SakshyaYantra Media on the command line

When to use it. Settings, keys, connection tests, provider re-validation, and the signed provider/model manifest - each documented on its own line. AI is optional and off by default in every build.

Image to examine (omit with --list-tools)

When to use it. The image or video the authenticity workbench examines.

Also run these ML models (each is refused by name if this build cannot run it)

When to use it. Also run these ML models, alongside the classical methods that always run.

What it costs. A model this build cannot run is refused by name, not silently skipped.

List the image & video authentication tool set (40+ tools) and exit

When to use it. List the image & video authentication tool set (40+ tools, grouped) and exit, without examining a file.

Run the whole image tool set on FILE, printing each tool's observation / interpretation / conclusion separately

When to use it. Run the whole image tool set on the file, printing each tool's observation and interpretation separately.

What it costs. The conclusion is reserved for the examiner and is never asserted by a tool.

Run one named authentication tool on FILE

When to use it. Run ONE named authentication tool on the file (e.g. ela, prnu_map, clone_keypoint).

With --tools, restrict to one group (file/global/local/camera/deepfake/video/geometry)

When to use it. With --tools, restrict to one group: file, global, local, camera, deepfake, video or geometry.

With --tools, also run the deepfake model tools (slower)

When to use it. With --tools, also run the deepfake model tools (slower - they load a classifier).

What it costs. A deepfake tool never asserts a verdict; with no pack it says so, with a pack it emits a labelled model observation.

When to use it. Attach the examination to this case, so the finding sits beside the exhibit it was run against.

With --exam / --audio / --synth / --document / --voice: the examiner's name, written into the Judicial and DETAILED reports as typed (recorded, not verified). Without it the reports say no examiner was named

When to use it. The examiner's name for the three-tier report of --exam, --audio, --synth, --document and --voice; it is written into the Judicial and DETAILED tiers as typed.

What it costs. The name is recorded, not verified; without it the reports say that no examiner was named.

Also write the full report here

When to use it. Also write the full authenticity report to this folder, for attaching to a file or handing to a reviewer.

Run the video/temporal authenticity examination on FILE (needs the media worker: ffmpeg/ffprobe) and print a per-segment timeline

When to use it. Examine a VIDEO instead of a still: walk the container and the pixels over time and lay the findings out as a per-segment timeline - re-encoding, edit lists, splice points and rate-mode changes shown where they occur.

What it costs. The timeline reports signals segment by segment and never a single 'edited/authentic' verdict - the reading stays the examiner's.

With --video-timeline, ALSO run the AI triage lane: the trained deepfake / AI-image detectors' per-frame score series, shown as a SEPARATE, labelled 'AI observation (triage)' lane - never a finding, never merged with the fired-signal timeline, and layered on the examiner's sealed deterministic reading. Needs a local detector model pack; with none installed the lane is empty and says so.

When to use it. With --video-timeline, ALSO run the AI triage lane: the trained deepfake/AI-image detectors' per-frame scores, shown as a separate, labelled 'AI observation (triage)' lane layered on the fired-signal timeline.

What it costs. Triage is never a finding and never merged with the timeline; it is a lead for the examiner, labelled as a model observation.

One-button Video Authenticity Exam: run every video authenticity method on FILE and write the three-tier report (Executive / Judicial / DETAILED) to -o

When to use it. The one-button Video Authenticity Exam: run every video authenticity method on the file and write the three-tier report - Executive, Judicial and DETAILED - to the -o folder. It automates the frame-by-frame pass an examiner would otherwise do by hand.

What it costs. The DETAILED report carries each method's measurement, its scientific basis and how to re-run it, so the finding can be independently re-derived; the exam still asserts NO verdict - the conclusion is the examiner's.

One-button Audio Authenticity Exam: run every audio authenticity method (ENF mains-hum, splice, noise-floor, channel) on FILE and write the three-tier report (Executive / Judicial / DETAILED) to -o

When to use it. The one-button Audio Authenticity Exam: run every audio authenticity method - ENF mains-hum continuity, splice/discontinuity, noise-floor consistency and stereo-channel consistency - on the file and write the three-tier report (Executive, Judicial, DETAILED) to the -o folder. It is the voice/audio counterpart of --exam and gives a case the audio forensics pillar competitors ship.

What it costs. The DETAILED report carries each method's measurement, its scientific basis (ENF authentication, spectral splicing) and how to re-run it, so the finding can be independently re-derived; the exam asserts NO verdict - the conclusion is the examiner's.

One-button synthetic-media / deepfake exam on FILE (image or video): classical GAN/diffusion, JPEG-grid, face-blend and temporal/flow cues, plus any signed neural pack, into the three-tier report to -o. Reports CANDIDATES, never a verdict.

When to use it. The one-button synthetic-media / deepfake exam for an image or video: classical cues (GAN/diffusion spectral artifacts, DCT periodicity, colour co-occurrence, JPEG-grid consistency, face-blend, and for video temporal-face and optical-flow-boundary cues) plus any locally installed, signature-verified neural detector, written into the three-tier report (Executive, Judicial, DETAILED) at -o.

What it costs. It reports CANDIDATES against stated thresholds, never 'this is a deepfake' / 'authentic'; any neural pack's output is a labelled AI observation, never a finding. The DETAILED tier carries each cue's measurement, basis and re-run command so it can be re-derived.

One-button document authenticity exam on FILE (PDF or scanned image): revision history, xref, signature byte-range, fonts, overlaid text, embedded-scan ELA / ghost / quantization and AI-text signals, into the three-tier report to -o. Descriptive, no verdict.

When to use it. The one-button document authenticity exam for a PDF or a scanned image: it reads the revision history (earlier saved versions), the cross-reference table, the signature byte-range, the fonts and any text drawn over the page, and on an embedded or standalone scan runs ELA, JPEG-ghost and quantization-table checks, then writes the three-tier report to the -o folder. It also reports AI-generated-text signals where the text is extreme-regular.

What it costs. It states measurements, never 'forged' or 'authentic'; the conclusion is the examiner's. The DETAILED tier carries each method's basis and re-run command. Signature checking recomputes the digest over the ByteRange - it does not verify the certificate chain, and says so.

One-button synthetic-voice exam on FILE (audio): vocoder / upsampling / phase artifacts, prosody, pause-breath and consistency cues, plus any signed neural pack, into the three-tier report to -o. Reports CANDIDATES, never a verdict.

When to use it. The one-button synthetic-voice exam for an audio recording: vocoder and upsampling artifacts, phase coherence, prosody, and the pause/breath pattern, plus any locally installed signed neural anti-spoofing model, written into the three-tier report at -o.

What it costs. It reports CANDIDATES against stated thresholds, never 'cloned' or 'genuine'; a good clone can defeat the classical cues and the limits say so. Any neural pack's output is a labelled AI observation, never a finding.

With --video-timeline, decode at most N frames

When to use it. With --video-timeline or --exam, decode at most this many frames (default 240) so a long recording is sampled rather than fully decoded.

What it costs. Fewer frames is faster but coarser; the report states how much of the video the timeline actually covers.

With --video-timeline, the timeline's segment width

When to use it. With --video-timeline, the width in seconds of each timeline segment the signals are summarised into.

With --audio / --voice: analyse at most SEC seconds of the recording (default 1800 = 30 min); 0 analyses the whole file. The report's coverage line states what was examined either way.

When to use it. With --audio or --voice, how many seconds of the recording the exam analyses (default 1800, i.e. 30 minutes); 0 analyses the whole file. A long recording is sampled from the start rather than fully decoded.

What it costs. The report's coverage line states exactly what was examined and what was not, so a bound is never a silent gap; a shorter window is faster.

With --audio: read the ENF mains-hum trace against this nominal grid frequency (50 or 60 Hz) instead of letting the exam pick the stronger family. Use it when the recording's country/grid is known and the result was ambiguous; a wrong value reads the trace about 10 Hz off.

When to use it. With --audio, the nominal mains frequency (50 or 60 Hz) the ENF hum trace is read against. Set it when the recording's country or grid is known and the exam's 50/60 Hz result was ambiguous; left unset, the exam picks the stronger family.

What it costs. It fixes the nominal the trace is compared with; a wrong value reads the trace about 10 Hz off, so set it only when the grid is known.

Build a PRNU reference fingerprint from these images, all from ONE known camera (several plain/flat-field shots identify the device best). Combine with FILE and --tool prnu_identify to test it against the reference in one step, or with --save-reference to keep it without testing anything yet

When to use it. Build a PRNU reference fingerprint from several images, all taken by ONE known camera - plain/flat-field shots (sky, a wall) identify the device best. Combine with FILE and --tool prnu_identify to test that file against the reference in one run, or with --save-reference to keep the fingerprint without testing anything yet.

What it costs. Without a reference, --tool prnu_identify still runs - it refuses honestly and names what is missing, rather than guessing a camera.

Save the fingerprint built from --camera-reference to this file (.npy), so it can be reused with --reference without rebuilding it from the source images

When to use it. Save the fingerprint built from --camera-reference to this .npy file, so a later run can test against it with --reference instead of rebuilding it from the source images every time.

A previously saved PRNU reference fingerprint (.npy, from --save-reference) to test FILE against with --tool prnu_identify, instead of rebuilding one now

When to use it. A previously saved PRNU reference fingerprint (.npy, from --save-reference) to test FILE against with --tool prnu_identify, instead of rebuilding one from images now.

What it costs. Give --camera-reference or --reference, never both - one source of truth per run, never a silent preference between them.

The peak-to-correlation-energy decision threshold --tool prnu_identify reports FILE against (the conventional default is 50.0 - see PARAM_GUIDANCE for what the number means)

When to use it. The peak-to-correlation-energy decision level --tool prnu_identify reports FILE against (Goljan/Fridrich/Filler 2009); the conventional default is 50.0.

What it costs. A HIGH PCE means the query's sensor noise matches the reference device's fingerprint - consistent with that device, not proof of it. Strong compression, resizing and denoising weaken PRNU, and a cropped or rotated image needs alignment before this number means anything; the threshold is conventional, not a certified error rate for this exact image.

When to use it. The body-cam file or folder, then options: it identifies the container and streams, extracts the recording times, device/officer identifiers and GPS track, keeps the three times (media PTS, recorder overlay clock, case time) separate, and hashes the file before and after. `--out DIR` writes the report; `--case-time k=v` supplies the case clock; `--json` prints the structured result.

What it costs. Recognition is by markers in the metadata, never the file name; an unrecognised file is refused, not guessed. A truncated recording is reported, never padded. Vendor-proprietary wrappers with no public spec are inventoried and marked "needs a sample to certify".

When to use it. Group several recovered sources - a laptop disk, a backup stick, a phone image - into one case for a single customer or job, and see everything recovered across them in one place, deduplicated by hash. `new` starts a case; `add` puts a source into it; `list` shows the cases or one case's sources; `status` totals its files and duplicates; `dedup` lists files found in more than one source. Use it when a job is more than one drive and you do not want to hand back the same file three times.

The question to ask over the case

When to use it. The triage question to ask over the case's own indexed data, such as who met whom and when, or whether a confession appears. Retrieval returns the case items that bear on it; a model answer, if any, is an observation, never a finding.

The case folder (defaults to the most recent case)

When to use it. The case folder to query when it is not the most recent case, which is used by default. Only the case's own indexed data is searched, nothing outside it.

Your OWN reading of the case, sealed into the audit trail before any model answer is shown

When to use it. Your own reading of the case, sealed into the audit trail before any model answer is disclosed, so the record shows what the examiner concluded independently of the tool.

What it costs. It is sealed once; a later change is recorded as an edit, never as the original reading.

Seal your reading as inconclusive instead of typing one

When to use it. Seal your reading as inconclusive rather than typing one, for when the case does not yet support a reading but you still want the model's words disclosed and audited.

Who is asking, recorded with the sealed reading

When to use it. Who is asking, recorded with the sealed reading and the audited reveal so the trail names the person who saw the model's words.

After sealing a reading, disclose the model's verbatim words (an audited event). Without a sealed reading the model's words stay sealed

When to use it. Disclose the model's verbatim words after a reading is sealed, which is an audited event recorded with who did it and when.

What it costs. The model's text is an observation, never a finding; revealing it puts a record in the audit trail that it was seen.

How many case items to retrieve as context

When to use it. How many case items to retrieve as context for the question, when the default breadth is too wide or too narrow for the case.

Recorder disk (e.g. \\.\PhysicalDrive2 or /dev/sdb)

When to use it. Point at the recorder's disk when you have the disk itself and the recorder is unavailable or its export function is broken.

What it costs. Reading a recorder disk directly is read-only, but the recorder must be powered down and the disk removed. A running recorder overwrites the oldest footage continuously.

Image of the recorder disk (.dd/.img/.e01)

When to use it. Preferred over --device for any matter that may be produced. Image the recorder disk once, then work from the image.

Where to write recovered clips (required when scanning a disk/image)

When to use it. A folder on the case store with room for the clips. Recorder disks are large and footage recovers as many separate files.

Ignore fragments smaller than this many bytes (default 65536)

When to use it. Raise it when a sweep is returning large numbers of very short fragments and the incident you care about is minutes long. Lower it when the event of interest is only a few seconds.

What it costs. Raising the floor discards short fragments permanently for that run. If the incident may be brief, run low first and filter afterwards.

Stop after N clips

When to use it. Cap the run when you are sampling a large recorder to establish what is on it before committing to a full extraction.

What it costs. A capped run is not a complete extraction. Say so in the notes, and do not report the cap as the total footage present.

Just report which recorder this disk is, don't extract

When to use it. Run first on any unfamiliar recorder disk. It reports which recorder wrote the disk without extracting anything, which tells you how long the real job will take and whether the format is supported.

Start even when the pre-flight checks say this cannot finish: too little room, or writing onto the drive being recovered.

When to use it. Only after reading the objection. See the same switch on acquire.

What it costs. Forcing past a same-drive objection can overwrite the footage you are extracting.

When to use it. Read the recorder's camera index, play a clip's timeline, list a scan's clips, download or cut one out, extract several, enhance a frame or a range, capture a frame pack, or build a media report. Every subcommand is documented on its own line.

Raw device path (e.g. \\.\PhysicalDrive1 or /dev/sdb)

When to use it. Run the feasibility check the moment a drive arrives, before quoting, before imaging and before any promise to the client: it measures how much of the drive is unreadable and states the chances in plain words.

What it costs. A few hundred sampled reads - seconds on a healthy drive, and one gentle attempt per area on a failing one. Far cheaper than discovering mid-copy that the job was never viable.

An existing image file to check instead

When to use it. Check an existing image instead of a drive - for example to confirm a copy received from a client or another lab reads cleanly before work is billed against it.

Also write the answer as a PDF report at this path

When to use it. Write the verdict as a PDF wherever a client, insurer or case file needs the answer on record. The report states its numbers as ranges and says it is based on a sample.

How many areas of the drive to test (default 160)

When to use it. More samples narrow the stated range and cost more reads of the drive. The default suits a first assessment; raise it when the estimate must be tighter than a few percent.

What it costs. Each extra sample is another read of a drive that may be dying. On clearly failing hardware, keep the default and move to the copy.

Also write the report (HTML, PDF, JSON) into DIR

When to use it. Write the detection report - HTML, PDF and JSON - into this folder: every device with its state, bus, serial and sector size, the hardware Windows can see but cannot use with the code and the fix, and the Plug-and-Play inventory. Use it when a customer or a partner says a drive is not detected: the report replaces "it does not work" with what the machine actually sees.

What it costs. The folder goes through the same pre-flight as every other writing job; the report is small, so only rights and a full disk stop it.

Skip the health read of each usable drive (faster)

When to use it. Skip the health read of each usable drive. Detection is then a listing only and returns in a second or two. Use it on a machine with many drives, or when a drive is known to be failing and you do not want even a test read against it before imaging.

Write the report even if the pre-flight objects

When to use it. Write the report even when the pre-flight objects to the folder. Use it only when you have read the objection and it does not apply - a report is a few hundred kilobytes, so the usual reason is a destination the check cannot judge.

What it costs. A refusal you have not read is not one you can override safely.

When to use it. Bring footage in, decode it, batch-convert it, check the tested-recorder registry, or see what this machine's media worker can handle. Every subcommand is documented on its own line.

The case folder; omit to use the most recent case

When to use it. The case folder to read; omit to use the most recent case on this machine.

Only images or only videos

When to use it. Show only images, or only videos, on the wall.

Camera make/model contains this text (from EXIF)

When to use it. Keep exhibits whose camera make/model (from EXIF) contains this text.

Only this file extension

When to use it. Keep only exhibits with this file extension, such as jpg or mp4.

Only exhibits carrying this tag/bookmark

When to use it. Keep only exhibits carrying this tag or bookmark.

Filter by known-file status (unknown until a hash set is installed - see the NSRL item)

When to use it. Filter by known-file status. Reads 'unknown' for every exhibit until a hash set (NSRL or a custom set) is installed.

When to use it. Keep exhibits dated on or after this day (YYYY-MM-DD), by EXIF or observed timestamp.

When to use it. Keep exhibits dated on or before this day (YYYY-MM-DD).

When to use it. Keep only exhibits that are at least this many bytes in size.

When to use it. Keep only exhibits that are no larger than this many bytes.

When to use it. Order the wall by date, by size, or by file name.

Sort ascending (default is newest/largest first)

When to use it. Sort ascending; the default is newest / largest first.

When to use it. Skip this many items before the page - for paging a large case.

Return at most N items (the page); the count is still the full filtered total

When to use it. Return at most this many items (the page). The count is still the full filtered total, so paging never hides how much matched.

Tag/bookmark this exhibit id, then list

When to use it. Tag/bookmark this exhibit id (ev_...) before listing - the mark is written to the case through its own door.

What it costs. It writes to the open case; do it on a case you are examining, not a read-only glance.

The label for --tag-asset

When to use it. The tag text written onto the exhibit named by --tag-asset.

When to use it. The examiner name recorded when the case is opened to tag an exhibit.

Use the classic Tkinter wizard

When to use it. Fall back to the classic interface on a machine where the modern window will not start, typically an old or minimal Windows install.

When to use it. Read the how-to guides for this product: list them, print one as plain text, open the bundled page or PDF, or copy one out to a folder. Each guide says plainly where this product stops.

When to use it. Add evidence to a case and process it through one pipeline with a live dashboard. `add` enqueues a source; `run` runs the stages; `status` prints the dashboard; `stop` halts at a stage boundary; `retry` re-queues a failed stage.

When to use it. Manage this computer's licence from the terminal: `status` shows the licence, what is left on it and this computer's System Key (the code a key is issued for); `activate` applies a key issued for this computer; `deactivate` removes it. Use it on a headless or scripted install, or to read the System Key to send with a key request. Offline - nothing is sent anywhere.

Also check each device's health (SMART + test reads), how it's connected, and what kind of device it is (CCTV recorder, phone, dashcam, card, ...) with advice on what to do

When to use it. Run before touching anything. It reports each device's health, how it is connected and what kind of device it is, which is what decides whether to recover directly or image first.

What it costs. Triage reads the drive. On a drive that is audibly failing, keep even this brief and go straight to imaging.

When to use it. The verb's argument: `hash <image>` prints the image's perceptual hashes; `dedup <folder>` clusters near-duplicate images; `match <image> <hashset>` matches one image against an operator-supplied set.

What it costs. Every result is a CANDIDATE within a stated Hamming threshold, printed with its chance-match rate; it is a triage aid, never a judgement about the content. No hash set is bundled - the operator supplies any known-media set they are lawfully entitled to use.

When to use it. Mask a region, track one across a range, record the examiner's review decision, or export - each documented on its own line. Export is refused until a redaction has been approved.

When to use it. Open an asset's timeline, build a frame pack from a range, bookmark one frame, read the gaps and field order, or verify a pack already built. Documented per subcommand.

When to use it. Open an artefact in a structured viewer without leaving the case: `registry` browses a hive, `plist` shows a property list, `sqlite` browses a database and its deleted rows, `hex` pages raw bytes, `interpret` decodes the bytes at an offset, `bookmark` marks bytes on the case. Every view prints JSON.