All questions and answers

No. The DVR calculator and TimeChex run entirely in your browser on your device. Times, INFO fields, camera images, and calculations are processed locally – nothing is sent to our servers and we have no access to what you enter. After confirmation, a watermark reading "TimeChex captured with Verified by Forensix.se" is burned into the evidence image, and a SHA-256 hash is computed for the exported JPEG and carried into the forensic report text. The evidence image is only saved when you choose to save it to your phone's photo album. Session measurements are stored temporarily in the browser's local storage on the same device and can be cleared with one tap.

We count aggregated page views via a dedicated Cloudflare Worker (no raw IP stored) and aggregated traffic in Cloudflare Analytics. This is only used to understand traffic patterns, countries, and most visited tools at an aggregated level. Every page view counts — not just the first visit. No investigation data or evidence is collected – all tools run locally on your device.

TimeChex and Forensix Cam may optionally look up an address from GPS coordinates via OpenStreetMap Nominatim. Only coordinates are sent – never images, video, or investigation data. Reference time may sync via NTP (time server). All image analysis, OCR, hashing, and conversion run locally without upload to Forensix.

Forensix Threat Intelligence is a public knowledge platform that aggregates RSS news and research on digital forensics, DFIR, deepfakes and digital evidence. Articles are summarized automatically (AI) and published as static JSON via GitHub Actions. Sensitive topics undergo human review. Threat Intelligence does not store investigation data and does not replace forensic tools — those still run 100% locally in the browser.

All teknisk rapportering vilar på primärkällsprincipen: officiella myndighetsbulletiner (CERT-SE, CISA, ENISA, Europol), verifierade säkerhetsrapporter eller publicerade CVE-bulletiner. Vi skiljer strikt på bekräftade tekniska fakta, rapporterade uppgifter och obekräftade påståenden från hotaktörer. Läs vår fullständiga Redaktionella policy.

Forensix tillämpar en transparent rättelsepolicy. Om en artikel innehåller sakfel eller missvisande uppgifter korrigeras detta skyndsamt med en tydlig rättelsenotis och tidsstämpel. Tips och rättelsebegäran kan skickas direkt till [email protected].

Ja, till 100 %. Inga sponsrade artiklar, betalda samarbeten eller dolda produktplaceringar förekommer i redaktionella texter. Urvalet styrs uteslutande av journalistisk relevans, teknisk substans och allmänintresse.

complies with established international standards: ISO/IEC 27037:2012 (digital evidence handling), ISO/IEC 27042:2015 (forensic analysis and interpretation), ISO/IEC 17025 (measurement uncertainty budget), SWGDE/ENFSI Best Practices for Digital Video Forensics, and RFC 5905 for NTP time synchronization.

calculates measurement uncertainty according to the GUM standard (ISO 17025) by combining reference clock uncertainty (NTP RTT or local clock), display quantization resolution, and reading method (manual vs OCR multi-frame). Uncertainty is reported as expanded uncertainty U with coverage factor k=2 (95% confidence level).

Yes – Forensix prepares reports as PDF/A-2b locally in your browser: XMP metadata (pdfaid:part/conformance), OutputIntent with embedded sRGB profile, and MarkInfo. No report is sent to the cloud for conversion. Files are labeled PDF/A-2b (prepared) – run your archive authority's validator (e.g. veraPDF) before long-term archiving or court use.

First verify the export type and time base. Then run controlled conversion with preserved metadata and document UTC/local time in the report.

UTC is used as the reference in the chain. Local time is shown in parallel with a clear offset to avoid misinterpretation.

Show measured reference time, displayed DVR time, offset, and direction in the same table, along with how the measurement was performed.

Yes. On Android, tap Add when the browser prompts you. On iPhone, open the page in Safari and choose Share → Add to Home Screen – we show a visual guide when you tap Add. The tools overview, TimeChex, and Forensix Cam can each be installed as separate apps. Install is always available under the More menu.

Forensix provides official Apple Configuration Profiles (.mobileconfig) for centralized IT deployment. IT administrators at law enforcement agencies can upload the profiles into Mobile Device Management systems (e.g., Microsoft Intune, Jamf Pro, or VMware Workspace ONE) to automatically deploy Forensix WebClips directly to investigators' duty devices with zero touch.

No, absolutely not. Forensix .mobileconfig profiles contain exclusively a 'WebClip' payload (com.apple.webClip.managed). They contain no network configurations, no VPN tunnels, no certificates, and possess zero technical permissions to read device data or monitor activity. They function purely as a secure, pre-configured Home Screen shortcut.

focuses on legal review, chain of custody, and reproducibility—not just fast conversion.

Yes. Timestamps and critical metadata are preserved and documented in report materials.

Yes. Support can be extended after technical validation of the format.

TimeChex only starts the camera when you tap Start camera. The camera view is shown as a split screen where the camera for the DVR time and the reference panel default to a 50/50 split (which you can adjust by dragging the divider up or down). OCR and time calculations run locally on your device via local AI models (PaddleOCR, ONNX and Tesseract.js LSTM) with multi-frame consensus for more stable results under motion blur, without the image ever leaving your browser. No external servers or cloud APIs are called for image analysis. Reference time may sync via NTP (an external time server) but no investigation data or images are transmitted. When you confirm the image, the watermark "TimeChex captured with Verified by Forensix.se" is added before export, and the SHA-256 hash of the finished evidence image is carried into the forensic report text. After confirmation, a single JPEG is offered via the share sheet – choose Save Image to add it to Photos. Forensix.se does not store, analyse, or have access to your images, locations, or time entries.

No. Data is processed locally in the browser and is not sent to forensix.se.

Yes. Both the DVR Calculator and Forensix TimeChex are Progressive Web Apps (PWA) that run completely locally in the browser. All image analysis, OCR readings, and time calculations are processed offline on your device – no internet connection or cellular coverage is required at the field. You can also install the tools overview (Forensix) as an app from the home screen for quick access to the tools.

Forensix Cam is a web-based documentation camera for photos and videos. The on-image layer shows optional INFO 1 and INFO 2 (e.g. case number and address), date, time, GPS, and compass – without labels for your own text. Time source (NTP or device) is documented in the report (PDF/JSON), not on the image. All processing runs locally in your browser – no image, video, GPS, or metadata is sent to Forensix. After capture, a report with SHA-256 and SHA-512 is generated automatically. Compass requires a phone with a magnetometer and permission; on most desktops it shows as unavailable. GPS is optional. You save files yourself via the share sheet; we store nothing. Verify later with the hash verifier.

Open the hash verifier and compare SHA-256 or SHA-512 against the report. You can also import a Forensix Cam JSON sidecar for videos.

Yes. Add to your home screen as a PWA – camera, sensors, and export work without a network. NTP sync for reference time runs at start when online and is noted in the report, not on the image.

No. All analysis runs locally in the browser. Nothing is uploaded to Forensix.

Integrity Lab shows two equal scores: Manipulation (splice/edit in authentic photos) and Provenance (synthetic or fully generated origin). Independent examinations return risk and confidence per axis. Hash is shown separately — it measures byte integrity, not content origin.

A JSON fingerprint with hashes, markers and method version. Export and compare profiles to see exactly what changed over time.

The hash verifier checks that a file is unchanged. Integrity Lab assesses authenticity indicators in image content and shows each observation transparently.

Yes, marginally — image decoding can differ across environments. Reports document engine version and runtime so comparisons use the same conditions.

C2PA is an embedded provenance manifest (JUMBF) in JPEG/PNG that can declare digitalSourceType, software agents and edit history. Integrity Lab reads the manifest locally and flags explicit AI declarations — but does not validate COSE signatures in this version. Missing manifest does not prove a camera origin.

On receipt, before analysis, and after export to secure integrity in the chain of custody.

It provides early indication of format, time fields, and technical quality before in-depth analysis.

It standardizes time reporting and reduces the risk of misunderstanding in legal documents.

No. OCR is assistive and results must always be verified by the user before reporting.

No. Converter Online analyzes and processes the file locally in the browser and does not upload video data to forensix.se.

You get a clear technical reason in the tool, such as codec or browser support limitations.

The tool tests all imported video files and converts locally when the browser's local encoding support is sufficient.