Open SourceDesktop AppForensics

Palimpsest

Metadata forensics toolkit. Extract hidden data from photos and videos, run deep forensic analysis, track suspects, and build evidence packages that hold up. Video-first. Built for investigators.

Download (.zip) View on GitHub

"A palimpsest is a manuscript where the original writing has been scraped off and written over, but traces of the old text remain underneath."

Just like metadata. You can try to erase it, but traces often remain.

Overview

Palimpsest is a desktop forensic toolkit that rips the hidden data out of photos and videos, runs deep analysis, tracks suspects, and builds evidence packages. Drop any file in and it extracts everything: camera model, GPS coordinates, timestamps, editing software, hashes, codec info, and more.

Video-first by design. Full H.264 transcoding via ffmpeg handles any format — MP4, AVI, MOV, MKV, WebM, MTS. Automatic frame extraction, frame-by-frame stepping, and a forensic video player with up to 32x zoom, brightness/contrast/saturation controls, color inversion, and gamma adjustment.

Built for investigators and advocacy communities documenting abuse networks. The forensic tools are general-purpose, but the workflow is designed around the real work: processing evidence dumps, connecting files to suspects, and generating reports that can be handed off to law enforcement.

2,730

Lines of Code

Forensic Modules

Export Formats

Tooltips

Forensic Suite

Scene Analysis Forensics Cross-Reference

Samples frames throughout a video. Builds HSV color histograms, measures brightness profiles and edge density, generates texture hashes. Scene Matching then cross-references these fingerprints across your library. Same floor, same walls, same light? Connected.

Watermark Detection Forensics Vision

Checks six standard overlay positions across multiple frames. Consistent high-contrast edges in the same position = a channel stamp, bot watermark, or redistribution mark. Reports confidence and consistency percentages. Reveals the sharing chain.

Encoding Chain Analysis Forensics

Calculates bits-per-pixel ratios, measures 8x8 block boundary artifacts, checks for non-standard resolutions and frame rates. Tells you whether a file is an original, a 1st-generation copy, or heavily re-encoded. Originals are the most valuable for investigation.

Screen Recording Detection Forensics Vision

Checks resolution against known phone screen sizes, analyzes top/bottom frame strips for status bar and navigation bar patterns. Identifies Telegram screen grabs vs original camera captures. Outputs a confidence percentage.

Lighting Analysis Forensics

Brightness and color temperature over time. Blue/red ratio for natural vs artificial classification. Flags very dark scenes, significant brightness changes, and unusual color temperatures.

Audio Fingerprinting Forensics Cross-Reference

Extracts audio via ffmpeg, normalizes to 16kHz mono. Computes spectral centroid, per-second energy profile, silence percentage. Audio Matching then finds videos with the same ambient sound signature. Same room = same background noise.

Features

🔍

File Analyzer

Drop any image or video. Extracts EXIF, GPS, camera info, hashes, codec data. Simple and Advanced modes.

🎬

Forensic Video Player

32x zoom, drag to pan, brightness/contrast/saturation/hue/gamma controls, color inversion, frame stepping.

🗃

Batch Processing

Drop a whole folder. Each file gets fully analyzed, hashed, thumbnailed, and frame-extracted automatically.

👤

Suspect Management

Profiles with aliases, platforms, threat levels, and typed identifiers. Link evidence to build case files.

📈

Side-by-Side Compare

Pick any two evidence items. Checks same camera, location, date, codec, resolution, and visual similarity.

📋

5 Export Formats

JSON (importable), PDF (law enforcement), CSV (spreadsheets), HTML (browser reports), Markdown (Discord/docs).

🔒

Multi-Algorithm Hashing

MD5, SHA-256, pHash, dHash, wHash, aHash. Perceptual hashes survive re-encoding and cropping.

🌐

GPS Map

Files with embedded coordinates plotted on an interactive map. Click markers for full details.

🔁

Duplicate Detection

Exact copies via SHA-256 and near-duplicates via perceptual hashing. Finds re-uploads across platforms.

📚

Interactive Tutorial

16-step walkthrough of the entire app. Full help page with written docs. 61 tooltips. Built for first-timers.

PythonFlaskOpenCVffmpegPillowimagehashscipyOpen Source

Installation

Option A: Download the .exe — grab the zip from Releases, extract, double-click. Bundles everything including ffmpeg. Three files total.

Option B: Run from source — Python 3.10+, pip install -r requirements.txt, install ffmpeg, run python palimpsest.py. Opens at 127.0.0.1:7700.

Screenshots

"Sorrow be damned and all your plans. Fuck the faithful, fuck the committed, the dedicated, the true believers; fuck all the sure and certain people prepared to maim and kill whoever got in their way; fuck every cause that ended in murder and a child screaming."

Iain Banks, Against a Dark Background