Forensight is an advanced image OSINT and video-call inspection toolkit built for investigative and analytical workflows. It allows you to extract metadata, perform reverse searches, detect objects and faces, run OCR, inspect image integrity, and analyze suspicious full-screen video calls directly from the command line.
Version 2.0 introduces Fake Video Call Detection (FVCD) as a major feature.
This update adds a real-time workflow for inspecting suspicious video calls by:
- calibrating against a good-quality real video baseline
- analyzing audio and visual anomalies
- detecting suspicious freeze / repeat / motion inconsistency patterns
- producing a readable final assessment
- explaining why a call was flagged as real, uncertain, suspicious, or likely fake
Forensight v2.0 is now both an image OSINT engine and a real-time fake video call inspection tool.
Forensight is a comprehensive OSINT toolkit designed for investigators, analysts, and researchers. Its features include:
- Inspect full-screen video calls in real time.
- Calibrate the detector using a clear real video before detection starts.
- Analyze audio and video behavior for suspicious deviations from the real baseline.
- Detect:
- freeze-like visual behavior
- repeated frame patterns
- unnatural motion consistency
- severe video anomalies
- Produce readable result labels such as:
LIKELY REALUNCERTAIN / NO SIGNALUNCERTAINSUSPICIOUSPOSSIBLE FAKELIKELY FAKELIKELY FAKE (VIDEO OVERRIDE)
- Display a human-readable explanation of what made the call look real or fake.
- Read, write, and manipulate images in multiple formats, including advanced formats like AVIF.
- Resize, crop, rotate, and convert images.
- Compute image hashes for duplicate detection or similarity analysis.
- Extract and analyze EXIF/XMP metadata from images.
- Attempt best-effort recovery of missing or stripped metadata.
- Perform automated reverse image searches.
- Retrieve geolocation, timestamps, and other embedded information.
- Detect objects and people in images.
- Recognize scenes and generate descriptive captions.
- Classify images and extract visual features.
- Supports GPU acceleration for faster processing (optional).
- Detect and locate faces in images.
- Count faces and highlight them with bounding boxes.
- Compare faces against reference datasets where configured.
- Extract printed and handwritten text from images.
- Recognize multi-language text depending on configuration.
- Analyze numeric and tabular data associated with images.
- Map geolocated images and generate interactive visualizations.
- Create detailed investigation reports.
- Sign investigation data for integrity verification.
- Encrypt sensitive files to protect investigation materials.
- Validate signatures to ensure authenticity.
- User-friendly command-line interface for workflow automation.
- Display progress, logs, and status updates in the terminal.
- Combine multiple operations in a single run.
- Flexible argument parsing for customized workflows.
The Fake Video Call Detector in Forensight v2.0 is heuristic-based and works in two stages:
Before detection begins, the user is asked to switch to a good-quality real video with:
- a clear visible face
- decent lighting
- a stable image
- the video filling as much of the screen as possible
During this stage, the detector measures what a normal real baseline looks like.
It records:
- audio baseline
- video baseline
This allows the detector to compare future signals against a known real reference instead of blindly guessing.
After calibration is complete, the detector pauses and asks the user to switch to the full-screen video call they want to inspect.
Once detection resumes, it analyzes:
The detector looks at:
- spectral flatness
- peak distribution
- energy stability
This helps it estimate whether the audio behavior is natural or suspicious.
The detector looks at:
- repeated frame behavior
- freeze-like frame similarity
- motion consistency using optical flow
- moiré / texture instability
- face visibility and face size on screen
These signals are fused into a final anomaly score.
The detector combines audio and video evidence and produces:
- a label
- a confidence score
- a signal summary
- a readable explanation of why the session looked real or suspicious
The detector works best when:
- the calibration video is genuinely real
- the face is clearly visible
- the target video call remains full-screen
- the user does not switch away from the call screen during detection
The detector may return UNCERTAIN / NO SIGNAL if:
- the face is not visible
- the video call is too small
- the screen changes during detection
- signal quality is too weak to judge reliably
Example of Forensight running a metadata extraction and OCR workflow.
Demonstrates a full workflow: metadata extraction → OCR → face detection → mapping.
Press Win + X → Windows Terminal (Admin) or search for PowerShell, right-click → Run as administrator.
winget install --id Git.Git -e --source winget
--id Git.Git → Specifies the official Git package -e → Exact match
--source winget → Ensures it uses the official repository
git --version
You should see something like:
git version 2.41.0.windows.1
https://www.python.org/downloads/windows/
Click Download Python 3.11
-
Open the downloaded .exe file.
-
Important: Check “Add Python 3.11 to PATH” at the bottom.
-
Click Install Now.
-
Wait for the installation to complete and click Close.
Press Win, type Git Bash, and open it.
git clone https://github.com/spider863644/Forensight.git
cd Forensight
python -m venv venv
venv\Scripts\activate
pip install pycryptodome
pip install -r requirements.txt
Important for Windows users: Installing face_recognition on Windows can be tricky because it depends on dlib. Follow these steps carefully:
- Install Visual Studio Build Tools 2019 or 2022 (ensure "Desktop development with C++" workload is selected).
- Download the precompiled wheel for dlib that matches your Python version from https://www.lfd.uci.edu/~gohlke/pythonlibs/#dlib.
- Install the wheel manually, e.g.:
pip install path\to\dlib-19.24.0-cp311-cp311-win_amd64.whl
- Finally, install face_recognition:
pip install face_recognition
sudo apt update && sudo apt upgrade
sudo apt install git
sudo apt install python3
git clone https://github.com/spider863644/Forensight.git
cd Forensight
python -m venv venv
source venv/bin/activate
sudo apt update
sudo apt install tesseract-ocr -y
pip install pycryptodome
pip install -r requirements.txt
sudo apt install -y cmake g++ make python3-dev
sudo apt install -y libboost-all-dev
Now simply run
pip install face_recognition
python3 main.py --help #Linux
python main.py --help #Winndows
Forensight is for personal and educational purposes. Please do not redistribute, modify, or use it commercially without permission. Credit must always be given to the original author.
Forensight was conceptualized, developed, and maintained by Spider Anongreyhat.
All core code, workflows, and OSINT techniques implemented in this project are the work of the author.
Special thanks to the developers of the libraries used: Pillow, OpenCV, face_recognition, YOLOv8, BLIP, pytesseract, and others that made this toolkit possible.
“Built for investigative and educational OSINT. Always give credit where it’s due.”
