Geolocation: OSINT Exercise #026 from Sofia Santos
This is a write-up for Sofia “Gralhix” Santos’ OSINT exercise #026. The goal of this exercise is to use the four pictures below and one video to answer several questions:
- At which train stations did the person board and alight?
- What is the mode of transportation in each image?
- What is the type of train they rode?
- What is the speed at which the train was traveling when the footage was recorded?
- Approximately how far did the person travel overall?
This goal of this article is to show you how to geolocate the places shown in each file, using different tools and methods. The files are sorted by difficulty, with each methods and locations listed in bold. After locating the files, we will focus on answering the questions.
Starting material
Helva Art Café Shop — Easy
Method: Google Maps
The first thing that jumps out in this picture is the wooden sign with the word “HALVA” written on it. After zooming on the sign, we can see that it reads “HALVA Art café shop”.
A quick search on Google Maps gives us only one results: a store in Tashkent (Uzbekistan). A white Ferris wheel can be spotted a 100m south of it, matching the one in the picture’s background.
Given the location where that picture was taken (pedestrian area) and the type of street in the picture, we can assume that this picture was taken by someone walking.
Location of the picture: 41.326065, 69.265462.
Chorsu Bazaar — Easy
Method: Reverse Image Search
After loading the picture in Chrome, Google Lens matches it to the Chorsu Bazaar in the same city as the first picture: Tashkent (Uzbekistan). Unfortunately Google Street Views is not available there, to confirm that this is the correct location, we can search for social media post of the place: this YouTube vlog shows the same ads and white arches as seen on the picture.
Given that the exercise’s picture is taken from an elevated point of view, we can assume that the photograph was standing on the stairs entering the main building of the bazaar. This also aligns nicely with the building in the background behind the lamppost. The person was walking when taking the picture.
Location of the picture: 41.326295, 69.235048.
Subway entrance — Medium
Method: Overpass Turbo
This is the first picture in this exercise which is not trivial to geolocate: reverse image search did not give any useful results and neither did googling elements of the pictures such as the Samsung Galaxy sign.
Looking at the picture we can isolate two useful features for geolocation: two bus stops and a metro station. After a quick google search, it appears that the red sign adorned with a white “M” matches the logo of Tashkent’s metro. This narrows it down but there are more than 50 metro stations in Tashkent, we have to reduce the number of places to check.
This is where Open Street Maps comes in: we can use it to query places in Tashkent that fit the following description: a metro entrance near a bus stop. If. you want to learn more about OSM and Overpass-tubo.eu, read this great three part tutorial from Nixintel.
After positioning our bbox over Tashkent, we can run the following query on overpass-turbo.eu:
[out:json][timeout:25];
// store all subway entrances in subway
(nwr["railway"="subway_entrance"]();)->.subway;
// store all bus stops in busstop
(nwr["highway"="bus_stop"]();)->.busstop;
// keep only subway entrances that are 30m or closer to a bus stop
nwr.subway(around.busstop:30);
out geom;
This gives us the following 13 results:
After inspecting them, only one location matches our picture. Using Google Street View, we can confirm the location:
The same railing, the same partial red sign in the top left corner and of course our bus stops with the nearby subway entrance.
Given that the picture was taken on a road, we can assume that the photograph was in a car or a bus.
Location of the picture: 41.299362, 69.272522.
View from the train — Hard
Method: Overpass Turbo + Suncalc
For this video, we need to think about the context: the images we are analyzing seem to be from someone’s camera roll. They are titled like a digital camera would name images: incrementally. Thus, this video, IMG_2677, has been taken after the three images we already localised: IMG_2597 (Chorsu Bazaar), IMG_2626 (Halva Café) and IMG_2658 (Subway entrance). It would stand to reason that the train this person took departed from Tashkent.
If we take a look at a map of the railways in Uzbekistan, there are 4 railways leaving Tashkent:
Now, let’s consider the following screenshots from the video:
Two crucial piece of information are on this picture:
- The sun is on the left of the screen, behind the train.
- There are mountains in the background.
While keeping the position of the sun in mind, let’s go to suncalc.org:
This shows that the train was likely traveling southwest, thus using railway number four on our map. The next major city along that railway is Samarkand. Looking at this region on Google Earth, only the last third of the itinerary (circled in red below) seems to have the kind of mountainous landscape seen on the video.
We now have narrowed it down to an area small enough to use overpass-turbo.eu, we just need to find distinctive features. Still using the same screenshot, we can make out what looks like a gas station (could also be a filling station for natural gas). Let’s use Overpass turbo to search for a railway that has a gas/filling station nearby.
[out:json][timeout:25];
// store fueling amenities in fuel
(nwr["amenity"="fuel"]();)->.fuel;
// store railway ways in railw
(nwr["railway"]();)->.railw;
// keep elements in fuel that are 50m or closer to a railway
nwr.fuel(around.railw:50);
out geom;
This leaves us with 3 possible location near Jizzax (the Samarkand results are too close to the city to match). After a quick inspection with Google Earth, we find the location. Unfortunately, there are no Google Street View to confirm this. Here are some element that are easy to spot from a satellite view that match the video:
Location of the picture: 40.097460, 67.803247.
Overpass — Hard
Method: Overpass Turbo
So far here is what we know: this person visited Tashkent then took the train towards Samarkand. They might have disembarked there or might have gone further. Given the fact that there is a taxi in the image and a large overpass, we will assume they are in a large city. We can then use overpass-turbo.eu in the same manner: identify specific features and build a query to isolate them on the map.
The bridge is an obvious feature that we should include, something more subtle would be the crowd in the background: lots of people waiting, some of them carrying large bags. This hints at public transport. After a bit of research Samarkand seems to have two main public transport: tram and bus. With that said, we can build the following query:
[out:json][timeout:25];
// gather all bridges in the bridges set
(nwr[bridge]();)->.bridges;
// gather all bus stops and tram railways in public_transport
(
nwr["highway" = "bus_stop"]();
nwr["railway"="tram"]();
)->.public_transport;
// get all bridges that are 50m or less from an element of public_transport
nwr.bridges(around.public_transport:50);
out geom;
We only have 3 results on the entire city. Using Google Street View, we can identify the correct location. Please note that this picture was captured in May 2024 according to Google Maps, which would explain the railings on the median (absent in the exercise’s picture).
To determine which vehicle was used is a bit more tricky, there is a window reflection in the top right corner, thus this person is not walking. Although there are tram tracks nearby, they stop before getting close enough to the bridge. This leaves us with two possibilities: car or bus. Given the shape of the seat seen in the reflection, a bus seems more likely. As the picture was taken closer to the ground, maybe a minibus.
Location of the picture: 39.665003, 66.979783.
At which train stations did the person board and alight?
We know that this person visited Tashkent then took the train to Samarkand. According to Uzbek Railways’ schedule, there are two train stations that could be the start of a journey to Samarkand (САМАРКАНД): ТАШКЕНТ Ц or ТАШКЕНТ ЮЖ. One key difference separates them: all the earliest train to depart from ТАШКЕНТ ЮЖ leaves the station at 14:20.
Let’s remember what we know from the video: the sun was behind the train. If we use suncalc.org, and carefully select the date and time, we see a train passing at 14:20 would have had the sun in front of it.
This means that the train from which the video was taken, left the station before 14:20, thus it left from ТАШКЕНТ Ц (41.291364, 69.286933). As for where they alighted: there is only one train station in Samarkand according to Google Maps and Uzbek Railways’ schedule (39.685484, 66.929131).
The person boarded their train at ТАШКЕНТ Ц and disembarked at the Samarkand train station.
What is the speed at which the train was travelling when the footage was recorded?
Now that we know where the video was taken, we can easily determine where it begins. The first image shows this location: 40.097428, 67.806656.
While the last image shows this location: 40.097675, 67.793114. Using Google Earth, we can measure the distance between the two locations which gives us 1.16 kilometer.
Since we know the video is 31 seconds long, we can proceed with the formula: speed = distance / time, we can determine the speed to be approximately 37.41 m/s (134.7 km/h or 83.7 mph).
What is the type of train they rode?
Fortunately for us, the Wikipedia page for Uzbek Railways lists the different model of passenger trains currently operated by the company: ER9E, ER2 and Talgo 250 (also named Afrosiyob). According to its Wikipedia page, ER2 maximum speed is 100 km/h which disqualifies it. We are left with the older ER9E or the modern high-speed Talgo 250. Several other pages also mention a third type of train: Sharq trains (rome2rio.com and this travel agency), to complicate things, it also has a suitable speed: 160 km/h.
The speed of the train from the video would match the ER9E, which has a speed of 130 km/h, roughly the same as what we deduced. However, this is not a definitive proof, since a high speed train like the Afrosiyob would likely have decelerated near a residential area like Jizzax, which is located near the area where the footage was taken.
I did not manage to find a definitive answer to that question.
Approximately how far did the person travel overall?
Now that we have the location and order of all the different places we know this person has visited, we can simply add the distances between all of them:
- Chorsu Bazaar to Halva Art café shop: 3.5 km on foot according to Google Maps.
- Halva Art café shop to Tashkent train station: 5.3 km by car. The itinerary proposed by Google Maps passes by the location of the subway entrance picture.
- Tashkent train station to Samarkand train station: 328 km. I could not find any information online about the length of that journey. Fortunately, Google Earth allowed us to manually create a path following the train tracks from Tashkent to Samarkand then calculate the length of this path.
- Samarkand train station to the overpass: 5.2 km. Using Moovit to list the bus lines going from the train station to that bridge, we find four lines doing the same segment (ignoring the other lines as they take a detour). According to Google Earth, this segment is 5.2 km long.
This gives us an approximate traveled distance of 342 km.
I hope you enjoyed this article, it’s the first piece of content focusing on geolocation I ever wrote; given how much fun I had, I hope it will not be the last.