EXAMINATION NOTES ยท 8 OCTOBER 2026
Recovered media you can document
A list of recovered files answers one question: what came back? Investigators, insurers and HR or legal teams have to answer a harder one: where did it come from, what exactly was read, and what is still unknown? Frame Witness is a Windows photo and video recovery tool built around that second question. Every finding keeps its source offset, SHA-256 hash and the recorded origin of each date, and a coverage report shows what the scan actually examined.
Who needs documented recovery
- Investigators and examiners who must show how a photo or video was located on an acquired image or physical disk, and be able to repeat the work.
- Insurance and claims teams reviewing deleted or formatted footage where a bare file list would raise more questions than it settles.
- HR and legal teams handling internal matters where the chain from storage medium to exported file has to be explained in plain terms.
Frame Witness does not certify a result, and a recovered file is not proof of what happened. What it gives you is context you can put in a report: the bytes that were retained, where they were read from, and which checks passed.
What each finding carries
Open any item in the examination workspace and you see the media next to its evidence fields:
- Source type and location - the acquired image or physical disk, with the source offset and extent map of the retained bytes.
- SHA-256 digest of the retained content. A digest identifies the bytes you have, not their origin, and the app keeps that distinction visible.
- Dates with their recorded source. A filesystem creation date, an embedded container time and a surviving Recycle Bin record are shown separately. A creation date is not a recording date, and a Recycle Bin date is the move to the bin, not permanent deletion. When a date is missing, it stays unknown rather than being filled in.
- Verification results - structural recognition, a decoded preview and full video-track decoding are three different checks. A visible frame alone does not establish that the entire original survived.
- Available filesystem records, including names and paths where they survived.
Know what the scan covered
The coverage report answers three separate questions before you interpret a result count:
- Read coverage - distinct bytes read against the source size, with failed reads listed as exceptions.
- Search coverage - the RAW pass plus residual structures such as earlier filesystem remnants.
- Selected mode - full, in-depth or filtered. A filtered search can exclude candidates whose metadata did not survive, and an interrupted scan is not a completed scan.
Video verification is reported separately from disk coverage. Reading every byte does not prove that every video was recovered, and the report never claims otherwise.
Keep the work local and contained
Media analysis runs on your Windows workstation. Recovered content is not uploaded to the Frame Witness website, and account access is separate from local analysis. Scanner and decoder workers run under Windows AppContainer isolation to reduce exposure while processing untrusted data. Isolation is a security measure, not a guarantee that malformed media is harmless.
For repeatable examination, prefer a preserved image and a write blocker where appropriate. A live Windows system keeps changing its disk even while the application reads it without writing. When you export, use a different physical destination so you do not overwrite remnants you may still need.
A reporting checklist
- Record the source and acquisition method.
- Note the scan mode and any unreadable regions from the coverage report.
- Separate filesystem findings from RAW-carved content.
- Record hash, byte length and the structural checks for each finding.
- Describe playback validation separately from original completeness.
- State the source of every timestamp and preserve unknown values.
Try it before you buy a licence
Download the signed Windows release (version 1.0.14, Windows 11 x64; Windows 10 not yet tested) and create a free account. The free tier runs a quick scan of the first 8 GiB of a source, returns up to 100 results, shows previews and saves recovered files up to 1 MiB each. Full scans, larger files and the advanced tools need a licence.
Licences are perpetual for the purchased version, with 12 months of updates and email support. Professional covers 1 workstation, Lab 3 and Organization 5; higher plans add activations and training, not a stronger recovery engine. Current prices, including any time-limited offer, are on the pricing page, and the conditions are in the terms of sale.
Independent review and representative field trials are still needed before institutional use; evaluate the workflow on your own representative cases first.
Download Frame Witness for Windows and run a free quick scan today.
Frequently asked questions
Does a SHA-256 hash prove where a recovered video came from?
No. The digest identifies the retained bytes so you can verify that an exported file matches what was read from the source. Provenance comes from the source offsets, surviving filesystem records and the dates shown with their recorded origin, and those have to be weighed separately.
Can the dates shown be used as the time of recording or deletion?
Not on their own. Frame Witness presents each date with its source: filesystem creation, embedded container time or a Recycle Bin record. Filesystem dates can reflect copying, embedded dates can be changed, and a Recycle Bin date marks the move to the bin, not permanent deletion. Missing dates remain unknown.
Is recovered media uploaded anywhere?
No. Analysis runs on your Windows workstation and recovered content is not sent to the Frame Witness website. Account sign-in handles profile, orders and support only.
What does the free account include?
A quick scan of the first 8 GiB of a source with up to 100 results, previews, and saving recovered files up to 1 MiB each. Full scans, larger files and the advanced tools require a paid licence, available from your account.