Introduction

Link: https://gralhix.com/list-of-osint-exercises/osint-exercise-009/
Difficulty:

For beginners: a) Hard, b) Hard  
For experts: a) Medium, b) Medium

Briefing:

The video below was shared by the Visit Tirana Twitter account on February 16, 2023.  

Please answer the following questions:  
a) To the best of your knowledge, at what time was the video recorded?  
b) Find the coordinates of where the person was walking at the time of the recording.  

(In the event that the tweet gets deleted here is the [saved](https://www.youtube.com/shorts/axC30cE_O-4) video and a [screenshot](https://gralhix.files.wordpress.com/2023/02/tirana-screenshot.png) of the tweet)

Attachment:

Link to the video (reupload by Gralhix): https://www.youtube.com/shorts/axC30cE_O-4

---

Solution

In this series of exercises, this is the first time we play with a video.
A video is just a lot of images added together. So the techniques are almost the same as for images.
But there is also (sometimes) an audio that could lead to further clues and research. In this case, the audio is just a song so it won’t be useful.

From the briefing, we know it is a Twitter post by "Visit Tirana". So it is very likely to be an account related with tourism in Tirana (Albania). We can confirm the country with the hashtag #Albania used in the publication.

The account shared this video on February 16, 2023. So the video was filmed the same day or prior to this date.

The video maker is also credited in the post: Eriseld Myrto

The video shows a sunset in Tirana. We know the location and the date (and even the publication time).
We can try to find when the sunset took place at this date: https://www.timeanddate.com/sun/albania/tirana?month=2

The Twitter account posted the video at 10:07 PM (22:07) but it was already the night so the video was filmed several hours before the post (if we consider that the video was filmed on the same day).

We can try to visualise the video to identify the exact time by looking at the shops which could have the time shown on their storefront but this is unsuccessful.

Let’s try to find more information about Eriseld Myrto:

https://www.instagram.com/four_s34sons/

We found his Instagram account. Maybe we can find the video on it (remember the date where the Twitter post was made):

Here is the original post on Instagram: https://www.instagram.com/p/CouwRhAjsQ6/

We have the date but not the details. To find that we can either go to the source code and look for "datetime":

Or use Javascript to automatically convert all horrible dates and "Xw ago" into real date values. This can be done with an extension such as [Greasemonkey] (Firefox) or [Tampermonkey] (Chrome).
Then go to https://github.com/LBreda/Instagram-explicit-date/blob/master/Instagram_explicit-date.user.js and install the JS script.

If you want to be more precise on dates, you can modify the line 19 to show seconds.
From:

item.textContent = date.toLocaleString(getLang(), {day: 'numeric', month: 'short', year: 'numeric', hour: 'numeric', minute: '2-digit'});

To:

item.textContent = date.toLocaleString(getLang(), {day: 'numeric', month: 'short', year: 'numeric', hour: 'numeric', minute: '2-digit', second: '2-digit'});

Then reload Instagram and you’ll be able to see the dates in a pleasant format:

This is also possible to view the date when comments were posted by clicking on it. But this is not that stable and sometimes you’ll need to refresh the page or retry more than once.

Careful with the timezone! The script takes your browser’s language setup to determine the timezone. So you may want to modify the previous line 19 to add a custom timezone:

item.textContent = date.toLocaleString(getLang(), {timeZone: 'UTC', day: 'numeric', month: 'short', year: 'numeric', hour: 'numeric', minute: '2-digit', second: '2-digit'});

As you notice, in the previous screenshot, the video was posted at 16:48 which is several minutes before the sunset.
In the video, we can’t see the sun and the rays are orange which means the sunset is coming any minute now.

This matches with the sunset time at 17:15 we saw previously.

Now we must find the coordinates.

We already know the video was filmed in Tirana, Albania.

A bike path (red) is identified and is in the middle of two roads. This could mean this is a main road or that we are in the city center.
On the left there are several green lights (blue) which could be linked to pharmacies or traffic lights.
There are also two buildings (yellow and purple) pretty recognizable once will find the location to confirm it.

The sunset is always in direction to the west, while the sunrise is from the east.
Thanks to this information, we know the road goes to the west.

Using Google Maps, I identified some roads going to the west:

I also found a website that uses OSM (OpenStreetMap) to identify all bike paths in Tirana: https://www.cyclosm.org/#map=14/41.3309/19.8259/cyclosm

By mixing these two maps, only some roads remain. It is then easy to look for each one with Street Maps to identify elements that could match the video:

Not the correct location. There is something between two roads but this is a river, not a bike path.
Next location!

Once again, not the location we are looking for…

Next one:

Here we have something that could be similar to the video. In the middle of the two roads there is a sidewalk but we can’t determine if it is a bike path. There are bushes and trees all along the path as in the video.

The street view is from 2016 so the look could have changed in 7 years.

By searching the street name on Google Images:

This is indeed the correct street. In the website we learn that the photo was taken in 2020.
Go back in Street View. After some time moving around the street, if find a potential candidate:

From the video:

We can also see the multiple pharmacies in the background.

---

Flag

a) Around 16:48
b) 41.326933, 19.807273