Forensics · deterministic, signed, re-runnable

Two regimes. One examiner.

Most forensic tools are black boxes that output a confident verdict you cannot reproduce. Obsign does the opposite: it states which regime you are in, and its analysis is itself deterministic, signed, and re-runnable - another examiner re-runs the exact pipeline and gets a bit-identical report.

Regime A · with a receipt

Certainty.

If the file carries an Obsign receipt, we know exactly what changed, where, and how - bit-for-bit, and the original is recoverable. Proof, not inference.

→ /prove · /verify
Regime B · no provenance

Calibrated evidence.

A bare file cannot be fully known - a skilled edit can leave no trace (that is a theorem). So we localize traces and report calibrated evidence with explicit limits. Never a verdict.

→ the panel below

On AI-generated detection. We measured supervised AI-gen image detectors on real, independent datasets -- they do not generalize across generators. A forensic engine must never be confidently wrong, so Obsign does not ship a bare classifier: it reports calibrated evidence and gates the claim, never a verdict. And the same reproducible, signed examiner runs on video -- frame by frame, with a Merkle inclusion proof for any single frame.

Run the forensic panel

load a case or your own file
Real signed cases:
Drop your own image - analyzed locally, never uploaded
Limits. The honest scope appears here after a run.

The unifier - one answer about a file

obsign/forensic-report/v1

When a receipt is present, the two regimes fuse: Obsign checks the receipt is authentic and binds to this exact file (Regime A, certain), then layers the forensic read on everything the receipt does not cover (Regime B). It refuses to transfer a receipt's claims to a file it does not match.

verdict-
receipt integrity-
signature-
binds to file-
forensic (Regime B)-
A "binds" of file_sha256 means the receipt commits to the exact bytes of this file; the unifier's own report is signed and re-runnable too.
load a scenario...
The point

Deterministic findings are facts. Statistical ones are evidence. Only a receipt is proof.

Copy-move and editor-signature findings are exact and reliable. The statistical detectors (noise, CFA, resampling) are calibrated evidence that can false-positive on ordinary compressed photos - which is precisely why provenance matters. The unique thing here is that the whole analysis is deterministic and signed: re-runnable to the bit, the way forensic science is supposed to work. When you need certainty, attach a receipt.

Make it provable (Regime A) → Inspect Content Credentials
The canonical analyzer is the SDK: obsign forensic image.png --sign key.json - it localizes, calibrates, signs, and another examiner reproduces it bit-for-bit. This page is the on-device preview.