SaschaHeyer · August 14, 2026 12:53
diff --git a/0-README-install.md b/0-README-install.md
diff --git a/references__case-study.md b/references__case-study.md
diff --git a/references__legal-austria-germany.md b/references__legal-austria-germany.md
diff --git a/references__letter-template-de.md b/references__letter-template-de.md
diff --git a/scripts__photo_forensics.py b/scripts__photo_forensics.py
 #!/usr/bin/env python3
 """Photo forensics for rental-damage disputes: verify EXIF capture time and GPS at byte level.

 Usage: python3 photo_forensics.py FILE [FILE ...]

 Pure stdlib. Parses JPEG APP1/EXIF directly (no PIL/exiftool needed), so the report can
 honestly state "verified at byte level". For HEIC or odd formats it falls back to reporting
 that no JPEG EXIF segment was found and suggests exiftool.

 Why this matters: a photo's EXIF DateTimeOriginal + GPS turns "I have a photo" into
 timestamped, geolocated evidence — and its *absence* in the claimant's photos means their
 images prove nothing about when or where they were taken. Timestamps are often UTC
 (e.g. Pixel PXL_YYYYMMDD_HHMMSS files): always convert to the rental location's local time
 before putting them in a letter.
 """
 import struct
 import sys
 from pathlib import Path

 TAG_MODEL = 0x0110
 TAG_DATETIME = 0x0132
 TAG_EXIF_IFD = 0x8769
 TAG_GPS_IFD = 0x8825
 TAG_DT_ORIGINAL = 0x9003
 GPS_LAT_REF, GPS_LAT, GPS_LON_REF, GPS_LON = 0x0001, 0x0002, 0x0003, 0x0004


 def find_exif_segment(data: bytes):
    """Walk JPEG segments; return the TIFF payload of the APP1/Exif segment, or None."""
    if data[:2] != b"\xff\xd8":
        return None
    i = 2
    while i + 4 <= len(data):
        if data[i] != 0xFF:
            i += 1
            continue
        marker = data[i + 1]
        if marker in (0xD8, 0x01) or 0xD0 <= marker <= 0xD7:
            i += 2
            continue
        if marker == 0xDA:  # start of scan — no EXIF beyond here
            return None
        length = struct.unpack(">H", data[i + 2:i + 4])[0]
        seg = data[i + 4:i + 2 + length]
        if marker == 0xE1 and seg[:6] == b"Exif\x00\x00":
            return seg[6:]
        i += 2 + length
    return None


 def parse_ifd(tiff, offset, endian):
    """Return {tag: (type, count, raw_value_bytes_or_offset_resolved)} for one IFD."""
    out = {}
    try:
        n = struct.unpack(endian + "H", tiff[offset:offset + 2])[0]
    except struct.error:
        return out
    for k in range(n):
        e = offset + 2 + 12 * k
        try:
            tag, typ, cnt = struct.unpack(endian + "HHL", tiff[e:e + 8])
        except struct.error:
            continue
        sizes = {1: 1, 2: 1, 3: 2, 4: 4, 5: 8, 7: 1, 9: 4, 10: 8}
        total = sizes.get(typ, 1) * cnt
        raw = tiff[e + 8:e + 12]
        if total > 4:
            off = struct.unpack(endian + "L", raw)[0]
            raw = tiff[off:off + total]
        out[tag] = (typ, cnt, raw)
    return out


 def read_ascii(entry):
    if not entry:
        return None
    return entry[2].split(b"\x00")[0].decode("ascii", "replace").strip() or None


 def read_long(entry, endian):
    if not entry:
        return None
    try:
        return struct.unpack(endian + "L", entry[2][:4])[0]
    except struct.error:
        return None


 def read_rationals(entry, endian):
    if not entry:
        return None
    vals = []
    for k in range(entry[1]):
        try:
            num, den = struct.unpack(endian + "LL", entry[2][8 * k:8 * k + 8])
            vals.append(num / den if den else 0.0)
        except struct.error:
            return None
    return vals


 def dms_to_decimal(dms, ref):
    if not dms or len(dms) < 3:
        return None
    dec = dms[0] + dms[1] / 60 + dms[2] / 3600
    return -dec if ref in ("S", "W") else dec


 def report(path: Path):
    print(f"\n=== {path} ===")
    try:
        data = path.read_bytes()
    except OSError as e:
        print(f"  unreadable: {e}")
        return
    print(f"  size: {len(data):,} bytes")
    tiff = find_exif_segment(data)
    if tiff is None:
        kind = "not a JPEG (try exiftool for HEIC/PNG/etc.)" if data[:2] != b"\xff\xd8" else "JPEG"
        print(f"  EXIF segment: ABSENT ({kind})")
        print("  → this file carries no verifiable capture time or location.")
        return
    endian = "<" if tiff[:2] == b"II" else ">"
    ifd0_off = struct.unpack(endian + "L", tiff[4:8])[0]
    ifd0 = parse_ifd(tiff, ifd0_off, endian)
    print("  EXIF segment: PRESENT (byte-verified)")
    model = read_ascii(ifd0.get(TAG_MODEL))
    if model:
        print(f"  camera model: {model}")
    exif_off = read_long(ifd0.get(TAG_EXIF_IFD), endian)
    dt = None
    if exif_off:
        dt = read_ascii(parse_ifd(tiff, exif_off, endian).get(TAG_DT_ORIGINAL))
    dt = dt or read_ascii(ifd0.get(TAG_DATETIME))
    print(f"  capture time: {dt or 'not recorded'}"
          + ("  (check the timezone — camera clocks/filenames are often UTC)" if dt else ""))
    gps_off = read_long(ifd0.get(TAG_GPS_IFD), endian)
    if gps_off:
        g = parse_ifd(tiff, gps_off, endian)
        lat = dms_to_decimal(read_rationals(g.get(GPS_LAT), endian), read_ascii(g.get(GPS_LAT_REF)))
        lon = dms_to_decimal(read_rationals(g.get(GPS_LON), endian), read_ascii(g.get(GPS_LON_REF)))
        if lat is not None and lon is not None:
            print(f"  GPS: {lat:.6f}, {lon:.6f}")
            print(f"  map check: https://www.openstreetmap.org/?mlat={lat:.6f}&mlon={lon:.6f}#map=18/{lat:.6f}/{lon:.6f}")
        else:
            print("  GPS: IFD present but coordinates unreadable")
    else:
        print("  GPS: not recorded")


 def main(argv):
    if len(argv) < 2:
        print(__doc__)
        return 1
    for p in argv[1:]:
        report(Path(p))
    print("\nReminder: preserve originals. Never let a mail client send a 'reduced size' "
          "copy — re-encoding strips exactly the metadata verified above.")
    return 0


 if __name__ == "__main__":
    sys.exit(main(sys.argv))
diff --git a/SKILL.md b/SKILL.md
Finding	Where	Why it mattered
Damage date contradiction: cover letter said return day, invoice said two days later	Their own PDFs	Their documents admitted the damage was first documented post-return
"Expert assessment" = €20.90 flat-fee remote photo triage, processed in another country, vehicle recorded as make "SONSTIGES"	Assessor's invoice to the company (included in their own attachment bundle!)	No expert ever saw the car; no repair calculation existed
Their damage photos showed the car in an underground garage — renter left it on an outdoor lot	Photo content comparison	Their own photos proved the car was moved/driven after return
All 6 of their photo files: zero EXIF (byte-verified)	photo_forensics on their files	Their photos prove nothing about when/where they were taken
Renter's single photo: full EXIF — capture 14:58:44 UTC (16:58:44 local), GPS at the return lot, 27 seconds before the key-box scan (16:59:11) logged in their own damage report	photo_forensics + geocoding	Timestamped, geolocated proof of the return moment
Company's own "we received your key" system email at 16:59	Renter's inbox	The company itself confirmed the return in writing
Deductible billed as flat €1,100 + VAT with no repair evidence	Invoice	Cap ≠ flat fee; VAT without repair; amount indefensible
Company's current AGB contained no key-box risk clause; consumer liability fault-only; venue = consumer's domicile	Fetched current AGB	Their own terms contradicted their claim theory
	#!/usr/bin/env python3
	"""Photo forensics for rental-damage disputes: verify EXIF capture time and GPS at byte level.

	Usage: python3 photo_forensics.py FILE [FILE ...]

	Pure stdlib. Parses JPEG APP1/EXIF directly (no PIL/exiftool needed), so the report can
	honestly state "verified at byte level". For HEIC or odd formats it falls back to reporting
	that no JPEG EXIF segment was found and suggests exiftool.

	Why this matters: a photo's EXIF DateTimeOriginal + GPS turns "I have a photo" into
	timestamped, geolocated evidence — and its absence in the claimant's photos means their
	images prove nothing about when or where they were taken. Timestamps are often UTC
	(e.g. Pixel PXL_YYYYMMDD_HHMMSS files): always convert to the rental location's local time
	before putting them in a letter.
	"""
	import struct
	import sys
	from pathlib import Path

	TAG_MODEL = 0x0110
	TAG_DATETIME = 0x0132
	TAG_EXIF_IFD = 0x8769
	TAG_GPS_IFD = 0x8825
	TAG_DT_ORIGINAL = 0x9003
	GPS_LAT_REF, GPS_LAT, GPS_LON_REF, GPS_LON = 0x0001, 0x0002, 0x0003, 0x0004


	def find_exif_segment(data: bytes):
	"""Walk JPEG segments; return the TIFF payload of the APP1/Exif segment, or None."""
	if data[:2] != b"\xff\xd8":
	return None
	i = 2
	while i + 4 <= len(data):
	if data[i] != 0xFF:
	i += 1
	continue
	marker = data[i + 1]
	if marker in (0xD8, 0x01) or 0xD0 <= marker <= 0xD7:
	i += 2
	continue
	if marker == 0xDA: # start of scan — no EXIF beyond here
	return None
	length = struct.unpack(">H", data[i + 2:i + 4])[0]
	seg = data[i + 4:i + 2 + length]
	if marker == 0xE1 and seg[:6] == b"Exif\x00\x00":
	return seg[6:]
	i += 2 + length
	return None


	def parse_ifd(tiff, offset, endian):
	"""Return {tag: (type, count, raw_value_bytes_or_offset_resolved)} for one IFD."""
	out = {}
	try:
	n = struct.unpack(endian + "H", tiff[offset:offset + 2])[0]
	except struct.error:
	return out
	for k in range(n):
	e = offset + 2 + 12 * k
	try:
	tag, typ, cnt = struct.unpack(endian + "HHL", tiff[e:e + 8])
	except struct.error:
	continue
	sizes = {1: 1, 2: 1, 3: 2, 4: 4, 5: 8, 7: 1, 9: 4, 10: 8}
	total = sizes.get(typ, 1) * cnt
	raw = tiff[e + 8:e + 12]
	if total > 4:
	off = struct.unpack(endian + "L", raw)[0]
	raw = tiff[off:off + total]
	out[tag] = (typ, cnt, raw)
	return out


	def read_ascii(entry):
	if not entry:
	return None
	return entry[2].split(b"\x00")[0].decode("ascii", "replace").strip() or None


	def read_long(entry, endian):
	if not entry:
	return None
	try:
	return struct.unpack(endian + "L", entry[2][:4])[0]
	except struct.error:
	return None


	def read_rationals(entry, endian):
	if not entry:
	return None
	vals = []
	for k in range(entry[1]):
	try:
	num, den = struct.unpack(endian + "LL", entry[2][8 * k:8 * k + 8])
	vals.append(num / den if den else 0.0)
	except struct.error:
	return None
	return vals


	def dms_to_decimal(dms, ref):
	if not dms or len(dms) < 3:
	return None
	dec = dms[0] + dms[1] / 60 + dms[2] / 3600
	return -dec if ref in ("S", "W") else dec


	def report(path: Path):
	print(f"\n=== {path} ===")
	try:
	data = path.read_bytes()
	except OSError as e:
	print(f" unreadable: {e}")
	return
	print(f" size: {len(data):,} bytes")
	tiff = find_exif_segment(data)
	if tiff is None:
	kind = "not a JPEG (try exiftool for HEIC/PNG/etc.)" if data[:2] != b"\xff\xd8" else "JPEG"
	print(f" EXIF segment: ABSENT ({kind})")
	print(" → this file carries no verifiable capture time or location.")
	return
	endian = "<" if tiff[:2] == b"II" else ">"
	ifd0_off = struct.unpack(endian + "L", tiff[4:8])[0]
	ifd0 = parse_ifd(tiff, ifd0_off, endian)
	print(" EXIF segment: PRESENT (byte-verified)")
	model = read_ascii(ifd0.get(TAG_MODEL))
	if model:
	print(f" camera model: {model}")
	exif_off = read_long(ifd0.get(TAG_EXIF_IFD), endian)
	dt = None
	if exif_off:
	dt = read_ascii(parse_ifd(tiff, exif_off, endian).get(TAG_DT_ORIGINAL))
	dt = dt or read_ascii(ifd0.get(TAG_DATETIME))
	print(f" capture time: {dt or 'not recorded'}"
	+ (" (check the timezone — camera clocks/filenames are often UTC)" if dt else ""))
	gps_off = read_long(ifd0.get(TAG_GPS_IFD), endian)
	if gps_off:
	g = parse_ifd(tiff, gps_off, endian)
	lat = dms_to_decimal(read_rationals(g.get(GPS_LAT), endian), read_ascii(g.get(GPS_LAT_REF)))
	lon = dms_to_decimal(read_rationals(g.get(GPS_LON), endian), read_ascii(g.get(GPS_LON_REF)))
	if lat is not None and lon is not None:
	print(f" GPS: {lat:.6f}, {lon:.6f}")
	print(f" map check: https://www.openstreetmap.org/?mlat={lat:.6f}&mlon={lon:.6f}#map=18/{lat:.6f}/{lon:.6f}")
	else:
	print(" GPS: IFD present but coordinates unreadable")
	else:
	print(" GPS: not recorded")


	def main(argv):
	if len(argv) < 2:
	print(__doc__)
	return 1
	for p in argv[1:]:
	report(Path(p))
	print("\nReminder: preserve originals. Never let a mail client send a 'reduced size' "
	"copy — re-encoding strips exactly the metadata verified above.")
	return 0


	if __name__ == "__main__":
	sys.exit(main(sys.argv))
Resource	When to use
`scripts/photo_forensics.py`	Every photo, both sides — EXIF/GPS verification at byte level
`references/legal-austria-germany.md`	Any AT/DE claim — pre-verified statutes, cases, links
`references/letter-template-de.md`	Drafting the German dispute letter
`references/case-study.md`	Pattern recognition — the anonymized winning reference case