SakshyaYantra · Digital forensics

Evidence, from the disk to the courtroom

The whole forensic platform in one console: verified imaging, artefact analysis and a timeline; an agent for live acquisition, estate sweeps and queued collections; and video evidence, decoded, examined frame-exact, redacted and certified.

How to get Forensic Suite Specifications

Licensed by a key bound to one machine, sold by the drive or image.

Who it is forExaminers, investigators, incident response teams and forensic laboratories - from a single case to an organisation-wide estate.

New in 7.8.10.76

What this release adds to SakshyaYantra Forensic Suite

Each item is in the shipping build of this product; the others in the range that carry it are named on the card.

The recorder view

A recorder disk opens on its vendor index: cameras down the left, time across, play from the disk, cut from-to, download, extract one camera, enhance, capture a frame, report. In every product that carries CCTV.

Ex01 and AFF4 images read as sources

Alongside raw dd, .img, .iso and E01, an image can now be read from an EnCase Ex01 or an AFF4 container and recovered from exactly as from any disk image. Output stays raw or E01, hashed on read and verified after write.

Filesystem-aware imaging with an entropy map

Imaging can copy only the areas the file system marks in use and read the rest as an entropy map, so an almost-empty or already-encrypted drive is imaged in a fraction of the passes a full sector copy would take. The full copy stays available.

Hardware-RAID metadata and assembly

A RAID array is reassembled from its own DDF and vendor controller metadata where it is present, so level, order and stripe size do not have to be guessed; the parameters can still be set by hand when the metadata is gone.

Evidence player and frame pack

Clips play from the disk. A frame pack - a few captured frames, each with its presentation time, decoded index, overlay time, case time, channel, source hash and its own SHA-256 - is the only unit that leaves the machine. Never the video.

Three times, never merged

The stream's presentation time, the recorder's overlay text and the case time are separate fields with separate uncertainty, on screen, in the pack and in the report.

Sealed reading before AI

The examiner's own reading is sealed before any model answer is shown. A model's response is an AI observation - model, version, prompt, input hashes, time, verbatim text - never a finding unless a reviewer promotes it by a typed decision.

AI optional: none, local or cloud

Three modes in every build: none, a local model pack with no internet, or cloud behind a per-agency switch that is off by default, with a transfer manifest of every frame digest that left.

Enhancement beside the original

An enhanced frame is shown beside the original, never instead of it, with the chain of operations printed beneath and both exported.

Authenticity, plates, registry, certificate

Authenticity checks with every method ranked, number-plate assistance, registry intake, and the certificate under Section 63(4) of the Bharatiya Sakshya Adhiniyam 2023.

The modules

Amped’s whole line, plus EnCase-class case and platform, in one product.

The Forensic Suite opens on a launcher, and every block below is a module of the same build - not a separate purchase. Where a module answers a tool an examiner already knows, that tool is named; where our depth is still growing, the module says so, because a police buyer reads this.

Footage

Getting the video off the recorder, readable, and seen

Footage & Convert

Open a seized recorder and see the footage the way the recorder saw it.

A DVR or NVR disk opens on its own vendor index, not a pile of carved clips. The decode ladder shows exactly how each stream was read, so nothing about the footage is taken on trust, and batch conversion turns a shelf of exhibits into reviewable video.

The recorder's own channel and camera layout, from its index
A decode ladder that records how every stream was opened
Batch conversion across many exhibits at once
A coverage view of what was found and what was not

Equivalent to DVRConv + Engine + FIVE convert. We go further by making the decode ladder part of the evidence; the breadth of proprietary formats keeps growing with our registry.

Recorder view, decode ladder and batch are built; the breadth of formats grows with the registry.

Enhance & Measure

Make the plate, the face or the logo legible - with the original always beside it.

Enhancement runs with the source frame next to the result and the exact chain of steps printed beneath, so an improvement can always be traced back. Capture the frame you need, and measure a real distance on a calibrated plane.

The original and the enhanced frame side by side, never one instead of the other
Every filter in the chain printed beneath the result
Single-frame capture into a frame pack
Calibrated measurement of distance or height on a plane

Equivalent to FIVE (restore, enhance, measure). We go further by sealing the chain into the case record. FIVE's filter library is broader than ours today, and our enhance module is still growing.

Slider enhance, frame capture and plane measure are built; filter breadth is the growing edge.

Review Player

Play the evidence, cut the moment that matters, and hand it over redacted.

Clips play straight from the exhibit disk. Mark an in and an out, download just that segment, and put two exhibits side by side to compare. Faces and plates can be masked before anything is disclosed.

Playback direct from the recorder disk
Cut from-to and download only the segment you need
Two exhibits compared frame for frame
Redaction of faces and plates before disclosure

Equivalent to Replay. We go further by keeping the recorder time, the overlay text and the case time as three separate fields. Model-assisted redaction is on the licensed or roadmap edge.

Player, recorder play, cut and download, and compare are built; model-assisted redaction is on the licensed or roadmap edge.

Analysis

What the picture is, and whether it can be trusted

Authenticate

Answer the question the court will ask: is this footage real?

Integrity, tamper and camera-identification checks run as a framework, each method ranked and written into the case, so an authenticity opinion rests on recorded tests rather than a single glance.

Integrity and container checks
Tamper and manipulation indicators
Camera-identification tests
Every method ranked and recorded against the exhibit

Equivalent to Authenticate. We go further by recording every method's result in the case file. The depth of classical-image methods is our growing edge.

The integrity, tamper and camera-identification framework is built; classical-image method depth is the growing edge.

Plate

Work a number plate as evidence, never as a guess.

Plate work runs as a lifecycle - capture the frame, prepare it, submit it - so a reading is always shown with how it was reached, and never presented as a settled fact.

Capture the plate frame into the case
Prepare and enhance it with the chain kept
Submit for recognition as an assisted step
A reading always shown as assistance, not a fact

Equivalent to DeepPlate. We go further by keeping the whole lifecycle in the case record. The recognition model is local and optional, or a licensed service.

The capture, prepare and submit lifecycle is built; the recognition model is local and optional, or a licensed service.

AI observations

Ask a model about a frame - after your own reading is already sealed.

A model may be asked about a frame pack, but only once the examiner's own reading is sealed. Whatever it says is recorded as an observation, with its model, prompt and input hashes, and is never promoted to a finding on its own.

The examiner's reading sealed before any model is asked
Model, prompt and input hashes recorded with every answer
Three modes: none, a local pack, or cloud behind an off-by-default switch
An observation, never a finding, until a person decides

Beyond Amped. This is built to keep AI out of the evidence unless a person puts it there - which is why it goes past their only AI feature.

Optional in every build: none, a local model pack, or cloud behind a switch that is off by default. Beyond Amped.

Case

What travels out of the machine, and what signs it

Case & Report

Turn the work into a case file a court will accept.

The case is locked and versioned, findings are recorded against the exhibits they came from, and the report carries the evidence certificate under Section 63(4) of the Bharatiya Sakshya Adhiniyam 2023.

A locked, versioned case with a custody line
Findings recorded against the exhibit they came from
A dated report in PDF, Word or HTML
The S.63(4) BSA 2023 evidence certificate

Equivalent to the peer-review project in FIVE, exceeded. This goes past their peer-review project: the case, the findings and the statutory certificate are one signed record.

Case lock and versions, findings, report and the S.63(4) certificate are built. Beyond Amped.

Frame Pack

Send a few hashed frames - never the whole video - out of the building.

The frame pack is the only unit that leaves the machine: a handful of captured frames, each with its times, its hash and its source extent, wrapped in a hashed manifest. The video itself stays put.

A few captured frames instead of the whole recording
Each frame with its time, hash and source extent
A hashed manifest that travels with the pack
Download, report or send to a model - by the same unit

Beyond Amped. This is our evidence-transfer unit, and it is what keeps a review honest from the disk to the disclosure.

Built. Beyond Amped.

Registry

Know exactly what the bench is holding, and where each exhibit is.

Exhibits arrive through an intake and sit in a queue with their custody line, so a busy bench always knows what it holds and what state each item is in.

A single intake for arriving exhibits
A queue with each item's custody line
At-a-glance state for everything on the bench

Beyond Amped. The registry is what makes a multi-exhibit bench accountable.

Intake and queue are built.

Amped Software, OpenText EnCase, Magnet AXIOM and Exterro FTK product names are used to say what a module is for, and belong to their owner. The software itself uses our own names throughout.

Typical cases

What this product is bought for

If the situation below matches yours, this is the right product. If none of them do, another product in the range is likely to be a closer fit, and the last section on this page says which.

A machine that has to be acquired cannot be switched off, or cannot be visited.

Something has been found on one machine and the question is where else it is.

A recorder export has to be read, hashed and decoded so that every frame shown later can be traced to it, or a bystander's face must be masked before disclosure.

An investigation needs an ordered account of what happened on a device and when, with chain of custody from acquisition through to the report.

Key points

How SakshyaYantra Forensic Suite is built

Defensible from acquisition to export

Images are hashed and verified, every exported frame carries its own hash and provenance, and the audit trail is hash-chained end to end.

One console for a whole estate

Search every enrolled machine for a filename, an exact SHA-256 or a string inside files, freeze and acquire one that cannot be switched off, and queue the ones that are away.

Three clocks, never merged

A frame's presentation ticks, the recorder's overlay text and the case time stay separate fields with their own uncertainty, on every frame.

Capabilities

What SakshyaYantra Forensic Suite does

Verified acquisition

Raw, E01 and AFF4 images, hashed on read and verified on completion, with a software write block where supported.

Artefact analysis

Windows event logs, registry, Prefetch, ShimCache, BAM, SRUM, Jump Lists, LNK, Recycle Bin, browser history, Windows Timeline, plus Linux and macOS artefacts.

Combined timeline

$MFT and $LogFile records, artefacts and file system times merged into one ordered sequence.

Memory analysis

Process lists, network connections, loaded modules, handles and injected-code detection from a memory image.

Live acquisition

A volume is frozen on the endpoint and imaged across the network. The snapshot is verified unchanged across the whole acquisition, and released afterwards.

Sweep across endpoints

One question asked of every enrolled machine at once: a filename, an exact SHA-256, or a string inside files. Results are paths and sizes, never file contents.

An installer you can push

A Windows MSI with your console address and pairing key already in it, installing silently as a service. Group Policy, Intune and SCCM.

Queued collections

Machines that are away stay queued with the operator and the reason, and are collected when they return.

Decode ladder for recorder and phone footage

Container, index, raw stream and then salvage, with the rung that produced each frame recorded and reported. A recorder registry carries signed entries for tested makes and models.

Frame-accurate review and the frame pack

Step by frame or keyframe with gaps reported, never interpolated. A frame pack of hashed PNGs with pts ticks, overlay text, case time, source id and hash leaves the machine - never the video.

Redaction, enhancement and authenticity

A mask across frames released only on a named reviewer's typed decision; a recorded processing graph of validated enhancements shown beside the original; an authenticity workbench that ranks hypotheses with their evidence; plate assistance from a signed local model pack.

Reports, custody and the draft certificate

A report with per-item hashes, a hash-chained custody record from acquisition onward, and the Section 63(4) certificate drafted from the case's own records with typed review states.

Workspaces in this build

These are the workspaces the application contains. Anything not listed is absent from the build; it is not present and locked behind the licence.

Forensic examination and reporting
gallery
geo
Recover files from disks, cards and images
Image a failing drive
CCTV and DVR footage
Mailbox recovery (Outlook PST/OST, mbox, Maildir)
Database row extraction
Image a drive over the network
Cloud account recovery
nandrecon
raid
Detect every connected device, with a report
footage
review
redact
export
medialab
authenticity
plate
stego
view
timeline
memory
link
hashset
keyword
ingest
yara
casehub
crosscase
casequery
recorders

The rest of the range

This page lists what the product does. Every capability across the whole range is one table, side by side, generated from the build itself - a job this product does not carry is simply in another column. Hardware cases - drives that do not spin, locked phones, encrypted volumes - are covered in the hardware help guide.

Compare all products

Partner access

Get SakshyaYantra Forensic Suite

Supplied to approved RecoverYantra partners. Apply once; your dashboard then carries every product, the licence keys for your machines and a direct line to our engineers.

Become a partnerTell us about your business. Applications are reviewed by a person, and you will hear from us by email.

Apply for access

Already a partnerSign in for the current build, your keys and support.

Partner sign in

Version 7.8.10.76Windows 10 or 11, 64-bitRead-only against your drives

System requirements

Windows 10 or 11, 64-bit
Administrator rights to read a physical drive. Working from a disk image needs none.
A separate destination with room for the recovered data. Results are never written to the drive being read.

Linux

The engine is standard-library Python and runs on Linux from source. A packaged Linux build is available on request.

Specifications

SakshyaYantra Forensic Suite at a glance

Product	SakshyaYantra Forensic Suite, version 7.8.10.76
Platform	Windows 10 and 11, 64-bit. Administrator rights are needed to read a physical drive; working from a disk image needs none.
Workspaces included	33 of 15 in the range: Forensic examination and reporting, gallery, geo, Recover files from disks, cards and images, Image a failing drive, CCTV and DVR footage, Mailbox recovery (Outlook PST/OST, mbox, Maildir), Database row extraction, Image a drive over the network, Cloud account recovery, nandrecon, raid, Detect every connected device, with a report, footage, review, redact, export, medialab, authenticity, plate, stego, view, timeline, memory, link, hashset, keyword, ingest, yara, casehub, crosscase, casequery, recorders
File types recovered	261 formats carried in the signature table, searched together with file system parsing.
Access to the source	Read-only for the whole session. The application refuses a destination on the drive being read.
Licensing	A signed key bound to this machine's code, verified offline. Sold by the source: one use is one drive or image, and the same source is free afterwards. No account and no network access at any point.
Before a key	Scan, browse and preview without a key; the key is asked for when files are first saved from a source.
Dependencies	None. A single executable, with no runtime, framework or third-party package to install.
Companion programs	RecoverYantra Agent (RecoverYantra-Agent.exe), installed beside the command line - Runs on the machine being acquired: serves its disks and snapshots read-only to a console holding the pairing key, reports the machine to the roster. Installed by the MSI the console builds (remote package --msi), or run by hand.
How it is supplied	Through the partner programme. The build is 869 MB; its SHA-256 is shown beside the download in your partner dashboard.

Where the rest of the range fits

These products carry workspaces SakshyaYantra Forensic Suite does not. The list is derived from the catalogue, so it cannot point at a product that lacks the capability too.

RecoverYantra SuiteEvery RecoverYantra data-recovery capability in one place

SakshyaYantra Mobile WorkbenchAcquire the phone as evidence

RecoverYantra MobileGet the data off the phone