There are only a few things we know for sure about Q. Some of their posts, however, reveal more about them than they likely intended. Here we examine such clues found in a series of on-site photos posted by Q, which add to the body of knowledge that investigators can use to rule in—or out—a particular suspect for Q. I’m particular, we find strong evidence of Q’s location during a specific period of time, and an indicator of Q’s socioeconomic status.
Background and Methods
Previous work by our team, with help from the crew at Bellingcat, drew on metadata which was not removed from certain photographs Q posted thanks to a coding oversight in the 4chan/8chan codebase. These image boards included filters to remove EXIF metadata from posted images, but neglected to remove other kinds of metadata, including the PNG metadata from iPhone screenshots, such as the ones that Q sometimes posted. The metadata, combined with the content of the images, paints a suggestive picture of Q’s circumstances and physical location: we can see that Q spends the overwhelming majority of their time in the Pacific time zone, but has traveled extensively in Asia.
Some of that Asian travel can be specifically dated and located based on the photos Q used in their drops — for instance, we know that Q spent at least several days and possibly weeks in the Shanghai Marriott Hotel Pudong East between December 2017 and early February, 2018 (most likely in late January to early February 2018).
We also know Q used an iPhone and had a habit of going into their phone’s image roll and taking screenshots of photos a few minutes before posting them, presumably to have them not as raw photos, but rather screenshots *of* photos that they’d taken off their own phone’s image roll. This is a basic practice for ensuring original photo metadata is not preserved in the final image. In this case, the screenshot metadata proves useful itself, nonetheless.
All of the above comes with a caveat: it’s not clear whether Q is a single poster or a team effort. It’s conceivable that the photos from various travels in Asia, and the photos from Newport Beach we’ll be discussing today, were first taken by someone other than the person who wrote the posts, and then sent along to that author. However, this information would still point us towards the location of a member of the team—one who’s in close enough contact with the author of the drops to lead investigators to that person. The information is valuable either way.
New Details about Q’s location
On July 29, 2018, Q posted three photos from outside the Newport Beach, CA office of Stormy Daniels’ lawyer, Michael Avenatti. Two of the photos were of the office building itself, and another was taken in the mirror of a car, featuring an unknown man dressed in black on Newport Center Drive outside the building. At first glance the images may seem to present little of interest, but certain details do provide useful information.
Q1752: 520 Newport Center Dr. 
Q1752: A close-up of the building 
Q1754: The Man in Black
Photo evidence supports “live” posting claim
The three images in these drops are some of the aforementioned screenshots with preserved metadata. While this method can be used to disguise the time or date of creation, in this case the creation time in the metadata aligns closely with the content of the photos themselves.
The first image of Q1752 contains several ornamental trees in the foreground, with their shadows visible on the ground. The height of the trees and the length of the shadows are both unknown, but the angle of the shadow can be found by comparison to other nearby features. In this case, I used the location of the second tree on the right, as the end of its shadow falls roughly parallel with the base of the first tree. Using this relation, we can find the angle of the shadow as it falls on the ground. According to the image metadata, the first image was created at 11:09am on July 29, 2018; the shadow angle derived from the image seems to match the solar angle at that date and time closely.
The image in Q1754 was taken in the mirror of a car parked on the east side of Newport Center Drive, viewing south along the street. It includes the shadows of five palm trees which grow on the east side of the street. Also of note is the position of the man in black, who appears to be about one cars’ width from the edge of the asphalt and roughly parallel to the white triangular feature set near the edge of the asphalt. Noting that the shadow of the second palm tree behind the photographer falls across the ground just ahead of the man in black, the ground angle can be approximated. This image was generated at 11:54am, and again the shadow angle in the image and the solar angle at that time appear to match.
Q drop 1755 is a reply from Q to another user on 8chan. The user asks “are we live?” to which Q replies, “5 min delay.” The images in Q1752 were created at 11:09am and posted at 11:13am PDT; the image in Q1754 was created at 11:54am and posted at 12:00pm PDT. As shown above, the images themselves appear to confirm the short delay between the time each photo was taken and when it was posted, and lend credence to Q’s claim.
Photo includes clues to the photographer’s vehicle
The image in Q1754 was taken in the side mirror of a vehicle parked on the east side of Newport Center Drive. The focus of the image is a man walking down the side of the road away from the car, who yet remains unidentified. However, two other details are also captured in the image: an orange indicator light on the mirror face, and a glimpse of the side mirror frame.
The lit orange triangle in the mirror is a blind spot indicator light, part of a safety system available in some cars to warn the driver when they are about to change lanes with a vehicle in their blind spot. The indicator also lights along with the indicators on the dashboard when the vehicle is started. The exact design differs between manufacturers, and aftermarket conversions are also available. We can eliminate right away several brands that use other implementations of the concept:
Several makes use pictographic indicators such as this. 
Some other makes place the indicator on the mirror housing or inside the window frame.
Of the many variations of the concept out there, the only make that uses a triangular indicator on the mirror face like this is Mercedes. In particular, their E series and GLE models use both the blind spot indicator and the mirror shape seen in the Q drop photo. Even among Mercedes, this is not a standard feature; on some models it is included only as an optional package.
Conclusions
The short delay between the original photos and when they were posted is a strong argument for a single person being responsible for both. Under this assumption, we know that Q was outside Michael Avenatti’s office between 11am and noon on Sunday, July 29th, 2018. Furthermore, the length of time during which they were on site, as well as the photo from the driver’s seat of a vehicle, indicate that Q was in their own car, which we have identified as a higher-end Mercedes. On the other hand, if we allow that the photographer may have been a different person than the poster: it was still a very tightly-run and focused operation, able to coordinate actions within minutes and across hours, and it was merely Q’s errand boy driving a loaded Mercedes. Whether directly or indirectly, this information about the photographer also informs us about Q.
Another interesting question the posts raises concerns the detail that the day in question was a Sunday. Michael Avenatti brought attention to the photo the next day, assuring his Twitter followers that “we will NOT be intimidated,” but it is unclear whether he was in the office at the time of the Q drops about him. Q1755, the drop following the image of the man in black, includes the statement “message sent,” supporting the theory that intimidation was the goal. That may help narrow the potential candidacy for the identity of Q to people who knew that Avenatti would be, or likely would be, at the office on that day, and more generally to people with a motivation to intimidate or harass him.
Acknowledgements
The initial body of research leading to the partial identification of the vehicle in Q1754 was a joint effort between myself, Q Origins, Robert Amour and Abigail. Robert first confirmed the location from which the image in Q1754 was captured. Initial scrutiny of these drops was inspired by the earlier work by Abigail and Robert on identifying and cataloguing image data from Q drops. This article was reviewed and edited by Robert, Q Origins and Alex Mendela.