How to do the job

The recording as received, hashed first. Model packs are optional and, when used, are named in the record.

Structure, codec history, double compression, frame statistics, model outputs - each with its result and its refusals. A method that cannot judge this file says so.

SWGDE Best Practices for Digital and Multimedia Evidence Authentication - method-based, documented.

Each hypothesis names the methods that support it and the ones that oppose it. The examiner writes the conclusion; the software ranks the evidence.

ISO/IEC 27042 s9 - interpretation stated with its basis.

Fans out to the keyword hit search, the gallery and the timeline's own text filter - no new search engine, the same ones those workspaces use.

Every finding and bookmark recorded anywhere in the case, filterable by kind, with its review state.

Named presets held with the case itself, so the next examiner sees them too.

The case's hash-chained trail, verified on the same screen: an altered, inserted or reordered entry is detected, not assumed absent.

ISO/IEC 27037 7.6 - documentation

The case items that bear on the question come back with the verdict. A claim that cites a case item which does not exist refuses the whole answer; nothing is invented.

Type your reading of the case, or mark it inconclusive. It is sealed into the audit trail before any model words are shown.

An audited event. The model's text is disclosed as an observation, labelled the model's words and never the case's.

Choose the NVR/DVR disk or a copy of it.

Cameras against time, read from the recorder's own table in seconds - nothing is written. A disk with no table shows cameras inferred from the video itself (labelled A/B/C, never an invented channel number) and says the times are unknown rather than guessing them.

A separate drive.

We carve the video and mark any clip that may not play, so you aren't misled.

Frame count, keyframes, picture size and time base - the same player a forensic examination uses.

The clip is copied as carved and verified against its own SHA-256 before you're told it's done.

Remuxed losslessly by default - the recorder's own compressed pictures, not re-encoded - unless you ask for the exact frame range and accept that every pixel becomes new.

Every clip, one channel, or the ones you pick - copied byte-exact with a manifest of every hash.

Point at the camera and the time you need and it comes straight off the disk - remuxed losslessly by default, using the same index you already read.

The enhanced picture is shown beside the ORIGINAL, never instead of it - the filter chain used is printed and both pictures are exported, so nobody has to take the enhancement on trust.

SWGDE Best Practices for Image Analysis and Forensic Video Enhancement

A small pack of frames - no case is needed for this one, it's a plain still, not an evidence pack.

Clips, channels, times, codecs and hashes, in the same report format a recovery job uses.

Which asset and which frames. Leave the range empty for the whole asset.

Lossless by default; where a container cannot be cut on a frame the policy says so and the record says which. The provenance record is verified against the clip after writing.

ISO/IEC 27042 s8 - derived items hashed; SWGDE s10 - output documented.

The device, the person in charge of it, the expert and the place, typed; every record it rests on named by digest. A draft for a person to read, sign and file.

Bharatiya Sakshya Adhiniyam 2023 s63(4) - the certificate for electronic records.

This sets where the local copy lives and which restore to use.

If the account was synced here, the files (or online-only stubs) are on the local disk and we recover them directly.

A separate drive from the sync folder.

For anything not cached locally, use the provider's version history, point-in-time restore, or trash window (OneDrive Files Restore 30 days, Google/Dropbox version history, S3 versioning). We tell you exactly which and how long the window is.

We recover the local sync cache and report the provider-side restore avenue for each file that lives only in the cloud.

Search the lab-wide store for a hash, phone, email or account and see every authorised case that carries it.

Adding a case is an explicit, authorised act, never automatic on save. A case stored without authority is never shown as a correlation of another.

See what the current case shares with every other authorised case - stated plainly when there is nothing, never a blank screen.

Before anything else: unplug it, or stop saving to it. Every file written to a drive can land on top of the one you are trying to get back, and once that happens no tool can undo it. If the drive is the machine's own system disk, shut the machine down and read the drive from another computer.

Universal first instruction in data recovery. R-Studio, UFS Explorer, Klennet and DMDE all lead with it.

We read its SMART data and try a few sectors at both ends, because flash dies from one region outwards. This is the question that decides everything after it: a failing drive must be copied before it is scanned, because every extra hour of scanning is an hour it might not survive. For the full measured answer - the recoverable-or-not verdict, with the unreadable fraction as a range and a PDF report - run the quick check on the source step ('Can it be recovered?'), or `check` on the command line.

Assess before you act. The step every professional recovery workflow puts first and the one this product previously asked the user to guess at.

Pick the kind of storage. This helps us read it the right way.

If the health check found ANY unreadable sectors, copy first - we then work on the copy and the drive is read once instead of repeatedly. Recover directly only when the drive read cleanly and you are in a hurry.

Image first, work from the image. ACPO principle 1 in forensics; standard practice in recovery.

Choose a folder on a DIFFERENT drive. We never save onto the drive you're recovering - that could overwrite the very files we're trying to get back.

This focuses the VIEW, not the scan - we always recover everything, so you can widen it afterwards without scanning again.

Pick the exact drive from the list. Removable drives are shown; the drive this program runs from is disabled so you can't scan it by mistake.

We'll show you the drive we'll read, the folder we'll write to, and the free space - then begin. Nothing is written to the source.

Open a few before exporting. A file can come back with the right name and the right size and the wrong contents, if the space it used was reused after deletion - previewing is how you find that out while it still costs nothing.

Preview before recovery. Offered by every major recovery tool and the step this wizard omitted.

We confirm each exported file matches what we recovered, and tell you plainly about any we could not read whole. Files we know are wrong are marked, never quietly handed over.

Verify the output. In forensic mode this is a SHA-256 manifest; in recovery mode it is a readability and completeness check.

If it's running, we must NOT read the live file - it would be inconsistent. We'll guide you to stop it or take a snapshot.

We can also detect this from the file. It sets how we read the pages.

This chooses the technique.

Always check first - restoring a good backup beats forensic extraction.

A separate drive. We save extracted rows to a NEW database or CSV and keep the damaged original.

We extract what's readable and tell you honestly what is validated versus lost - never a best-guess row.

Pick carefully. The system disk, the drive this program runs from, and the report drive can never be erased.

Typing the serial back proves you picked the right drive. A simple 'yes' is too easy to click through.

One zero-writing pass meets the NIST 'Clear' standard and is provable (we read it back). We don't claim more than we can prove.

We read the drive back with our own recovery engine to confirm nothing is left, and produce a certificate stating what was achieved and its limits.

Plug it straight into the machine, not a hub; a desktop external drive also needs its mains adapter.

ISO/IEC 27037 7.4 - identification of digital devices

Every device is listed, usable or not. One that is connected but cannot be used says why: cannot be read, needs administrator, in use, Windows cannot start it, or a phone in MTP mode.

A card the reader cannot address needs an SDXC reader; a bridge Windows cannot start needs power, cable, a USB 2.0 port or a different enclosure; a drive that reads but is failing goes to Image, not Scan.

HTML, PDF and JSON, with every device, its state, the Plug-and-Play inventory and the environment. Send it with any support request about a drive that is not detected.

We read the index - the filesystem's own record of names and folders, deleted entries marked - without touching any file's contents. Seconds, and free.

Browse before recovering. R-Studio and DMDE both read the index first and let you choose.

A ticked folder covers everything under it. Find by name, modified date or minimum size; deleted entries carry their recovery chances so you know before you commit.

A folder on a different drive. Only the ticked files are read and written - the destination never holds more than that.

Only what is ticked is read from the source and written out, under its own folder path rather than sorted by type.

The same completeness check a full recovery gets, scoped to the files you actually asked for.

A date range is enough - a month, or just a year. We match it against whichever date survived on each file (created, modified or last accessed); a file that kept none of its dates cannot be matched this way and is left for the other two questions to find.

Photo, video, audio, document or archive - the same groups the results screen already sorts everything into, so narrowing here never excludes a format quietly.

A part of the filename is enough - "tax", "IMG_2021", "invoice". This matches the name only, not what is inside the file.

Every match is shown with the trust grade already worked out for it - a file whose contents do not match its name, or that came back empty, is marked so before you open it rather than after.

No surveyed data-recovery competitor documents this last step at all - they report a count and offer a preview.

A recorder export, a clip from a phone or a pen drive, or the folder a recovery wrote. It is opened read-only and hashed before anything else happens.

ISO/IEC 27037 s7.1 - identification and collection of the original.

Two readers on purpose - the container parser and the decoder's probe - and a disagreement is shown as one. The recorder registry says whether this make and model has been tested.

SWGDE Best Practices for Forensic Video Analysis s5 - characterise the recording before processing.

Container, index, stream, then salvage: the rung that produced each frame is recorded, and a frame the index had lost is marked salvaged rather than passed off as normal. Written to a folder on another drive.

ACPO principle 1 - the original is not changed; ISO/IEC 27042 s7 - reproducible processing.

The decode result, the source hash and the examiner's typed name become the exhibit record. This is where one USE of the licence is spent - one source, however many frames.

ISO/IEC 27037 s6.6 - chain of custody from the first record.

A format destroys exactly what a recovery exists to save. This door opens only after a recovery has finished, and where the scan found files that have not been exported it refuses and says how many.

Recover before you repair - the ordering diskrepair and every professional workflow put first.

Read-only, about 12 seconds: whether the disk reads at all, how many read errors, and whether it stays present and steady on the bus. A disk that drops or cannot be read is refused - formatting failing hardware only wastes what is left of it.

exFAT for cards and sticks used across devices, NTFS for a Windows-only disk, FAT32 where an older device needs it (4 GB file limit). The choices that do not fit the disk say why.

Typing the serial back proves you picked the right drive. The system disk and the disk this program runs from can never be formatted here.

A fresh partition table and filesystem are written, the disk is read back, and the record shows each step taken and the drive letter Windows gave it.

Registry hive, plist, SQLite database, or hex - deleted keys/values and deleted/superseded rows are a switch away.

Subkeys and values with types; tables with schema and row counts, then a page of rows; a paged hex window with typed data interpretation.

The bytes (up to 256) and their SHA-256 are captured, so a later reader can prove the mark still points at what the examiner saw.

ISO/IEC 27037 7.6 - documentation

Who authorised this examination, over what, and on what basis - the owner's instruction, a warrant, or a statutory power. Recorded now, before anything is opened, because an authority written afterwards is not an audit trail.

ISO/IEC 27037 s5.3; ACPO principle 3 (a record of all processes applied).

Attach the exhibit through a write blocker where you have one. This engine has no write path to a source at all, and we MEASURE that rather than assert it: the source is fingerprinted before and after the job and the report states which regions were checked.

ACPO principle 1 - no action should change data held on an exhibit.

Case reference, exhibit number, make, model, serial, capacity, and who is handling it. This starts the chain of custody, and everything acquired afterwards is filed against it.

ISO/IEC 27037 s6.7 chain of custody; NIST SP 800-86 s3.1.2.

Memory and running state are gone the moment it is powered down, so they are collected before the disk. If the machine is already off, leave it off - do not power it up to look.

Order of volatility - NIST SP 800-86 s3.1.1, RFC 3227.

The image is hashed WHILE it is written, not afterwards, so the hash covers what was read from the exhibit rather than what happened to land on disk. E01 or raw; both carry the same manifest.

ISO/IEC 27037 s7.1.3; NIST SP 800-86 s3.1.2.

Compare the acquisition hash with the source. This is the step that makes everything after it defensible, and it is why it sits HERE and not at the end - analysing an unverified image means every finding rests on a copy nobody checked.

ACPO principle 2; ISO/IEC 27037 s7.1.4 verification.

The exhibit goes back in the bag. Every examination from here runs against the image, so the original is read once and never again.

ACPO principle 1; ISO/IEC 27037 s7.1.5.

Recover deleted files, read the artefacts - recycle bin, USN journal, prefetch, registry, LNK, event logs, jumplists, shellbags, AmCache, browser history - build a timeline, and search. Everything you do is written to the hash-chained audit trail as you do it.

NIST SP 800-86 s3.2 examination and s3.3 analysis.

The findings, the method, the tool and its version, every hash, the source offset of each recovered file, and the limits of what the examination can support. The limits are not optional - a report that states none is claiming certainty it does not have.

NIST SP 800-86 s3.4 reporting; ISO/IEC 27037 s6.8.

The audit trail is sealed - the receipt goes into the manifest, which is what makes a later truncation detectable - and the exhibit is signed back in.

ISO/IEC 27037 s6.7 - custody is unbroken to disposal.

The map reads the exhibits already in a case. Open or create the case in Examination or Footage first; the map is then every located photo and video that case holds.

ISO/IEC 27037 7.5 - collection and preservation

Every photo/video that carries EXIF GPS becomes a point; nearby points cluster, and a point names its source exhibit and real timestamp. The basemap is offline.

Filter by images or video, by date range, or to a single exhibit; turn on the track to join the timed points in order.

Click a point to see the exhibit it came from, and open it in the gallery for the byte-exact original.

ISO/IEC 27037 7.6 - documentation

Export the points to GeoJSON or KML - KML opens them, with the track and timestamps, in Google Earth, QGIS and other mapping tools.

NSRL RDS (modern SQLite), a plain MD5/SHA-1/SHA-256 list, or a custom examiner set typed known-good or known-bad.

Every exhibit's digest is looked up against every installed set; the gallery's known column and filter read the same result.

Known-good, known-bad and unknown counts, and which set a known-bad match came from.

A drive, a phone, or an existing image file. Phones have their own guided steps.

Before any copying, we test areas right across the drive and tell you the chances: how much is unreadable, what you can expect back, and what cannot come back. You get the answer as a PDF report you can keep or send to us.

Assess before you act - the step every professional recovery workflow puts first.

A separate drive with room for the whole source - the app lists your drives with their free space and refuses the drive being copied. Choose raw (.img) or E01, the compressed format recovery labs open directly.

We copy in passes, skipping bad areas first and retrying them gently, and keep a map of what couldn't be read. You can stop at any time and continue later.

An E01 is already compressed - hand it over as it is. A raw image can be zipped here; any lab can open a zip.

A stage set is queued for it at once; carve is opt-in and only meaningful for an image.

Each stage is isolated - one failing does not stop the others - and retryable; a resumed case skips finished stages.

Per-stage status, progress and counts, and the case's overall progress.

Literal terms or /regex/ patterns, case-sensitive or not, saved with the case.

Every indexed item is searched; a hit carries its keyword, source item, character offset and surrounding context.

Tag a hit or add it to a finding through the case's own door.

ISO/IEC 27037 7.6 - documentation

Entities (devices, people, phones, emails, accounts, domains) and edges (sms/call/chat/email/contact/visit), each with its own provenance.

Degree, betweenness and community metrics; the shortest path between two entities; one entity's neighbourhood.

Recorded as a finding through the case's own door.

ISO/IEC 27037 7.6 - documentation

A .pst or .ost, an mbox, a Maildir folder, loose .eml files, or an Exchange .edb. If it came off a drive you are recovering, point us at the recovered copy, not the drive.

We report how many folders and messages we can see. A store Outlook calls damaged has lost the structures a normal reader depends on, so we sweep for the messages directly - anything found that way is marked salvaged everywhere it travels, because a salvage and a clean read differ in what they can give you.

A folder on a different drive. Messages are written as .eml with an index.csv, because two thousand loose files is not a mailbox anybody can use.

Exported as .eml so they open in Outlook, Thunderbird and any review platform.

The gallery reads the exhibits already in a case. Open or create the case in Examination or Footage first; the wall is then every image and video that case holds.

ISO/IEC 27037 7.5 - collection and preservation

Every picture and video as a tile - a video shows a poster frame. Tiles load lazily and page, so a case of tens of thousands stays responsive.

Filter by images or video, by camera make from EXIF, by extension, by date range or size, and by known-file status (unknown until a hash set is installed); sort by date, size or name.

Tag or bookmark an exhibit, or add it to a finding - each mark is written into the case through its own door and shows on the tile.

ISO/IEC 27037 7.6 - documentation

Open a tile to review it: a still full size, a video frame by frame through the shared frame-exact player.

A frame pack or a folder of PNGs. The lab never opens the video itself; it works on frames whose digests it records.

A chain of validated operators with its parameters pinned. A pin that no longer matches this build refuses to run rather than doing something else quietly.

SWGDE Best Practices for Image and Video Enhancement - documented, repeatable processing.

The enhanced frame is shown beside the original, never instead of it; both are exported with the chain.

ISO/IEC 27042 s7 - reproducibility of processing.

Processes, process tree, command lines, network connections, loaded DLLs, open handles, or a malware-detection plugin, for Windows, Linux or macOS.

Offline by default; an honest refusal names what is missing (no image, Volatility 3 absent, symbols unavailable) rather than guessing.

The exact row, the plugin and the Volatility 3 version travel with it.

ISO/IEC 27037 7.6 - documentation

What it answers with, or a picked class - nothing is assumed about a device this build has not identified. Reachability is checked before anything is tried.

ISO/IEC 27037 7.4 - identification of digital devices.

Every method this build carries for this device, ranked, with the honest gap named when none can reach it.

A physical/file-system acquisition is only lawful with the owner's consent or proper authority. This is recorded and cannot be skipped.

Works down the ranked list and stops at the first method that succeeds; a failure names every method tried.

Owner's rule (CLAUDE.md, R-MOBILE-FULL) - the honesty boundary is what public exploits actually reach.

The file the lab produced, spare (OOB) areas included. It is read-only; nothing is written to it.

Read the dump and report the geometry, scrambling, error correction and block map. It writes nothing and tells you which figures, if any, the lab still needs to supply.

A separate drive from the dump.

Write the image, and read the count of pages the error correction could not fully fix before trusting it - a complete image is not the same as a fully verified one.

This decides how we connect.

Phone acquisition is only lawful with the owner's consent or proper authority. This acknowledgement is recorded and cannot be skipped.

Plug in the phone, unlock it, and approve the trust/USB-debugging prompt on its screen. We check we can actually read it.

Read-only copy is always available. Advanced methods (backups, supported BootROM/EDL paths) are opt-in per case.

A separate drive with enough space. We check first.

We copy what's exposed, verify each file's size, and report honestly what could and couldn't be read.

USB debugging on, and the phone unlocked at least once since it was restarted - files stay encrypted until then, so a locked phone lists fine and reads nothing.

A drive with room for the whole partition.

Streamed in blocks with a live figure and a stop that stops. We compare the length against what the phone reported: a short image is reported failed, never handed over as whole.

The image goes into the ordinary recovery flow from here.

Only a frame pack ever leaves the machine, and only in the mode the agency has switched on: none, a local model pack, or a cloud provider behind the authorisation switch. Reachability is checked before any key is touched.

Owner's rule (CLAUDE.md, SakshyaYantra video rules) - the frame pack is the only unit that leaves the machine.

What you read, sealed with a digest before the model is asked. The order cannot be reversed: the reveal is refused until the seal exists.

Owner's rule - the examiner's reading is sealed BEFORE any AI answer is shown.

Model, version, prompt, input digests, time and the verbatim text - labelled an observation, never a finding, and the transfer manifest lists every digest that left.

Owner's rule - an AI response is an observation, promoted only by a typed reviewer decision.

Each disk or image in the set. They are only ever read, never written. A RAID 5 array still rebuilds with one member missing (RAID 6 with two) - mark a missing member's row blank so the array is rebuilt degraded.

Read the RAID metadata off the disks (LDM, IMSM, DDF, SHR / mdadm), or set the level, chunk size and layout yourself when there is no metadata to read.

See the rebuilt volume's partition table before committing. If it looks wrong, go back and set the level yourself rather than recovering from a bad assembly.

Hand the assembled volume to the ordinary recovery scan - the same results grid and export, licensed and charged like any single source.

Do NOT delete the encrypted files or the ransom note, and don't wipe the machine. Keep the note, a sample of the malware, and - if the machine is still on - a memory image. We'll explain each.

Choose the folder (or a copy of the drive) that was hit. We only read it.

A clean, SEPARATE drive - never the infected one. Keep the encrypted originals too; a decryptor may appear later.

We check every file: some were only renamed or fake-encrypted and come back with no key at all.

We identify the family, look for surviving originals and any known weakness, and give you an honest plan - including when the files themselves can't be decrypted.

The count of (container, codec) pairs that decoded a frame from a REAL sample - the number we can prove, never a claimed total.

The signed make / model rows, each proved by a specimen; when there is none it says why, never a blank.

Real specimens we hold but cannot yet prove a decoded frame from - the honest gap, never dressed up as support.

Offline and consent-gated: only the first 1 MB and the hash leave the file - never a frame, never case data, no transport - so a new recorder can be worked on next build.

Pixels in the frame, from one frame to another; optionally followed across frames. The original is never written to; the mask is a record with its own chain.

SWGDE Best Practices for Forensic Video Analysis s9 - processing recorded and repeatable.

Approve or reject, typed with a name and a note. The decision goes into the hash-chained audit trail and the report. Recorded by the software, not authenticated by an account system - and said so.

ACPO principle 3 - a record of all processes, and who applied them.

Refused until an approve decision exists. The copy carries the mask chain and its hashes; the original stays as it was.

ISO/IEC 27042 s8 - a derived item names what it was derived from.

Install and start the agent there; it offers its disks read-only. Both machines show the same pairing code.

The agent lists what it can offer, with size and health.

A local folder with room for the whole drive.

Live throughput and an estimate. The copy is verified by hash - a transfer that looks finished and is short is the failure this must never hide.

The recovered files that will not play. Originals are never modified - we always work on a copy.

Optional but it is what makes the difficult cases work: a healthy file from the same device supplies the structure the damaged one has lost.

We rebuild the index and correct the container header. What we CANNOT do is invent picture data that was overwritten - where frames are genuinely gone, the result says so rather than reporting a repair that changed nothing.

Each repaired file is checked for a real video track and an index that points inside the file, before it is called repaired.

The frame server reads the index first: frame count, keyframes, gaps and field steps are reported before a picture is drawn, and none is interpolated.

SWGDE Best Practices for Forensic Video Analysis s6.2 - frame-accurate access.

Presentation ticks, the decoded index and the recorder's overlay text are three fields and are never merged into one time. Bookmark what you see in your own words.

SWGDE s6.3 - timing recorded per frame; the recorder clock is text, not truth.

A few frames as PNG, each with its times, its source id, hash and extent and its own SHA-256, plus a hashed manifest. Never the video. Verify it before it leaves.

ISO/IEC 27042 s8 - derived items hashed and traceable to the original.

Point at the exhibit - a photo, a scan, an audio file or any file a payload might be hidden in. It is opened read only.

ISO/IEC 27037 7.5 - collection and preservation

The battery checks for appended data, embedded files, known stego-tool signatures and LSB payloads (chi-square for sequential embedding, RS analysis for a payload estimate). Each step is shown as it runs.

Where something is found, carve it out to a folder you pick. A carve is confirmed only when identifiable bytes come back; anything uncertain is labelled so, never overstated.

The verdict is graded clean, likely or confirmed, with the methods used and the honest limit: content-adaptive schemes need a trained model pack, which the tool says is not installed rather than missing silently.

The histogram buckets events by day (or another grain); an empty bucket is absent, never invented.

By date range, artefact type, source exhibit or free text.

Tag it or add it to a finding through the case's own door.

log2timeline/Timesketch CSV (l2tcsv) or JSON.

Only drives whose HARDWARE reports itself removable are offered, and the system disk can never be chosen. A drive that will not identify itself is refused rather than guessed at.

The portable kit (files only, nothing erased), a bootable stick made from a live ISO you supply (this ERASES the stick), or an ISO copied on for Ventoy.

We name the stick, its size and what will happen to it. Erasing needs an explicit yes and the server refuses without one, so the interface is never the only guard.

Written, then READ BACK and compared by hash - dying flash reports a happy write and stores something else, and you would find out standing at a machine that will not boot.

This is the file the VM uses as its hard disk. We read all the common ones.

Files from inside the disk, or the whole disk carved (for a deleted/corrupt VM).

Point us at the .vmdk/.vhdx/.vdi/.qcow2 file (or a copy of it).

A separate drive - never inside the virtual disk or its folder.

We open the virtual disk (`recover --image <file>`), read its filesystem, and recover files - including deleted ones. A snapshot chain is followed to its current state.

The bundled starter set (PEM key / PE / email / demo marker, no malware signatures), or your own .yar file or folder - a bad rule is reported, the rest of the set still saves.

Runs the enabled sets over the case's evidence with the real YARA engine (yara-python or the yara tool) - never a hand-rolled matcher.

Tag a hit or add it to a finding, with the matched rule, set and offset.

ISO/IEC 27037 7.6 - documentation