A timestamp on a tweet is a claim. The shadow under the burning building isn't.
Chronolocation is the OSINT discipline of pinning down when a photo or video was captured — without trusting metadata, captions, or the source. EXIF strips on every social upload. Dates lie. Captions lie harder. What doesn't lie: the angle of the sun at 14:37 in Kharkiv, the METAR from the nearest airport, the leaves on the linden tree, the scaffolding around city hall that came down on a permit-stamped Tuesday. Chronolocation extracts a timestamp from those signals when no machine-readable timestamp exists — or when the one you've been handed is garbage.
This is not a thought experiment. It's the verification spine of every serious investigation Bellingcat publishes, the technique that Sector035 codified into the canonical guide, and the reason coverage of the war in Ukraine — particularly Bucha and Mariupol — survived contact with state-level disinformation. If a phrase like "this video is from yesterday" lands in your inbox, chronolocation is what tells you whether to believe it.
Step one: kill the metadata first
Before doing anything clever, run the file through ExifTool. Half the time the question is already answered: the camera has burned a UTC timestamp, lens, and GPS coordinates straight into the file. The other half, the EXIF is stripped, edited, or wrong because the user shoots in JST while traveling through CET. FotoForensics handles the next tier — error level analysis, clone detection, signs the image has been spliced or generated. If your image is a synthesis, no amount of shadow math will save you.
Treat any surviving timestamp as a hypothesis, not a fact. People forget to update their clock when they cross time zones. Cameras drift. Phones default to "auto" and pick up the wrong network time at the border. Forensic OSINT guides treat EXIF as corroborating evidence only — and they're right.
Sun and shadows: the workhorse
The single most powerful chronolocation primitive is shadow geometry. Two angles — solar azimuth (compass direction the sun is in) and solar elevation (height above horizon) — uniquely fix the position of the sun for a given latitude, longitude, date, and time. Reverse the equation: known location + observed shadow direction = time of day. Bellingcat's tutorial walks through the geometry step by step.
The standard tool is SunCalc.org. Drop a pin on the lat/lng, scrub the time slider, watch the yellow line (sun direction) and orange line (shadow direction) sweep across the map. Match the orange line to the shadow in your image, freeze the slider, read the time. With a clean reference object — a lamp post, a building corner, a soldier standing still — you can typically nail time-of-day to a 15-minute window.
If location is unknown, Bellingcat's Shadow Finder Tool (released August 2024) inverts the problem. Feed it the height-to-shadow ratio and a UTC timestamp; it draws a band across the globe where that ratio could occur on that day. Combine with continental priors — language on signage, vehicle steering side, plug shapes — and you've cut the search space by 99%.
Other useful weapons in this category. Stellarium handles night sky work — moon phase, visible constellations, planet positions. Photographers' apps PhotoPills and ShadowCalc do precision casework with augmented-reality overlays. Wolfram|Alpha computes "sun position Kyiv 2025-03-12 14:30 local" without a UI. TimeAndDate.com is the catch-all reference — sunrise, sunset, civil twilight, eclipses, all queryable by date and place.
Two limits worth memorizing. Accuracy collapses near solar noon — the shadow is shortest, azimuth changes fastest, small measurement errors blow up. And atmospheric refraction shifts apparent sun position by up to 0.5° near the horizon, so sunrise and sunset frames carry larger error bars than midday ones.
Weather: the date killer
Sun fixes time-of-day. Weather fixes the date. METAR archives — the structured, hourly weather observations every commercial airport in the world transmits — are the gold standard. Each METAR record carries temperature, dew point, wind direction and speed, visibility, cloud layers, and present weather (rain, snow, fog, thunderstorm). Cross-check what you see in the photo against the METAR for the nearest airport on the candidate date. Wet pavement in your image, dry sky in the METAR? Your hypothesis is dead.
Ogimet hosts METAR archives back to 2005 for most stations, queryable by ICAO code, with a 365-day request limit per query. Weather Underground still surfaces daily summary pages when raw METAR isn't enough — and used to mirror METARs directly until they restricted it. WeatherSpark visualizes long-term climate patterns and is brilliant for sanity-checking absurd date ranges (heat-haze in February over Murmansk? unlikely). AccuWeather and Tropical Tidbits cover specialized cases — tropical systems, blizzards, named storms.
Weather corroboration is binary. The photo either fits the METAR or it doesn't. There is no "mostly matches." Fog at 06:00 UTC + fog in the frame = corroboration. Light rain in METAR + dust on the windshield in the frame = contradiction. Treat it as a hard filter.
Foliage and seasonal markers
Trees keep a calendar. Bare branches in March, full canopy in July, yellow turn in October, snow on conifers in January — in temperate latitudes these patterns hold within roughly 2–3 week tolerance per region. Specific species narrow harder. Cherry blossom in Tokyo runs late March to mid-April; the bloom timing is publicly tracked. Jacaranda bloom in Pretoria peaks in October. Tulip fields in the Netherlands flower mid-April to early May. Authentic8's Geolocation 101 piece has more case studies on flora as evidence.
Snow tells you more than people think. Snow on the roads but not on the roofs = recent plowing. Snow only on north-facing slopes = late melt phase. Salt residue and sand piles imply post-snow days. Crops cycle through visible growth stages. A wheat field in green-leaf is May in Central Europe; the same field gold-stalk is late July. Match the agricultural calendar of the location and you can narrow by week.
Event anchors: humans label the world for free
Christmas decorations. Pride flags. Election posters with dates. Sports banners. Scaffolding around a building. A traffic cone painted for Halloween. Every one of these is a calendar stamp the subject installed for you.
Construction is especially valuable because permits and timelines are public. Scaffolding goes up on an exact day, comes down on an exact day. Cross-referencing your image with Wayback Machine snapshots of local news outlets, Google Street View timeline, and municipal permit records gives a hard window. A building with scaffolding in your image, no scaffolding on April 15 per Street View, scaffolding back up by June 1 — your image is in that 6-week bracket.
Posters and banners with printed dates are gifts. A concert poster for "September 14" at venue X is a hard upper bound (the image is at or before that date) and usually a soft lower bound (it's not from January, when the poster wasn't printed). Newspaper boxes with visible front pages give you the day. Google Trends can sanity-check whether a meme on a t-shirt or a slogan on a banner is plausibly contemporary.
Hard upper bounds: devices, plates, models
Hardware is dated. A phone visible in the frame cannot predate its release. A Tesla Cybertruck on the road = post-November 2023. A specific iPhone body style = within its production window. License plate format changes are particularly clean: Ukraine rolled out new plate format in 2014, South Africa announced a transition in 2022. A plate in the old format = before that date, full stop.
Bus-stop ads, cinema posters, election billboards, "5G is here" launch campaigns — all carry release windows. Combining one or two hard upper bounds with sun, weather, and foliage typically collapses the answer to a single calendar date.
The actual workflow
A real chronolocation pass runs in this order:
- Run ExifTool first. If clean metadata survives, you may already be done.
- Pass through FotoForensics to confirm the image isn't generated or composited.
- Geolocate before chronolocating. Time math is exponentially harder when lat/lng is unknown.
- Measure shadow direction → SunCalc → time-of-day window.
- Pull METAR from nearest airport via Ogimet for candidate dates → confirm or kill.
- Foliage, snow, crop stage → narrow to weeks.
- Event anchors, posters, scaffolding, archived news pages → narrow to days.
- Apply hard upper bounds (devices, plates, vehicle models) → final date.
Cross-check across at least three independent signals before publishing. One signal is a guess. Two is a hypothesis. Three is a finding.
Pitfalls that get findings discredited
Time zones eat careless investigators alive. METAR is UTC. SunCalc lets you toggle between UTC and local. Most cameras are set to local time. GeoConfirmed and similar collaborative projects log everything in UTC for a reason. Get sloppy with conversion and you publish a finding that's an hour off and easy to laugh at.
Reused footage is the second classic trap. Russia recycled 2014 Crimea footage in 2022 captioned as "today." If your sun, weather, and foliage point to 2015 and the caption says 2022, trust the photons. Likewise, training data poisoning matters now: AI-generated or AI-modified frames can pass casual review but break under shadow geometry, because diffusion models still get sun direction wrong with high frequency.
Final advice: follow people who do this work seriously. @Sector035, @bellingcat, @geoconfirmed, @aric_toler, @benjaminstrick, @hatless1der — the bench is shallow but it's real. The next time someone tells you "this video is from yesterday," check the shadow before you check the caption.
SUGGESTED SEO TITLE: GEOINT Chronolocation: How to Tell When a Photo Was Taken Using Sun, Shadows, Weather and Foliage