Finding McAfee: geolocation and imagery analysis

Identifying past, current, and possible future locations through the geolocation and chronolocation of media provided by a specific user.

This case study is based on a challenge from well-known entrepreneur, John McAfee, to show how relative geolocation of two points on a chronological timeline can give a likely path and possible locations in between.

To do this, two geographical points will be used, categorised by day, to geolocate a photo that was taken between those two points.

This research post is split into the following four sections, in this order:

• Point B (the photo to geolocate)
• Point C (where the subject is traveling to)
• Point A (where and when the subject started the journey)
• Geolocation analysis of the Point B image

The tools in this case study are completely free, so please do use them to follow along. I used Google Maps, GIMP (image editing) and Twitter.

Point B: the image to geolocate

Below is the tweet in question. The challenge: self-explanatory.

So where do you start in a case like this? Using a first approach to imagery intelligence (IMINT), look in the image and ask: "what do I see?".

In the image, we have a number of clues that may indicate where this photo was taken. I am going to number some of them in the image below.

What do we see here?

• First, we have got McAfee. Who through his accounts may help give more clues. I will get to him later.
• This roof colouring gives an indication that it might be a brand colour.
• Coloured fuel bowsers indicate that this is both a fuel station, and is a unique identifier for what the brand or name of the fuel station may be.
• Large trucks use this fuel station, so it is likely that it is in an open area, or along a highway.
• There are flowers in front of the building McAfee is next to, which means it might be a store for the fuel station.
• There is a light blue band along the horizon. This is usually synonymous with a large body of water.
• This post and building would be a unique identifier on satellite imagery.
• The horizon is not cluttered with buildings or trees, indicating it might be a flat plain and out of built-up urban areas.

That is a lot of reference points we have to go off. And now, since we have done an initial imagery analysis checklist, we can work our way down that list to investigate each of those leads.

First is John McAfee. He is likely to indicate relevant information in his social media.

Point C: where the subject is traveling to

In the initial tweet above the subject indicated he was "on the way to London" and that the photo was taken in the past. This identifies our destination.

How is he traveling there? Considering the location of the photo as we analysed in the eight takeaways above, it is clear he is at a service station with his large security crew. So it is likely he is driving to his destination.

Point A: where and when the subject started the journey

Where did the subject come from?

This is where we can start using the intelligence tool I would like to refer to as "geoprofiling". Essentially we are going to map out a short chronological timeline of where McAfee was in order to find where he is.

Scrolling back through his Twitter timeline, we can find this tweet. It was posted two days before the other photo.

What is important about this tweet is it gives us a location as well as a destination. Take a look in the red box in the right of the image below.

It is in Munich, Germany.

We know this is the place where the photo was taken as there are a number of features that match those seen in geotagged images on Google Maps and Facebook.

First is the identical match of the sign and wall lining to this one found on Google Maps.

Second, for further verification, we can identify both the sign and the white paint on the ground from this image on the Hotel Schlicker Facebook page.

For chronolocation, for the purposes of this post there is no necessity to conduct a shadow calculation. Merely being able to plot this geolocated image on our timeline gives us an original lead for the following reference points:

• Hotel Schlicker in Munich, Germany on January 26, 2020
• The unknown point in between
• London, at a future point in time

Why is the second point unknown? Because that is the initial location we need to find. And we are going to do that now.

Geolocation analysis of the Point B image

We already know two things about the image. It was taken on the road between Hotel Schlicker and London.

Using Google Maps "direction" feature we can make a simple indication of the route between those two points.

That is a lot of empty space to cover. But we have a list of eight points we can use to filter that information down.

First, what is the place they stopped at in the image? The features of the roof and fuel pumps will help with that. Those features are something we can use in a Google Search term. For this, I used what we know and what I see in the following string search for Google Images:

• It is likely in Europe, so that is a term I used: "Europe"
• "Fuel Station"
• "Red and White"

We also have blue bowser pumps in the image, and some of the results have that. The features in the photo match those pictured in Google Images as an Esso Petrol Station.

Now we can search for "Esso" in Google Maps to find any Esso fuel stations on the way from Munich to London.

To further refine our search area, looking back at the eight points, the photo was likely taken near a body of water, possibly in an open area or out of a city, and along a highway. In looking at places where there is a main road near a large body of water I identified two possible locations on the route.

To layer both the location of Esso petrol stations and the routes to London, I used photo editor GIMP to layer the two images, changing the transparency of one of them. There are alternative ways using KMZ points, but this one is also quite simple and keeps Google Maps as our main operating tool.

One of these stations along the route is near a body of water. It is near Baden-Baden. It satisfies a number of the indicators we are after, such as water, main road, quiet area and an Esso station on our route.

We can start to match this location with the Point B image to see if it fits the fingerprint of what is visible on the Google Maps satellite image.

Using all of the information derived from geolocating objects in the image, we can say, for certainty, that the photo was taken here.

Further verification can be made by matching the Google Maps embedded images. However, for the purpose of this case study, the indicators seen in the photo are uniquely matched to the satellite image therefore giving a stronger level of geolocated evidence.