Forensics · deterministic, signed, re-runnable

Two regimes. One examiner.

Most forensic tools are black boxes that output a confident verdict you cannot reproduce. Obsign does the opposite: it states which regime you are in, and its analysis is itself deterministic, signed, and re-runnable - another examiner re-runs the exact pipeline and gets a bit-identical report.

Regime A · with a receipt

Certainty.

If the file carries an Obsign receipt, we know exactly what changed, where, and how - bit-for-bit, and the original is recoverable. Proof, not inference.

→ /prove · /verify

Regime B · no provenance

Calibrated evidence.

A bare file cannot be fully known - a skilled edit can leave no trace (that is a theorem). So we localize traces and report calibrated evidence with explicit limits. Never a verdict.

→ the panel below

Run the forensic panel

load a case or your own file

Real signed cases:

Drop your own image - analyzed locally, never uploaded

Limits. The honest scope appears here after a run.

The canonical, signed SDK report for this case (re-runs bit-for-bit):

suspicion (SDK)-

reproducesre-run with the SDK

signer-

receipt SHA-256-

The unifier - one answer about a file

obsign/forensic-report/v1

When a receipt is present, the two regimes fuse: Obsign checks the receipt is authentic and binds to this exact file (Regime A, certain), then layers the forensic read on everything the receipt does not cover (Regime B). It refuses to transfer a receipt's claims to a file it does not match.

verdict-

receipt integrity-

signature-

binds to file-

forensic (Regime B)-

A "binds" of file_sha256 means the receipt commits to the exact bytes of this file; the unifier's own report is signed and re-runnable too.

load a scenario...

The point

Deterministic findings are facts. Statistical ones are evidence. Only a receipt is proof.

Copy-move and editor-signature findings are exact and reliable. The statistical detectors (noise, CFA, resampling) are calibrated evidence that can false-positive on ordinary compressed photos - which is precisely why provenance matters. The unique thing here is that the whole analysis is deterministic and signed: re-runnable to the bit, the way forensic science is supposed to work. When you need certainty, attach a receipt.

Make it provable (Regime A) → Inspect Content Credentials

The canonical analyzer is the SDK: obsign forensic image.png --sign key.json - it localizes, calibrates, signs, and another examiner reproduces it bit-for-bit. This page is the on-device preview.