Images and videos have become some of the most valuable sources of intelligence in modern investigations. Every photograph, screenshot, or video clip contains layers of information beyond its visible subject. Locations, timelines, behaviours, relationships, and environmental clues can often be extracted through careful analysis.
Image and video forensics is not primarily about specialised software. It begins with observation, critical thinking, and a structured methodology. Investigators who develop these skills can often uncover significant insights using visual evidence alone.
The case: the "He will not divide us" flag
One of the most famous examples of community-driven image and video forensics occurred in 2017 during actor Shia LaBeouf’s art project, “He Will Not Divide Us.”
After repeated disruptions at previous installations, a livestream was set up showing only a flag flying against the sky. The location was intentionally kept secret. Members of online communities, particularly users on 4chan, collaborated to determine the flag’s location using open-source intelligence techniques.
So how did the community crack the case with the information they had?
Looking beyond the subject
The first mistake many investigators make is focusing exclusively on the main subject of an image or video. Effective visual analysis requires examining the entire scene.
Every image contains multiple layers of information:
- Foreground elements
- Background details
- Environmental conditions
- Human behaviour
- Technical characteristics
- Contextual clues
A photograph of a person standing in front of a building may reveal far more than the individual. Street signs, architectural features, weather conditions, vehicle registrations, business names, and even shadows may provide valuable intelligence.
In practice:
When analysing visual media, perform multiple viewing passes:
- Examine the primary subject.
- Examine the background.
- Examine objects and environmental features.
- Examine people and interactions.
- Examine temporal indicators.
- Examine technical characteristics.
Each pass should focus on a different category of information.
Geo-Location through visual cues
One of the most valuable applications of image forensics is determining where media was captured.
Geo-location rarely depends on a single clue. Instead, investigators assemble multiple indicators that collectively identify a location. Potential geo-location indicators include:
- Street signs
- Road markings
- Building architecture
- Storefronts and business names
- Public transportation infrastructure
- Utility poles and power lines
- Natural landmarks
- Vegetation and terrain
Environmental Analysis
Different regions often exhibit unique characteristics:
- Architectural styles
- Road signage standards
- Vehicle types
- Public infrastructure designs
- Local languages and dialects
Even seemingly insignificant details can narrow the possible location dramatically.
In practice:
Avoid searching for exact locations immediately.
Instead:
- Identify broad geographic indicators.
- Narrow to country or region.
- Narrow to city or district.
- Confirm through multiple independent visual features.
Temporal analysis: determining when the media was created
Establishing when an image or video was captured is often as important as determining where it was captured. Temporal indicators may include:
- Weather conditions
- Seasonal vegetation
- Holiday decorations
- Construction progress
- Clothing lines
- Event-related signage
- Vehicle models
Shadow Analysis
Sunlight and shadows can provide valuable temporal information.
Investigators may analyse:
- Shadow direction
- Shadow length
- Position of the sun
These observations can help estimate:
- Time of day
- Approximate season
- Potential geographic region
In practice:
Create a timeline of all observable temporal indicators. Rather than relying on one clue, combine multiple indicators to establish a probable timeframe.
Behavioural intelligence from visual media
People often reveal more through behaviour than through direct statements. Images and videos provide opportunities to observe:
- Social interactions
- Group dynamics
- Emotional states
- Organisational structures
- Security practices
Indicators to consider
In practice:
When analyzing group photographs or videos, map interactions and positioning rather than focusing solely on identities. Physical proximity often reveals relationships that are not immediately obvious.
Verifying authenticity
Not every image or video accurately represents reality. Visual verification involves identifying inconsistencies that may indicate manipulation, misrepresentation, or deception. Potential indicators include:
- Inconsistent lighting
- Distorted shadows
- Perspective anomalies
- Unnatural reflections
- Abrupt scene transitions
- Missing contextual information
Context verification
Authentic media can still be misleading.
Investigators should verify:
- The claimed location
- The claimed date
- The claimed participants
- The surrounding circumstances
A genuine photograph presented with a false narrative remains misinformation.
In practice:
Separate two questions:
- Is the media authentic?
- Is the accompanying claim accurate?
Both questions require independent verification.
Video analysis techniques
Video offers additional opportunities for intelligence gathering because it contains movement, sound, and sequencing.
Investigators can analyze:
- Movement patterns
- Speech and language
- Environmental audio
- Vehicle traffic
- Crowd behaviour
- Event progression
Frame-by-frame analysis
Important details often appear only briefly. Examining individual frames can reveal:
- License plates
- Signage
- Faces
- Reflections
- Screens and devices
- Background activity
Audio as intelligence
Audio frequently contains overlooked clues:
- Accents and dialects
- Background conversations
- Transportation sounds
- Church bells
- Emergency vehicles
- Public announcements
These elements may help establish both location and context.
Corroboration and cross-referencing
Visual evidence should rarely stand alone. Effective investigators compare observations against:
- News reports
- Public records
- Social media content
- Satellite imagery
- Historical photographs
- Other witness media
Corroboration strengthens confidence and reduces the risk of misinterpretation.
In practice:
Treat every visual clue as a lead rather than a conclusion. Seek independent evidence that confirms or contradicts each observation.
Avoiding analytical pitfalls
Visual analysis can be vulnerable to cognitive bias. Common mistakes include:
- Seeing what you expect to see
- Focusing on a single compelling clue
- Ignoring contradictory evidence
- Assuming context without verification
- Overstating confidence
Best practice
Document:
- What is directly observable
- What is inferred
- What remains unknown
Separating observation from interpretation helps maintain analytical integrity.
From visual evidence to actionable intelligence: the "He will not divide us" flag investigation
The ultimate objective of image and video forensics is to transform visual observations into intelligence that supports decision-making. The “He will not divide us” investigation is a direct example of the techniques we have seen so far.
Investigators had almost no obvious clues. The livestream showed:
- A flag
- The sky
- Aircraft occasionally passing overhead
- Sounds from the environment.
Despite this limited information, the community identified the location by combining multiple observations.
Contrails and flight paths
The direction of aircraft and contrails provided clues about air traffic corridors, relative camera orientation, and possible locations beneath those routes. No single aircraft identified the location, but multiple observations reduced the search area.
Star pattern analysis
At night, stars became visible in the livestream. Investigators compared visible constellations, star positions, and astronomical software predictions. This helped estimate the camera’s geographic latitude and orientation.
Environmental sounds
Listeners reported hearing animal noises and rural environmental sounds. These clues suggested the flag was located in a relatively remote area rather than an urban environment.
Sunlight and shadow analysis
Observers tracked sunrise and sunset timing with shadow movement and sun position. These observations further refined the probable location.
Cross-referencing maps
Once the search area had been narrowed, investigators examined satellite imagery, rural roads, open fields, and Potential flagpole locations. Eventually, the exact location was identified and physically verified.
The “He Will Not Divide Us” investigation demonstrates how seemingly insignificant details (aircraft, stars, shadows, and environmental sounds) can be combined to solve a complex geo-location challenge. By learning to examine visual media systematically, investigators can uncover hidden details, validate claims, reconstruct events, and generate actionable intelligence from sources that many observers would overlook.