PDF

#23

Post by Lani » Sat Jun 22, 2013 7:22 pm

[anchor= goto=][/anchor]Why are you spending time on the White House pdf? Hawaii has confirmed that the information is accurate. End of story. Move along....Because I like minor mysteries and I believe that I may have figured out the work flow involved. Now even the compressed PDF has no evidence of forgery anymore...Call it intellectual curiosity that drives me to find a more reasonable explanation for the document. I believe I have found such evidence.I just found to be funny after all your years of devotion to the question of eligibility. Wrote the comment with a chuckle, not meaning to sound negative. I should have added a laffing icon. :lol: (Better late than never....) Yes, of course, people enjoy digging into all kinds of things out of curiosity and enjoy the hunt for answers. I will spare you the details of things that have tweaked my curiosity and the amount of research I have devoted to them.
Insert signature here: ____________________________________________________

User avatar
nbc
Posts: 4228
Joined: Thu Mar 19, 2009 12:38 am

Dissecting the White House PDF

#24

Post by nbc » Sat Jun 22, 2013 7:54 pm

I will spare you the details of things that have tweaked my curiosity and the amount of research I have devoted to them.:-) I know what you mean.

User avatar
PatGund
Posts: 7767
Joined: Fri Jan 23, 2009 4:41 pm
Location: Edmonds. WA
Contact:

Dissecting the White House PDF

#25

Post by PatGund » Sun Jun 23, 2013 12:31 am

I actually find that pretty hard to believe - are you looking at documents that were created by the Xerox machine and then were not processed further? I would think that's a sign that the PDF was post-processed on a Mac.Would make sense, particularly if the scanner outputted directly to the Mac.

Post Reply

Return to “Debunking the Lies”