Case file inventory
SHA-256 + provenance summary| File | Format | SHA-256 | AI / provenance | Location | |
|---|---|---|---|---|---|
| Add files to begin. | |||||
Metadata relationship clusters
0Files are grouped when two or more files share the same meaningful metadata. ProvenanceLab understands common aliases such as Author, Creator, Artist, and Camera Owner as related identity fields, while still showing the exact source field from each file. Matching SHA-256 hashes are treated as a high-signal duplicate-content relationship.
Timestamp clusters & timeline
0ProvenanceLab extracts supported embedded and file timestamps, groups events that occur within a user-defined time window, and highlights potentially important date inconsistencies. A normal later Modified date is not treated as suspicious by itself.
Geolocation cluster & map settings
Geolocation clusters
0Add files with GPS/location metadata, then run clustering.
Case report · PDF
Open a professionally formatted, printable analyst report with an executive snapshot, review findings, coordinate visuals, hashes, and relationship summary. Use Print / Save as PDF in your browser.
Case report · CSV
Export one row per file with SHA-256, format, coordinates, AI indicator count, provenance count, and finding labels.
Hash manifest
For one file, export a TXT hash record. For multiple files, export a CSV SHA-256 manifest.
Case memory
The active case is held in browser memory for this page session. Use Add files to extend the current case. Use New case or Clear memory to remove the active case after confirmation. Map API keys are never stored unless you explicitly select “Store this key.” Stored keys use this browser’s localStorage and are not encrypted, so avoid storing them on shared systems.
Built by Plessas Experts Network, Inc.
Plessas ProvenanceLab is a sample architecture. We can customize provenance, metadata, AI-indicator, reporting, evidence-preservation, or integration workflows for your investigation environment.