Now that we are certain that the PDF file containing an image of President Obama’s long form birth certificate was produced by first scanning the original on a Xerox WorkCentre then rotating and printing the file to PDF on a Mac PC it is instructive to look at what a real forensic document examiner had to say in a report filed just a few days after the document was released. This document has been labeled a “100% forgery” by Mike Zullo and the Cold Case Posse.
So what is the truth? For example, how does the “Xerox theory” stack up against Ivan Zatkovich’s report?
Ivan Zatkovich was one of the forensic document examiners that WND hired immediately after the release of the long form birth certificate on April 27, 2011. WND did not publish his report but instead cherry picked selected quotes to make it appear as if Mr. Zatkovich might have supported claims that the document was forged. The report was referenced in an article written by Bob Unruh on May 1, 2011 titled “Online ‘Birth Certificate’ Document Was Changed” but was not linked.
Following publication of the WND article Kevin Davidson, aka Doctor Conspiracy, contacted Mr. Zatkovich about his analysis. Because he felt that his findings were not being portrayed accurately by WND Mr. Zatkovich emailed a complete copy of his report to Kevin and published it on his company web site where it is still available today Analysis of Obama Birth Certificate PDF. Mr Zatkovich told Dr. Conspiracy that he did not think WND accurately excerpted from his report. See WND document expert says: not quite accurate
I compared the Xerox Workcentre 7535 test findings with the Zatkovich report in detail. For comparison I used a file created by scan a color printout of the LFBC PDF that was scanned on a Xerox 7535 WorkCentre and the opened and printed to PDF on a Mac PC.
First Zatkovich examined the Metadata for the LFBC PDF using Adobe Acrobat Pro.
… The software application that created the PDF document is Preview, a graphics and PDF utility included with the Mac OX X operating system. The version of Preview used is included with Mac OS X 10.6.7. It is possible that the document was created by some other application at an earlier date and then opened and saved from Preview causing new meta data to be stored in the document. The probability of this is at best 50/50.
The metadata analysis is pretty straightforward. You can use several different tools to examine the metadata. The metadata of our test file is consistent with what Mr. Zatkovich found. The producer is Mac OS X 10.8.3 Quartz PDF and the creator is Preview. Zatkovich certainly doesn’t rule out the possibility that the file was created in another application and then opened and saved in Preview causing new metadata. I think his 50/50 comment is another was of saying he did not know. Now we know. The document was created originally by the scanning software in a Xerox WorkCentre by scanning a paper document. Remember that Zatkovich had at most a couple of days to examine the file and produce a report.
This is what Zatkovich said:
These are two common file formats. TIFF images are usually produced by scanning software used with scanner devices. PNG is a newer format used by graphics programs that store in graphics data a more efficient format producing smaller files than TIFF files. The two image types appearing in the meta data is consistent with the fact that the PDF document contains layers where small chunks of image are overlaid on the larger background image containing the form and security paper background. What caused those layers to exist is unknown. One commenter at a prominent website said that the layers were caused by “optimizing the PDF.” I know of no PDF optimization process that creates layers in the output PDF file.
Again nothing that Mr. Zatkovich said is contradicted by the “Xerox” theory. I believe Zatkovich would have written the final sentence a little differently had he known more about MRC compression and how it is used in modern office centers. There is no doubt that the Xerox WorkCentre line creates multilayer PDF files. More on that in a minute. As shown below the Xerox 7535 scan exhibits exactly the same file format types when the 7535 scan metadata is viewed in Illustrator:
File Creation and the Layers
Zatkovich made a very important observation about the file creation.
Because the internal creation and modification dates are the same, it can be concluded that the file was created in one session, not created and then modified with the overlays at a later time. This does not preclude the possibility that the scanning and overlays were prepared separately and merged together in this single session.
He was hedging his words a bit here but what he said was that there is no evidence that layers were created separately at different times and merged. The 7535 PDF shows the same creation date for all the layers as well. That is because they were created during the Preview print to PDF operation.
Zatkovich then discussed the individual layers that he found from analyzing the PDF. He made this statement about the layers:
When a paper document is scanned on a scanner and saved as a PDF file it normally contains only a single layer of graphical information. The PDF that appears on the White House website however, contains multiple layers of graphical information. Multiple layers usually appear in a document like this when it is being edited or modified in some fashion….
It is possible to take a single layer PDF and inadvertently create multiple layers, without changing the image in any fashion. But that does not appear to be the case here. The multiple layers in the PDF document are a result of changes made to the image. It is not known of all the changes that may have been made, several changes are identifiable.
This statement is true when one is referring to most dedicated desktop scanners. However, this does not apply to modern multifunction high end office machines like the Xerox WorkCentre with built-in compression algorithms. MRC compression breaks apart the image vigorously into multiple layers and applies compression individually to those layers to reduce the size of the completed file.
Zatkovich said that the existence of layers in itself was not evidence that the contents of the document had been changed. He gave the possible scenario of someone trying to enhance the clarity of the document. That is one of the things MRC does. It separates text-like objects into a layer that is maintained at twice the resolution of the background image layer for readability. So it was not a person “enhancing the appearance of the image” it was a machine doing exactly that.
More on Layers
Zatkovich correctly identified that the LFBC PDF file consisted of a background layer plus a number of overlays with text and other mostly grey or black objects. He also figured out that the “overlay layers” were at a higher resolution than the background layer. The Xerox 7535 scan follows exactly the same pattern. The background (green) layer is stored at 150 ppi and the foreground masks (overlays) are at 300 ppi. Xerox employs this scheme because it is more important that the text in the foreground layers be readable than the background layer which is often just a color or a photo. The file size is made smaller by using lossy JPEG compression to save the image at a lower resolution. There are no conflicts at all between the Zatkovich overview of the layers and those seen in the WorkCentre 7535 scan.
Let me explain a bit about “lossy” and lossless compression schemes. It refers to the fact that in some types of compression no information is lost and in some schemes it is lost. For example if you are down sampling an image to go from 600 ppi (pixels per inch) to 300 ppi then blocks of adjacent pixels get averaged together and the individual pixel info is lost forever. In reality it is more complex than this simple explanation but suffice it to say that lossy compression allows you to shrink a picture file by a huge amount and still recognize that it is a photo of your cute kitten being cute without being able to count Kitty’s hairs. .
Other types of file compression do not cause information to be lost. Everyone has used Zip files. They shrink file size for downloading and emailing but an exact copy of the file can be reconstructed by using a decoder. Binary files like executable files can only be compressed suing lossless compression schemes.
The Xerox Workcentres use both types of compression.
Let’s compare the more important layers from the LFBC in the Zatkovich report with the Xerox 7535 scan.
First is the background layer:
It is plainly visible that the four main “layers” in the two documents are very similar. The color of the background is slightly different as would be expected when comparing a scanned, compressed, printed copy to an original. Printers rarely render hues exactly. The white “ghosts” where text was lifted is visible in both backgrounds. The signature stamp was not quite cleanly lifted in the Xerox 7535 scan but this is easily explained because of the imperfect duplication of a process that included scanning, compression and printing.
Mr. Zatkovich concludes his report:
The following is a summary of my analysis:
1. The Hawaii Department of Health stated that they have a record of the birth certificate of Barak Obama.
2. A certificate was produced by the State of Hawaii and copied onto green safety paper, as per normal procedure.
3. The ‘Green copy’ was then scanned, presumably by the White House, to produce a PDF document.
4. The PDF document was then modified in some fashion (e.g. layers, white halo).
All of the modifications to the PDF document that can be identified are consistent with someone enhancing the legibility of the document. It is possible that in addition to enhancing the legibility of the document that the content of the document was also changed. There is no specific evidence of how or why that content would have been changed, but the evidence clearly indicates that the document was changed.
The changes that Zatkovich identified are all consistent with the effects of the scanning and compression process occurring within the Xerox Workcentre. I have presented a convincing case that every anomaly that Mr. Zatkovich identified in his report issued on April 29, 2011 can be explained by a very simple work flow process:
- Someone scanned on a Xerox Workcentre one of the original certified copies of the LFBC obtained from the Hawaii DOH. They emailed themselves a copy. They rotated the copy to the right orientation in Preview on a Mac.
- They printed the rotated image to a PDF file.
- That file was published at WhiteHouse.gov.
It will discuss the Xerox theory and how it stacks up against the Cold Case Posse “expert” reports in future articles.
thatMerriam-Webster: that definition: the person, thing, or idea indicated, mentioned, or understood from the situation. →