Dashboard
Your investigation at a glance
Camera Distribution
Codec Distribution
Recent Evidence
File Analyzer
Drop or select a file to extract and analyze all its hidden metadata
Batch Process
Analyze many files at once. Great for dumping an entire folder.
Side-by-Side Compare
Pick two evidence items and see what they have in common
Duplicate Detection
Find exact copies (same hash) and near-duplicates (visually similar). Works across videos and images.
Evidence Library
Every file you've imported. Click any row to see full details.
| File | Type | Duration | Codec | Date | GPS | Strip | Suspect |
|---|
Timeline
Evidence sorted by when it was originally captured. Useful for establishing sequences.
GPS Map
Files with embedded GPS coordinates plotted on a map. Click markers for details.
Suspects
People of interest. Link evidence to them to build a case.
Add Suspect
Hash Lookup
Paste any hash (MD5, SHA-256, or perceptual) to find matching evidence in your library.
Forensic Analysis Suite
Deep analysis beyond basic metadata. Run scene matching, audio fingerprinting, watermark detection, encoding chain analysis, screen recording detection, and lighting analysis.
Analyze Single File
Select an evidence item and run all forensic modules on it.
Batch Forensics
Run forensics on all evidence that hasn't been analyzed yet. This can take a while for large libraries.
What each module does
- Scene Analysis. Builds a color, brightness, and texture fingerprint of the environment. Used to find videos filmed in the same room.
- Watermark Detection. Looks for consistent overlays in the corners or edges of frames (channel names, bot stamps, redistribution marks) and reveals the sharing chain.
- Encoding Chain Analysis. Reads compression artifacts, bitrate ratios, and block boundaries to estimate whether a file is an original or a re-encoded copy, and roughly how many generations it's been through.
- Screen Recording Detection. Tells you if a video was screen-grabbed from a phone app like Telegram instead of captured by a camera. Checks for status bars, navigation bars, phone-screen resolutions, and frame-rate patterns.
- Lighting Analysis. Tracks brightness and color temperature over time, distinguishing natural from artificial light and giving you a rough sense of indoor versus outdoor and time of day.
- Audio Fingerprinting. Pulls the audio out, builds a spectral fingerprint, and uses it to match videos recorded in the same room by their ambient sound. Needs ffmpeg installed.
Scene Matching
Find videos that appear to be filmed in the same location based on color, brightness, and texture analysis. Run forensics on your evidence first.
Audio Matching
Find videos with matching audio environments. Same room, same background noise. Requires ffmpeg for audio extraction.
⚡ ENF Analysis
Electrical Network Frequency. Detects the power grid frequency embedded in a recording, 50Hz or 60Hz, and uses it to narrow geographic region. Court-accepted forensic technique.
How ENF Works
AC power grids oscillate at either 50Hz (Europe, Asia, Africa, Oceania) or 60Hz (Americas, parts of East Asia). This frequency gets embedded in recordings through electromagnetic interference from power lines and through indoor lighting flicker. ENF analysis extracts this signal to narrow geographic region without any metadata.
ENF Summary
ENF Results by Evidence
Run forensics on your evidence (Forensic Suite > Batch Forensics) to generate ENF analysis data.
ENF Grid Matches
Videos recorded on the same power grid at the same time will have matching ENF fluctuation patterns.
Metadata Groups
Group evidence by shared metadata fields to map the distribution pipeline. Who recorded, who re-encoded, who distributed.
AI Vision Analysis
Send extracted frames to an AI vision model (Claude, GPT, Gemini) for forensic analysis. Identifies power outlets, visible text, room features, and geographic clues.
Analyze Evidence
Select an evidence item with extracted frames. The AI will analyze each frame for forensic indicators.
Previous AI Results
Select an evidence item to view stored AI analysis results.
⚙ AI Settings
Configure your AI provider, API key, and model for vision analysis.
Provider Configuration
Analysis Prompt
The prompt sent with each frame. Customize for your investigation focus.
Cost Tracking
Export & Import
Download evidence packages or import from another Palimpsest instance.
JSON Export
Machine-readable. Full metadata, hashes, and forensic results. Good for importing into another Palimpsest or feeding to other tools.
PDF Report
Formatted evidence report. Professional enough for law enforcement handoff.
CSV Spreadsheet
Opens in Excel, Google Sheets, or any spreadsheet app. One row per evidence item. Good for sharing with people who don't have Palimpsest.
HTML Report
Standalone web page. Opens in any browser, no software needed. Email it to anyone. Dark themed, same Palimpsest look.
Markdown Report
Clean text report. Good for pasting into Discord, docs, GitHub issues, or anywhere that renders markdown.
Import Palimpsest Data
Load evidence from someone else's Palimpsest JSON export into your instance. Suspects are imported too. Duplicates (same SHA-256) are skipped automatically.
Help & Tutorial
Everything you need to know about Palimpsest
What is Palimpsest?
Palimpsest is a metadata forensics toolkit. When someone takes a photo or records a video, the file contains hidden data: what camera was used, when it was taken, GPS coordinates, software used to edit it, and more. This tool extracts, analyzes, and organizes all of that data to support investigations.
The name comes from a palimpsest, a manuscript where the original writing has been scraped off and written over, but traces of the old text remain underneath. Just like metadata: you can try to erase it, but traces often remain.
Getting Started
- Step 1: Go to File Analyzer and drop a photo or video. Palimpsest will extract everything hidden inside it.
- Step 2: Review the results. Simple Mode explains each field in plain English. Advanced Mode shows raw technical data.
- Step 3: Your file is now in the Evidence Library. You can search, filter, and organize it.
- Step 4: Create Suspects and link evidence to them to build case files.
- Step 5: Go to Forensic Suite and run batch forensics. Then check Scene Matching and Audio Matching for connections.
- Step 6: Use Export & Import to generate reports in any format, or import evidence from a teammate's Palimpsest export.
Features Explained
- File Analyzer. Drop any image or video. Palimpsest pulls EXIF, GPS coordinates, camera info, hashes, and flags signs of metadata stripping. Videos also get eight frames extracted automatically for visual review.
- Simple vs Advanced Mode. Simple mode walks you through each metadata field in plain English. Advanced mode shows the raw data for people who already know what they're looking at.
- Batch Process. Point it at a whole folder. Each file gets fully analyzed. Useful for working through evidence dumps in one pass.
- Compare. Pick any two evidence items and Palimpsest checks whether they share the same camera, location, date, codec, resolution, or visual similarity.
- Duplicate Detection. Finds exact copies (identical SHA-256) and near-duplicates (visually similar via perceptual hashing). Works across both videos and images.
- Evidence Library. A searchable, filterable table of everything you've imported. Filter by media type, GPS presence, or stripping flags. Click any row for the full record.
- Timeline. All dated evidence sorted chronologically, useful for establishing event sequences.
- GPS Map. Files with embedded GPS coordinates plotted on an interactive map.
- Suspects. Build profiles with names, aliases, platform info, threat levels, and typed identifiers (Telegram handles, crypto wallets, emails, Discord tags). Link evidence to suspects to assemble case files.
- Hash Lookup. Paste any MD5, SHA-256, or perceptual hash and get back matching evidence.
- Export & Import. Five export formats: JSON (machine-readable, importable into another Palimpsest), PDF (handoff to law enforcement), CSV (spreadsheets, shareable with anyone), HTML (standalone dark-themed report, opens in any browser), and Markdown (paste into Discord or docs). Import works in reverse: load someone else's Palimpsest JSON into yours, suspects come along, duplicates auto-skip by SHA-256, every export filterable by suspect.
- Forensic Suite. Deep analysis beyond basic metadata. Scene analysis fingerprints the environment. Watermark detection finds channel stamps and bot overlays. Encoding chain analysis estimates whether a file is an original or a re-encoded copy. Screen recording detection flags Telegram screen grabs. Lighting analysis characterizes the environment. Audio fingerprinting matches videos by ambient sound.
- Scene Matching. Once you've run forensics, this compares environment fingerprints across your whole library to surface videos shot in the same room.
- Audio Matching. Compares audio fingerprints. Same background noise, same room. Needs ffmpeg.
- ENF Analysis. Electrical Network Frequency. AC power grids oscillate at 50Hz (Europe, Asia, Africa, Oceania) or 60Hz (Americas and parts of East Asia), and that frequency gets baked into recordings through electromagnetic interference and indoor lighting flicker. ENF analysis pulls the signal out and narrows geographic region with no metadata required. Court-accepted forensic science.
- Metadata Groups. Groups all evidence by shared metadata fields (comment, encoder, codec plus resolution plus fps, file size) so you can map the distribution pipeline. Same comment means same recording tool. Same encoder means same encoding software. Same chain means same batch processing.
- AI Vision. Sends extracted frames to Claude, GPT, or Gemini for forensic analysis. The model picks out outlet types (which narrows country fast), visible text and language, room features, lighting fixtures, vegetation, and other geographic clues. Shows a cost estimate before running. Supports Anthropic, OpenAI, Google, OpenRouter, and custom endpoints.
- AI Settings. Configure your provider, API key, model, and custom analysis prompt. Tracks total tokens and cost across every run.
What is Metadata Stripping?
When someone wants to hide where a photo or video came from, they can use tools to remove ("strip") the metadata. Palimpsest looks for signs this has happened:
- No EXIF data at all (most cameras always embed it)
- Camera info present but dates removed (selective stripping)
- Editing software detected (Photoshop, GIMP, etc.)
- Modification date different from capture date
- Minimal video container data (re-encoded to strip)
A stripping warning doesn't prove anything on its own, but it's a red flag worth noting.
What are Perceptual Hashes?
Regular hashes (MD5, SHA-256) change completely if even one pixel is different. Perceptual hashes (pHash, dHash, etc.) create a "visual fingerprint" of what the image looks like. Two photos of the same scene will have similar perceptual hashes even if one was cropped, compressed, or resized.
This is how Palimpsest finds near-duplicates, and it's why the same re-uploaded video can be tracked across platforms even if it's been re-encoded.
Dependencies
Palimpsest needs these Python packages. All are pip-installable, no external DLLs:
- Flask. Web framework. Runs the local UI.
- Pillow. Image EXIF extraction.
- imagehash. Perceptual hashing (pHash, dHash, wHash, aHash).
- opencv-python-headless. Video analysis, frame extraction, thumbnails, forensic vision.
- hachoir. Video container metadata: creation dates, codecs, encoder info.
- numpy. Numerical processing for the forensic modules.
- scipy. Audio spectral analysis and signal processing.
- ffmpeg. Audio extraction from video. Install separately, it's not a Python package. Download from ffmpeg.org.
- reportlab. PDF report generation. Optional.
Click here to check your dependencies
About
Palimpsest is part of the investigation toolkit ecosystem built by Ephemera.
Website: ephemeradev.net
GitHub: github.com/ephemera02
This tool is free and open source. If it helps your work, that's all that matters.