CY-2002/3006 Digital Forensics | Semester Project — Tool #3: Cyber Triage Tool for Video Analysis

CyberTriage is a web-based digital forensics tool for comprehensive video evidence analysis. It allows forensic investigators to:

• Ingest video files in multiple formats as digital evidence
• Extract individual frames at user-specified timestamps or regular intervals for quick visual triage
• Play the video directly inside the browser-based interface
• Perform steganography detection (appended data, embedded file signatures, metadata anomalies, LSB analysis)
• Attempt recovery of hidden/embedded media objects
• View detailed video metadata (filesystem, codec, and embedded tag fields)
• Maintain a forensic log of all analysis actions per session

The tool runs entirely locally — no data ever leaves the investigator's machine. Built with Python (Flask) on the backend and vanilla HTML/CSS/JS on the frontend.

flask>=2.3.0
opencv-python-headless>=4.8.0
Pillow>=10.0.0
mutagen>=1.47.0
numpy>=1.24.0

All listed in requirements.txt.

# Clone from GitHub
git clone https://github.com/musa42069/VideoAnalysisTool.git
cd VideoAnalysisTool

# OR if you received a ZIP
unzip VideoAnalysisTool.zip
cd VideoAnalysisTool

Windows:

python -m venv venv
venv\Scripts\activate

Linux / macOS:

python3 -m venv venv
source venv/bin/activate

pip install -r requirements.txt

If you encounter issues with opencv-python-headless:

pip install opencv-python --upgrade

Ubuntu/Debian — if OpenCV fails:

sudo apt-get install libgl1-mesa-glx libglib2.0-0

python app.py

Expected output:

CyberTriage - Video Forensics Analysis Tool

Open your browser at: http://127.0.0.1:5000

Navigate to http://localhost:5000 in Chrome or Firefox.

python generate_test_videos.py

Creates three test videos in test_videos/:

VideoAnalysisTool/

├── app.py # Main Flask application & API endpoints

├── requirements.txt # Python dependencies

├── generate_test_videos.py # Test video generator

│

├── utils/

│ ├── frame_extractor.py # Frame extraction engine (OpenCV)

│ ├── steg_detector.py # Steganography detection pipeline (5 modules)

│ └── metadata_extractor.py # Metadata extraction (OpenCV + ffprobe)

│

├── templates/

│ └── index.html # Web interface (HTML + CSS + JS)

│

└── static/

├── uploads/ # Uploaded evidence (auto-created, gitignored)

└── frames/ # Extracted frames (auto-created, gitignored)

Port already in use:

# Linux/macOS
lsof -i :5000
kill -9 <PID>

# Windows
netstat -ano | findstr :5000
taskkill /PID <PID> /F

Then restart with python app.py.

Large video upload fails: Open app.py and increase MAX_CONTENT_LENGTH:

app.config['MAX_CONTENT_LENGTH'] = 4 * 1024 * 1024 * 1024  # 4 GB

OpenCV cannot open video:

• Ensure the file is not corrupted
• Try converting: ffmpeg -i input.mkv output.mp4
• Verify the format is in the supported list above

Module not found error: Ensure your virtual environment is activated, then:

pip install -r requirements.txt

Browser video player not working:

• Use Chrome or Firefox (recommended)
• Frame extraction still works even if in-browser playback fails

This tool is designed for local forensic use only. Do not expose port 5000 to the internet. Uploaded evidence files are stored in static/uploads/ and are never transmitted externally.

This tool must only be used on video evidence for which proper legal authorization has been obtained. Unauthorized analysis of digital evidence may violate applicable laws including Pakistan's Prevention of Electronic Crimes Act (PECA) 2016.

CY-2002/3006 Digital Forensics — Semester Project | April 2026