Skip to content

erenisci/evidex

Repository files navigation

Evidex — Forensic OSINT Investigation Platform

A locally-run, court-grade web platform for lawful Open-Source Intelligence (OSINT) investigation of public Twitter/X content. Built for lawyers, digital forensics experts, and licensed investigators preparing admissible evidence.

⚠️ Legal use only. This tool is provided for lawful investigations. Operators are personally responsible for compliance with KVKK, GDPR, the Türk Ceza Kanunu, and all other applicable laws. See docs/LEGAL.md for detailed obligations.


What it does

Stage Capability
Collect Public tweets · replies · retweets · quote tweets · likes · profile snapshots · photos & videos with EXIF
Analyse 10 OSINT modules: Wayback, EXIF, Reverse Image (Yandex/Google Lens), Email/Phone extraction, Profanity & Hate-Speech (TR/EN/DE/FR/AR), Hashtag, Activity heatmap, Network graph, Profile-change tracking, Trust score
Pipeline One-click Run All OSINT orchestrator runs the 14-step pipeline (profile → tweets → likes → sherlock → wayback → exif → reverse-image → email → linked-accounts → profanity → hashtags → activity → trust → identity merge) with live per-step progress, elapsed timer, and last-run timestamps on every module
Cross-match Sherlock — handle reuse across 400+ platforms · Behavioral fingerprint comparison between two accounts
Preserve SHA-256 hash on every artifact · Watchdog auto-detects deleted tweets and saves Wayback fallback · tamper-evident audit log
Report Court-ready PDF with chain-of-custody, methodology, hashes, and preparer details · CSV / JSON / ZIP exports

The interface is a cyber-noir intelligence dashboard: pure-black canvas, neon matrix-green accent, JetBrains Mono for every identifier, Inter for body text. Dark by default, light theme available, TR / EN language toggle.


Requirements

  • Python 3.11+
  • Google Chrome (for the Selenium fallback scraper and screenshot capture)
  • ChromeDriver is managed automatically by selenium-manager — no manual install needed

Quick Start

git clone <repo-url> evidex
cd evidex

# Virtual environment (recommended)
python -m venv venv
source venv/bin/activate      # Linux / macOS
# venv\Scripts\activate       # Windows

# Dependencies
pip install -r requirements.txt

# Run
python main.py

Open http://127.0.0.1:8000 in your browser. The SQLite database, evidence directories, and locale cookie are created on first use.

First action: open Settings (sidebar bottom) and add a Twitter/X account so twscrape can run. Without one, the tool falls back to Selenium browser scraping (slower).


Documentation

File Contents
docs/GUIDE.md End-to-end user guide: installation, every page, every workflow
docs/LEGAL.md KVKK / GDPR / TCK obligations, permitted vs. prohibited use, chain of custody

Tech Stack

Layer Technology
Backend FastAPI + Uvicorn
ORM SQLAlchemy 2.0
Database SQLite (WAL mode)
Frontend Jinja2 server-rendered + Vanilla JS + Lucide icons + Leaflet — no build step
Styling Hand-written static/css/evidex.css (cyber-noir tokens)
Scraping twscrape (primary) + Selenium (fallback)
OSINT Sherlock · Wayback CDX · EXIF (Pillow + exifread) · Yandex/Google Lens · profanity-check
Visualisation vis.js (network + timeline) · Leaflet (map)
PDF ReportLab
Integrity SHA-256
i18n English + Türkçe (cookie + ContextVar)
Tests pytest + pytest-asyncio (134 tests, including a 51-case E2E suite)

Configuration

Copy .env.example to .env to override defaults:

cp .env.example .env

The app runs with sensible defaults without any .env file.


Resetting Data

To wipe all collected data (while the app is stopped):

rm -f data/db/evidex.db data/db/evidex.db-wal data/db/evidex.db-shm
rm -rf data/exports/* data/media/* data/screenshots/*

The database is recreated automatically on the next startup.

See docs/LEGAL.md §5 for retention guidelines.


Running Tests

pip install pytest pytest-asyncio
pytest tests/ -v

The suite covers 134 tests including:

  • tests/test_e2e.py — end-to-end smoke: every HTML page, every read-only API, every write endpoint that does not require a live Twitter account
  • tests/test_models.py — SQLAlchemy model behaviour and cascade deletes
  • tests/test_analyzers.py — OSINT module unit tests (activity, hashtags…)
  • tests/test_scrapers.py — scraper unit tests (twscrape / Selenium)
  • tests/test_routers.py, test_collection_service.py, test_osint_service.py, test_edge_cases.py — route and service-layer integration

A green suite means every endpoint the frontend calls resolves to a real backend route, and every page renders without server errors.


Security Posture (in brief)

  • CORS restricted to loopback (127.0.0.1 / localhost) — see main.py.
  • Locale cookie is HttpOnly, SameSite=Lax.
  • Templates use Jinja2 autoescape; client-side innerHTML interpolation goes through escapeHtml() in static/js/app.js.
  • File-serving endpoint enforces the resolved path stays within the project root (defense-in-depth).
  • No raw SQL — everything goes through SQLAlchemy ORM.
  • No authentication layer — application is local-only by design. Do not expose to a network without adding auth, HTTPS, and CSRF protection.

See main.py and the docs/GUIDE.md for the full local-only security posture.


Legal Notice

This tool is intended exclusively for lawful OSINT investigations supporting due-process legal proceedings. Use of the platform for stalking, harassment, mass profiling, or any unlawful purpose is strictly prohibited and may constitute a criminal offense under TCK, KVKK, GDPR, and other statutes.

The developers, contributors, and copyright holders accept no liability for unlawful or out-of-scope use. Operators must consult qualified legal counsel before deployment in any investigation. See docs/LEGAL.md for full obligations.


License

License: MIT

Released under the MIT License — see LICENSE for the full text.

Copyright (c) 2026 Eren İşci

Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, subject to the conditions in the LICENSE file.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND.

About

Forensic OSINT investigation platform for public Twitter/X content. Court-ready evidence with SHA-256 chain of custody, watchdog deletion tracking, and a 14-step OSINT pipeline. Local, open-source, lawful use only.

Topics

Resources

License

Stars

0 stars

Watchers

0 watching

Forks

Releases

No releases published

Packages

 
 
 

Contributors