A locally-run, court-grade web platform for lawful Open-Source Intelligence (OSINT) investigation of public Twitter/X content. Built for lawyers, digital forensics experts, and licensed investigators preparing admissible evidence.
⚠️ Legal use only. This tool is provided for lawful investigations. Operators are personally responsible for compliance with KVKK, GDPR, the Türk Ceza Kanunu, and all other applicable laws. Seedocs/LEGAL.mdfor detailed obligations.
| Stage | Capability |
|---|---|
| Collect | Public tweets · replies · retweets · quote tweets · likes · profile snapshots · photos & videos with EXIF |
| Analyse | 10 OSINT modules: Wayback, EXIF, Reverse Image (Yandex/Google Lens), Email/Phone extraction, Profanity & Hate-Speech (TR/EN/DE/FR/AR), Hashtag, Activity heatmap, Network graph, Profile-change tracking, Trust score |
| Pipeline | One-click Run All OSINT orchestrator runs the 14-step pipeline (profile → tweets → likes → sherlock → wayback → exif → reverse-image → email → linked-accounts → profanity → hashtags → activity → trust → identity merge) with live per-step progress, elapsed timer, and last-run timestamps on every module |
| Cross-match | Sherlock — handle reuse across 400+ platforms · Behavioral fingerprint comparison between two accounts |
| Preserve | SHA-256 hash on every artifact · Watchdog auto-detects deleted tweets and saves Wayback fallback · tamper-evident audit log |
| Report | Court-ready PDF with chain-of-custody, methodology, hashes, and preparer details · CSV / JSON / ZIP exports |
The interface is a cyber-noir intelligence dashboard: pure-black canvas, neon matrix-green accent, JetBrains Mono for every identifier, Inter for body text. Dark by default, light theme available, TR / EN language toggle.
- Python 3.11+
- Google Chrome (for the Selenium fallback scraper and screenshot capture)
- ChromeDriver is managed automatically by
selenium-manager— no manual install needed
git clone <repo-url> evidex
cd evidex
# Virtual environment (recommended)
python -m venv venv
source venv/bin/activate # Linux / macOS
# venv\Scripts\activate # Windows
# Dependencies
pip install -r requirements.txt
# Run
python main.pyOpen http://127.0.0.1:8000 in your browser. The SQLite database, evidence directories, and locale cookie are created on first use.
First action: open Settings (sidebar bottom) and add a Twitter/X account so twscrape can run. Without one, the tool falls back to Selenium browser scraping (slower).
| File | Contents |
|---|---|
docs/GUIDE.md |
End-to-end user guide: installation, every page, every workflow |
docs/LEGAL.md |
KVKK / GDPR / TCK obligations, permitted vs. prohibited use, chain of custody |
| Layer | Technology |
|---|---|
| Backend | FastAPI + Uvicorn |
| ORM | SQLAlchemy 2.0 |
| Database | SQLite (WAL mode) |
| Frontend | Jinja2 server-rendered + Vanilla JS + Lucide icons + Leaflet — no build step |
| Styling | Hand-written static/css/evidex.css (cyber-noir tokens) |
| Scraping | twscrape (primary) + Selenium (fallback) |
| OSINT | Sherlock · Wayback CDX · EXIF (Pillow + exifread) · Yandex/Google Lens · profanity-check |
| Visualisation | vis.js (network + timeline) · Leaflet (map) |
| ReportLab | |
| Integrity | SHA-256 |
| i18n | English + Türkçe (cookie + ContextVar) |
| Tests | pytest + pytest-asyncio (134 tests, including a 51-case E2E suite) |
Copy .env.example to .env to override defaults:
cp .env.example .envThe app runs with sensible defaults without any .env file.
To wipe all collected data (while the app is stopped):
rm -f data/db/evidex.db data/db/evidex.db-wal data/db/evidex.db-shm
rm -rf data/exports/* data/media/* data/screenshots/*The database is recreated automatically on the next startup.
See
docs/LEGAL.md§5 for retention guidelines.
pip install pytest pytest-asyncio
pytest tests/ -vThe suite covers 134 tests including:
tests/test_e2e.py— end-to-end smoke: every HTML page, every read-only API, every write endpoint that does not require a live Twitter accounttests/test_models.py— SQLAlchemy model behaviour and cascade deletestests/test_analyzers.py— OSINT module unit tests (activity, hashtags…)tests/test_scrapers.py— scraper unit tests (twscrape / Selenium)tests/test_routers.py,test_collection_service.py,test_osint_service.py,test_edge_cases.py— route and service-layer integration
A green suite means every endpoint the frontend calls resolves to a real backend route, and every page renders without server errors.
- CORS restricted to loopback (
127.0.0.1/localhost) — seemain.py. - Locale cookie is
HttpOnly,SameSite=Lax. - Templates use Jinja2 autoescape; client-side innerHTML interpolation goes through
escapeHtml()instatic/js/app.js. - File-serving endpoint enforces the resolved path stays within the project root (defense-in-depth).
- No raw SQL — everything goes through SQLAlchemy ORM.
- No authentication layer — application is local-only by design. Do not expose to a network without adding auth, HTTPS, and CSRF protection.
See main.py and the docs/GUIDE.md for the full local-only security posture.
This tool is intended exclusively for lawful OSINT investigations supporting due-process legal proceedings. Use of the platform for stalking, harassment, mass profiling, or any unlawful purpose is strictly prohibited and may constitute a criminal offense under TCK, KVKK, GDPR, and other statutes.
The developers, contributors, and copyright holders accept no liability for unlawful or out-of-scope use. Operators must consult qualified legal counsel before deployment in any investigation. See docs/LEGAL.md for full obligations.
Released under the MIT License — see LICENSE for the full text.
Copyright (c) 2026 Eren İşci
Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, subject to the conditions in the LICENSE file.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND.