Virtual Vacation: Sofia Santos OSINT Exercise #026
Hello everyone, today I am doing a write-up for Sofia Santos’ OSINT Exercise #026. This was a challenging yet exciting journey, so I hope you enjoy.
This write-up does not include the bonus challenges, and only answers the main task.
Here is the brief:
The image below shows the contents of a zip file. Inside you will find a 31-second video recorded during a train ride, and four photos of undisclosed locations. They were all taken by the same individual in February 2024. Despite having no useful metadata, they still contain enough information to track down this person’s movements.
Your task is to determine:a) At which train stations did the person board and alight?
FYI: this exercise also has bonus challenges, check them out!
Picture 1
First, all of the pictures were geolocated to help with determining the person’s movements.
The first picture looks like it was taken at a market. The most notable features of this picture are:
Street market goods in stands
Graphic with text
Wavy roof design with white tiles
Large building in the back with cylindrical towers on top
Reverse image search on Google yielded promising results. I came across this Chinese blog which contained pictures that match with the features in the source image. The same white tiling for the wavy roof are present and so are the graphics.
The blog entry says:
Time flows in the air at 42°
I am still sweating in the air mixed with mutton seeds and spices in Chorsu Bazaar Chusu Market (Dome Bazaar), also known as Dome Bazaar, is located in the center of the old city. It is the most famous farmers market in Tashkent.
Looking up Chorsu Bazaar on Google Maps confirms that this is where the source picture was taken. Other pictures uploaded at the location match the features of the source image, and the building with the cylindrical towers can also be seen.
Picture 1:
Chorsu Bazaar
Tafakkur ko'chasi 57, Тashkent, Tashkent, Uzbekistan
41.326735641899695, 69.2350639861194
Picture 2
Picture 2 has a Ferris wheel in the background and it looks like it was taken at an amusement park, or near an amusement park. There is a sign that says ‘Halva art café shop’, patterns on the wall, hanging lights and a chandelier.
Looking up ‘Halva art cafe shop’ on Google yielded good results. Images uploaded by users in the location contain the Ferris wheel, hanging lights, the patterns on the wall and also the Halva sign.
A better view can be seen of the relation between the Ferris wheel and the cafe. It can be confirmed that the person took the picture near the Halva art café shop.
Picture 2:
Near Halva art café shop -> улица Лабзак 12а/10, Тashkent, Tashkent, Uzbekistan
41.32617170423142, 69.26617377300757
Picture 3
Picture 3 contains many notable markers, including but not limited to:
A sign that appears to end with the letter ‘O’
Decorative arches in the building located at the far left corner of the picture
Steel heart patterns on the street
Bust stops, one with a Kapitalbank ad
Samsung sign
Green logo at the side of building
Decorative lights
Metro stop
Car rental
The approach I took with this was that I began from left to right in the picture. I decided to look at the car rental store more closely.
It can be seen that the lettering says “RENT A CAR” in capital letters. The colors for this company seem to be yellow and blue.
Considering that the previous two pictures were in Uzbekistan and also the fact that they were taken at the same day, it was very likely that picture 3 was also taken in Uzbekistan.
Through googling “rent a car Uzbekistan” I was able to find a car rental company that had a similar color palette. When I looked at their Instagram, I found that their store matched exactly with the one in the source image.
The signs match and even the arches in the building are the same.
When I went on street view mode near the car rental store, the street matched with the source image. The only difference is that it is not winter, so the trees are blocking some of the view.
Overall, the same two bus stops can be seen, the Samsung sign, the green logo on the side of the building, the metro stop, the red sign on the far left and the arches on the building on the far left.
Picture 3:
Near Samsung Sign and Orient Rent a Car store in Tashkent, Uzbekistan.
41°17'57.87"N
69°16'21.69"E
Picture 4
Picture 4 appears to have been taken near an overpass in a busy street. It can be seen that there is a parking lot and an elevated rocky section in the back with some structures. We can also conclude that the person is inside a car through the window reflection, so they are on a road. Here are some other notable details:
Ornamented street lights
Overpass railing with flower pattern
Gate with flowers in the center
Uzbek taxi (so we are still in Uzbekistan)
Tunnel built at the intersection of Bostonsaray and Rudakiy streets
Reverse image search on Yandex retrieved useful results. I came across a news report about new constructions in Samarkand, Uzbekistan.
As we can see in the picture retrieved from the news report, the flowery railings and the lamp posts in the background match the source picture.
The news report states:
President of Uzbekistan Shavkat Mirziyoyev returned from a visit to Samarkand region on February 10. During the visit, the head of state visited a number of facilities […]. The next destination was the tunnel built at the intersection of Bostonsaray and Rudakiy streets in the region. The tunnel is 120 meters long and 27 meters wide. A car and tramway, pedestrian and bicycle lanes have been built on Rudaki Street.
I found the intersection on Google maps and thought that maybe if I followed the road that had the same lamps I would find the location where picture 4 was taken. However, that was not the case. These lamps are only present for a small section of the road and then another type of lamp design is present.
Then I turned to testing my theory:
Cities often have a cohesive architectural style, if these railings and lamp posts are present in Samarkand overpasses, it is likely that they will be present again in another overpass in the city. It is safe to assume that there is a possibility that picture 4 was taken in Samarkand based on the nature of the exercise, since the person is going from point A to point B. Also, taking into account that all other pictures have been taken in Toshkent, it is realistic that one of the ways to confirm in which city the person boarded or alighted in, would be that one of the pictures was taken in a different city.
I then turned to the fact that in the background, we can see rocky elevated terrain. I looked for something in Samarkand that could fit the background of picture 4 and came across these two rocky elevations. Since the rest of the city is relatively flat, the overpass was most likely near one of these rock formations.
I started to look at all of the overpasses that had a parking lot nearby surrounding the smaller rock elevation and checking with street view. Through this I was able to find a match with the source image.
This overpass that goes over Shah-i-Zinda St. is called Siyab Bridge. The rocky formation in the background can be seen, the same design for the flowery railing and decorative lamps are present. Also, we can see that there is a parking lot in the back with a gate containing flowers in the center separating it from the street. Even the peeled off posters in the pillar have a close resemblance to the source image. The person in picture 4 was on the other side of the street going the opposite direction.
Picture 4:
Below Siyab Bridge in Shah-i-Zinda St. Samarkand, Uzbekistan.
39°39'53.41"N
66°58'48.35"E
Summary
The pictures were taken in two different cities in Uzbekistan, Samarkand and Tashkent.
Where were they going?
Based on the source video and the direction that the train was facing, I hypothesize that the train was likely headed to Samarkand. However, it is best to be absolutely sure and double-check.
Through the Uzbekistan train timetable, we can get more information about the train system in the country and get a notion of the frequency of trains going to Samarkand from Tashkent. We can see that the train rides can be done in just a few hours, further reinforcing the fact that the person was in Samarkand and Tashkent during the same day.
The map of the train routes in Uzbekistan is going to serve as a reference to aid me in pin-pointing the location in the video to confirm the direction in which the person was going.
The journey
The source video contains many pointers as to the location in which the video was recorded. We can see that the video is recording a city or village based on the amount of buildings. It is in a mountainous region as well, we also have what looks like two gas stations next to each other separated by a train and car intersection.
I began by following the train tracks from Samarkand to Tashkent and took into account any mountains present on the right side of the track (when facing Samarkand). I tried to rely on Google’s landmarks labels to see if I could find the two gas stations. However, that did not work as the gas stations are not labeled on Google.
As an alternative, I went through the sections in the tracks that had mountains and man-made structures nearby and looked for car and train intersections that had two square or rectangular structures in each side (indicating the gas stations).
I came across an intersection that matched the one in the video. Two rectangular structures can be seen, with a road separating them. The little house on the deviated path is present, we can also see the small details on the red roof as well. If we count the trees in the circled space we get the same number as well with similar sizes.
It can be seen that this section of the train track is an exact match with the section filmed in the video. This video was recorded in the Jizzakh region in Uzbekistan.
The approximate coordinates are:
Start of video - 40° 5'50.56"N 67°48'24.31"E
End of video- 40° 5'51.52"N 67°47'35.22"E
Based on the start and end point of the video, it can be confirmed that the person was headed to Samarkand.
Where did they board and alight?
Tashkent has two major train stations a southern and main station, so we first need to define in which train station the person boarded in.
The train went a distance of around 1.15 km in about 0.51 mins.
0.51 mins -> 1.15 km
60 mins -> 135 km
If we do the rule of 3, x= 135 km/h. So the train was going around 135 km/h
In Uzbekistan there are three types of trains:
-Afrosiyob
-Sharq
-Sleeper
The Afrosiyob high speed train has an average speed of 140 km/h and the Sharq train has a maximum speed of up to 140 km/h. The slowest train is the sleeper one, with a maximum speed of 90 km/h.
I wasn’t able to find the average speed of the Sharq train, but taking into account that often trains do not go at their maximum speed limits, it is likely that the average speed of the Sharq train will not be its maximum speed of 140 km/h.
It is very probable that the person was on the Afrosiyob train.
From the information provided across the web, the Afrosiyob train only departs from Tashkent’s main railway station.
We can also confirm that two people (person 1, person 2) who made videos about traveling in the Afrosiyob boarded in the Tashkent Main Railway station as opposed to the southern one.
Tashkent Main Railway Station, Toshkent Shahri, Uzbekistan - 41.29137246124618, 69.28695395767899
Samarkand only has one train station, so the person alighted there:
Samarkand Train Station, Samarqand Region, Uzbekistan - 39.68551803897664, 66.92898094422375
a) At which train stations did the person board and alight?
The person boarded in Tashkent Main Railway Station - 41.29137246124618, 69.28695395767899 - and alighted in Samarkand train station - 39.68551803897664, 66.92898094422375 -
…and with that we conclude OSINT Exercise #026, this was such a fun challenge and I am looking forward to taking on others as they come!
Peace and love.
