Ghiro’s documentation

Ghiro is an Open Source software for digital photo and digital image forensics. The forensic analysis is fully automated, report data can be searched or aggregated in different perspectives.

This documentation will explain what Ghiro is, which techniques it uses for forensic analysis, how to set up it and how to use it.

Introduction

• Why Ghiro?
• Use Case
• Supported image types
• Architecture
• Download Ghiro
  • Stable Branch
  • Development Branch
• Virtual Appliance

Techniques

• Techniques
• MIME information
• Metadata information
• Preview thumbnail extraction
• Preview thumbnail consistency
• GPS Localization
• ELA (Error Level Analysis)
• Hash digest generation
• Hash list matching
• Signature engine

Setup

• Setup Ghiro
• Requirements
• Getting started
  • Download and extract
  • Requirements
  • Preparing
  • Running
• Configuration
• Running Ghiro as service
  • Database
  • Apache as a front-end
  • Run the processor with upstart

Usage

• Usage
  • Dashboard
  • Cases
  • Images
  • Search
  • Hashes
  • Administration
• Administration
  • Run processor in debug mode
  • Create a new superuser
  • Upload images via command line utility

Notes

• Contribute, bugs and feature requests
• Disclaimer
• License