SakshyaYantra Enterprise: the objects it works on, rendered in the family colour

SakshyaYantra, digital forensics

Evidence, from the disk to the courtroom

The whole forensic platform in one console: verified imaging, artefact analysis and a timeline; an agent for live acquisition, estate sweeps and queued collections; and video evidence, decoded, examined frame-exact, redacted and certified.

How to get Enterprise Specifications

Licensed by a key bound to one machine, sold by the drive or image.

Who it is forExaminers, investigators, incident response teams and forensic laboratories - from a single case to an organisation-wide estate.

The workspace it is bought for

SakshyaYantra Enterprise, as shipped

A real screenshot of version 20.54.3.2, captured from the shipping build on this bench. Nothing on the site is a mock-up.

New in 20.54.3.2

What this release adds to SakshyaYantra Enterprise

Each item is in the shipping build of this product; the others in the range that carry it are named on the card.

The recorder view

A recorder disk opens on its vendor index: cameras down the left, time across, play from the disk, cut from-to, download, extract one camera, enhance, capture a frame, report. In every product that carries CCTV.

Ex01 and AFF4 images read as sources

Alongside raw dd, .img, .iso and E01, an image can now be read from an EnCase Ex01 or an AFF4 container and recovered from exactly as from any disk image. Output stays raw or E01, hashed on read and verified after write.

Filesystem-aware imaging with an entropy map

Imaging can copy only the areas the file system marks in use and read the rest as an entropy map, so an almost-empty or already-encrypted drive is imaged in a fraction of the passes a full sector copy would take. The full copy stays available.

Hardware-RAID metadata and assembly

A RAID array is reassembled from its own DDF and vendor controller metadata where it is present, so level, order and stripe size do not have to be guessed; the parameters can still be set by hand when the metadata is gone.

Evidence player and frame pack

Clips play from the disk. A frame pack - a few captured frames, each with its presentation time, decoded index, overlay time, case time, channel, source hash and its own SHA-256 - is the only unit that leaves the machine. Never the video.

Three times, never merged

The stream's presentation time, the recorder's overlay text and the case time are separate fields with separate uncertainty, on screen, in the pack and in the report.

Sealed reading before AI

The examiner's own reading is sealed before any model answer is shown. A model's response is an AI observation - model, version, prompt, input hashes, time, verbatim text - never a finding unless a reviewer promotes it by a typed decision.

AI optional: none, local or cloud

Three modes in every build: none, a local model pack with no internet, or cloud behind a per-agency switch that is off by default, with a transfer manifest of every frame digest that left.

Enhancement beside the original

An enhanced frame is shown beside the original, never instead of it, with the chain of operations printed beneath and both exported.

Authenticity, plates, registry, certificate

Authenticity checks with every method ranked, number-plate assistance, registry intake, and the certificate under Section 63(4) of the Bharatiya Sakshya Adhiniyam 2023.

The modules

The video-forensic line and the case platform, in one product.

SakshyaYantra Enterprise opens on a launcher, and every block below is a module of the same build, not a separate purchase. Where a module answers a tool an examiner already knows, that tool is named; where our depth is still growing, the module says so, because a police buyer reads this.

Footage

Getting the video off the recorder, readable, and seen

Footage & Convert

Open a seized recorder and see the footage the way the recorder saw it.

A DVR or NVR disk opens on its own vendor index, not a pile of carved clips. The decode ladder shows exactly how each stream was read, so nothing about the footage is taken on trust, and batch conversion turns a shelf of exhibits into reviewable video.

The recorder's own channel and camera layout, from its index
A decode ladder that records how every stream was opened
Batch conversion across many exhibits at once
A coverage view of what was found and what was not

Equivalent to DVRConv + Engine + FIVE convert. We go further by making the decode ladder part of the evidence; the breadth of proprietary formats keeps growing with our registry.

Recorder view, decode ladder and batch are built; the breadth of formats grows with the registry.

Enhance & Measure

Make the plate, the face or the logo legible - with the original always beside it.

Enhancement runs with the source frame next to the result and the exact chain of steps printed beneath, so an improvement can always be traced back. Capture the frame you need, and measure a real distance on a calibrated plane.

The original and the enhanced frame side by side, never one instead of the other
Every filter in the chain printed beneath the result
Single-frame capture into a frame pack
Calibrated measurement of distance or height on a plane

Equivalent to FIVE (restore, enhance, measure). We go further by sealing the chain into the case record. FIVE's filter library is broader than ours today, and our enhance module is still growing.

Slider enhance, frame capture and plane measure are built; filter breadth is the growing edge.

Review Player

Play the evidence, cut the moment that matters, and hand it over redacted.

Clips play straight from the exhibit disk. Mark an in and an out, download just that segment, and put two exhibits side by side to compare. Faces and plates can be masked before anything is disclosed.

Playback direct from the recorder disk
Cut from-to and download only the segment you need
Two exhibits compared frame for frame
Redaction of faces and plates before disclosure

Equivalent to Replay. We go further by keeping the recorder time, the overlay text and the case time as three separate fields. Model-assisted redaction is on the licensed or roadmap edge.

Player, recorder play, cut and download, and compare are built; model-assisted redaction is on the licensed or roadmap edge.

Analysis

What the picture is, and whether it can be trusted

Authenticate

Answer the question the court will ask: is this footage real?

Integrity, tamper and camera-identification checks run as a framework, each method ranked and written into the case, so an authenticity opinion rests on recorded tests rather than a single glance.

Integrity and container checks
Tamper and manipulation indicators
Camera-identification tests
Every method ranked and recorded against the exhibit

Equivalent to Authenticate. We go further by recording every method's result in the case file. The depth of classical-image methods is our growing edge.

The integrity, tamper and camera-identification framework is built; classical-image method depth is the growing edge.

Plate

Work a number plate as evidence, never as a guess.

Plate work runs as a lifecycle - capture the frame, prepare it, submit it - so a reading is always shown with how it was reached, and never presented as a settled fact.

Capture the plate frame into the case
Prepare and enhance it with the chain kept
Submit for recognition as an assisted step
A reading always shown as assistance, not a fact

Equivalent to DeepPlate. We go further by keeping the whole lifecycle in the case record. The recognition model is local and optional, or a licensed service.

The capture, prepare and submit lifecycle is built; the recognition model is local and optional, or a licensed service.

AI observations

Ask a model about a frame - after your own reading is already sealed.

A model may be asked about a frame pack, but only once the examiner's own reading is sealed. Whatever it says is recorded as an observation, with its model, prompt and input hashes, and is never promoted to a finding on its own.

The examiner's reading sealed before any model is asked
Model, prompt and input hashes recorded with every answer
Three modes: none, a local pack, or cloud behind an off-by-default switch
An observation, never a finding, until a person decides

Beyond Amped. This is built to keep AI out of the evidence unless a person puts it there - which is why it goes past their only AI feature.

Optional in every build: none, a local model pack, or cloud behind a switch that is off by default. Beyond Amped.

Case

What travels out of the machine, and what signs it

Case & Report

Turn the work into a case file a court will accept.

The case is locked and versioned, findings are recorded against the exhibits they came from, and the report carries the evidence certificate under Section 63(4) of the Bharatiya Sakshya Adhiniyam 2023.

A locked, versioned case with a custody line
Findings recorded against the exhibit they came from
A dated report in PDF, Word or HTML
The S.63(4) BSA 2023 evidence certificate

Equivalent to the peer-review project in FIVE, exceeded. This goes past their peer-review project: the case, the findings and the statutory certificate are one signed record.

Case lock and versions, findings, report and the S.63(4) certificate are built. Beyond Amped.

Frame Pack

Send a few hashed frames - never the whole video - out of the building.

The frame pack is the only unit that leaves the machine: a handful of captured frames, each with its times, its hash and its source extent, wrapped in a hashed manifest. The video itself stays put.

A few captured frames instead of the whole recording
Each frame with its time, hash and source extent
A hashed manifest that travels with the pack
Download, report or send to a model - by the same unit

Beyond Amped. This is our evidence-transfer unit, and it is what keeps a review honest from the disk to the disclosure.

Built. Beyond Amped.

Registry

Know exactly what the bench is holding, and where each exhibit is.

Exhibits arrive through an intake and sit in a queue with their custody line, so a busy bench always knows what it holds and what state each item is in.

A single intake for arriving exhibits
A queue with each item's custody line
At-a-glance state for everything on the bench

Beyond Amped. The registry is what makes a multi-exhibit bench accountable.

Intake and queue are built.

Amped Software, OpenText EnCase, Magnet AXIOM and Exterro FTK product names are used to say what a module is for, and belong to their owner. The software itself uses our own names throughout.

Typical cases

What this product is bought for

If the situation below matches yours, this is the right product. If none of them do, another product in the range is likely to be a closer fit, and the last section on this page says which.

A machine that has to be acquired cannot be switched off, or cannot be visited.

Something has been found on one machine and the question is where else it is.

A recorder export has to be read, hashed and decoded so that every frame shown later can be traced to it, or a bystander's face must be masked before disclosure.

An investigation needs an ordered account of what happened on a device and when, with chain of custody from acquisition through to the report.

Key points

How SakshyaYantra Enterprise is built

Defensible from acquisition to export

Images are hashed and verified, every exported frame carries its own hash and provenance, and the audit trail is hash-chained end to end.

One console for a whole estate

Search every enrolled machine for a filename, an exact SHA-256 or a string inside files, freeze and acquire one that cannot be switched off, and queue the ones that are away.

Three clocks, never merged

A frame's presentation ticks, the recorder's overlay text and the case time stay separate fields with their own uncertainty, on every frame.

Capabilities

What SakshyaYantra Enterprise does

Verified acquisition

Raw, E01 and AFF4 images, hashed on read and verified on completion, with a software write block where supported.

Artefact analysis

Windows event logs, registry, Prefetch, ShimCache, BAM, SRUM, Jump Lists, LNK, Recycle Bin, browser history, Windows Timeline, plus Linux and macOS artefacts.

Combined timeline

$MFT and $LogFile records, artefacts and file system times merged into one ordered sequence.

Memory analysis

Process lists, network connections, loaded modules, handles and injected-code detection from a memory image.

Live acquisition

A volume is frozen on the endpoint and imaged across the network. The snapshot is verified unchanged across the whole acquisition, and released afterwards.

Sweep across endpoints

One question asked of every enrolled machine at once: a filename, an exact SHA-256, or a string inside files. Results are paths and sizes, never file contents.

An installer you can push

A Windows MSI with your console address and pairing key already in it, installing silently as a service. Group Policy, Intune and SCCM.

Queued collections

Machines that are away stay queued with the operator and the reason, and are collected when they return.

Decode ladder for recorder and phone footage

Container, index, raw stream and then salvage, with the rung that produced each frame recorded and reported. A recorder registry carries signed entries for tested makes and models.

Frame-accurate review and the frame pack

Step by frame or keyframe with gaps reported, never interpolated. A frame pack of hashed PNGs with pts ticks, overlay text, case time, source id and hash leaves the machine - never the video.

Drone flight log and video telemetry

DJI flight-log formats and .SRT video-telemetry sidecars are read for the GPS track, exported to CSV, GPX and KML with an offline flight-path and altitude plot, and sealed into the case with a hashed manifest of the source file.

Redaction, enhancement and authenticity

A mask across frames released only on a named reviewer's typed decision; a recorded processing graph of validated enhancements shown beside the original; an authenticity workbench that ranks hypotheses with their evidence; plate assistance from a signed local model pack.

Reports, custody and the draft certificate

A report with per-item hashes, a hash-chained custody record from acquisition onward, and the Section 63(4) certificate drafted from the case's own records with typed review states.

Workspaces in this build

These are the workspaces the application contains. Anything not listed is absent from the build; it is not present and locked behind the licence.

Forensic examination and reporting
Media gallery triage
Location data
Recover files from disks, cards and images
Image a failing drive
Phone acquisition and data recovery
Create a phone image
CCTV and DVR footage
Drone flight log and video telemetry recovery
Industrial robot and controller incident data
Vehicle data recovery
Mailbox recovery (Outlook PST/OST, mbox, Maildir)
Database row extraction
Image a drive over the network
Cloud account recovery
Chip-off and rig-dump reconstruction
RAID and storage-pool reassembly
Detect every connected device, with a report
Footage intake, decode and conversion
Frame-exact video review
Redaction under review
Evidence export and the draft S.63(4) certificate
Media enhancement lab, chain shown
Image and video authenticity examination
Number-plate assistance
Steganalysis
Evidence viewer
Timeline across artefacts
Memory (RAM) analysis
Link analysis
Known-file hash sets
Indexed keyword search
Foreign image and dump ingest
YARA scanning
Case hub: cases, versions and locks
Cross-case lookup
Ask the case (AI observations after a sealed reading)
Recorder registry and intake
sessionrec

The rest of the range

This page lists what the product does. Each product in the range is built for its own job, and what every one of them does is set out, product by product, on the products page, generated from the build itself. Hardware cases (drives that do not spin, locked phones, encrypted volumes) are covered in the hardware help guide.

What each product does

Partner access

Get SakshyaYantra Enterprise

Supplied to approved RecoverYantra partners. Apply once; your dashboard then carries every product, the licence keys for your machines and a direct line to our engineers.

Become a partnerTell us about your business. Applications are reviewed by a person, and you will hear from us by email.

Apply for access

Already a partnerSign in for the current build, your keys and support.

Partner sign in

Version 20.54.3.2Windows 10 or 11, 64-bitRead-only against your drives

System requirements

Windows 10 or 11, 64-bit
Administrator rights to read a physical drive. Working from a disk image needs none.
A separate destination with room for the recovered data. Results are never written to the drive being read.

Linux

The engine runs on Linux from source, and a Linux command-line build is available on request.

Specifications

SakshyaYantra Enterprise at a glance

Every row is read from the build this page was generated from.

Product	SakshyaYantra Enterprise, version 20.54.3.2
Family	SakshyaYantra, digital forensics
Platform	Windows 10 and 11, 64-bit. Administrator rights are needed to read a physical drive; working from a disk image needs none.
Workspaces included	39 of 42 in the range: Forensic examination and reporting, Media gallery triage, Location data, Recover files from disks, cards and images, Image a failing drive, Phone acquisition and data recovery, Create a phone image, CCTV and DVR footage, Drone flight log and video telemetry recovery, Industrial robot and controller incident data, Vehicle data recovery, Mailbox recovery (Outlook PST/OST, mbox, Maildir), Database row extraction, Image a drive over the network, Cloud account recovery, Chip-off and rig-dump reconstruction, RAID and storage-pool reassembly, Detect every connected device, with a report, Footage intake, decode and conversion, Frame-exact video review, Redaction under review, Evidence export and the draft S.63(4) certificate, Media enhancement lab, chain shown, Image and video authenticity examination, Number-plate assistance, Steganalysis, Evidence viewer, Timeline across artefacts, Memory (RAM) analysis, Link analysis, Known-file hash sets, Indexed keyword search, Foreign image and dump ingest, YARA scanning, Case hub: cases, versions and locks, Cross-case lookup, Ask the case (AI observations after a sealed reading), Recorder registry and intake, sessionrec
File types recovered	269 formats carried in the signature table, searched together with file system parsing.
Access to the source	Read-only for the whole session. The application refuses a destination on the drive being read.
Licensing	A signed key bound to this machine's code, verified offline. Sold by the source: one use is one drive or image, and the same source is free afterwards. No account and no activation server. Nothing leaves the machine unless the operator uses a network feature this product contains (acquiring a drive over your own network, reaching an iSCSI target, reaching a NAS, collecting from your own cloud tenant, the optional AI provider); every other connection to the public internet is refused by default. There is no telemetry and no update check.
Before a key	Scan, browse and preview without a key; the key is asked for when files are first saved from a source.
Dependencies	None to install. The forensic family bundles its own media and analysis libraries inside the installer; nothing is fetched at run time.
Companion programs	RecoverYantra Agent (RecoverYantra-Agent.exe), installed beside the command line: Runs on the machine being acquired: serves its disks and snapshots read-only to a console holding the pairing key, reports the machine to the roster. Installed by the MSI the console builds (remote package --msi), or run by hand.
How it is supplied	Through the partner programme. The build is 3734 MB; its SHA-256 is shown beside the download in your partner dashboard.

Where the rest of the range fits

These products carry workspaces SakshyaYantra Enterprise does not. The list is derived from the catalogue, so it cannot point at a product that lacks the capability too.

RecoverYantra SuiteEvery RecoverYantra data-recovery capability in one place