HS Harry Smallwood

Digital forensics / all software

In development · early access

Ground Truth

Test data with known answers

Make video and computer images where every frame, file, user and timestamp is written down in advance, then run them through your tools and see exactly what they found, missed or changed.

Request early access Ask for a demo
Ground Truth from start to finish: a 48-file video dataset, three exports checked frame by frame, and a Windows 11 computer imaged as E01 and read back. Real runs, making shown sped up.

The problem it solves

Validating a forensic tool means knowing the right answer before you start. Real casework can't give you that, and hand-made test sets are slow to build and rarely cover the codecs, file systems and artefacts you actually meet. Ground Truth generates the data and the answers together, so a tool's output can be checked line by line.

Who it's for: Units validating tools and methods for accreditation, testing a new software version before it goes live, or training staff on data where every answer is known.

What it does

  • Video datasets. Test cards, synthetic CCTV scenes or your own clips, at any mix of resolution, frame rate, bitrate, codec and container, with CBR, VBR or quality-based encoding.
  • Every frame identifiable. A frame code burnt into each frame, lossless references and per-frame hashes show dropped, repeated, reordered or re-encoded frames after export.
  • Real-world faults. Truncated files, dropped frames, odd timings and device-style metadata, the awkward files a player or converter has to cope with.
  • Windows computers as E01. Windows 7, 10 or 11 on NTFS with GPT or MBR, users with documents, pictures and downloads, installed programs and a realistic timeline in the right time zone.
  • The artefacts examiners look for. Registry hives, LNK files, shellbags, UserAssist, ShimCache, BAM, Amcache, USB history, browser history and the Recycle Bin.
  • Deleted and hidden data. Deleted files left recoverable or partly overwritten, timestomped files, alternate data streams and remnants in unallocated space, each recorded where it sits.
  • A full answer key. Every file, time, hash, MFT record and fact in a manifest with CSV and HTML reports, plus a check that reads the image back with independent tools.

See it work

what to click, and what you get

01 · Make video

Every codec, every container. Every fact known.

Pick a ready-made dataset or tick the sources, sizes, frame rates and codecs you need. Every file is made from a lossless reference, then probed, hashed and compared with what was asked for.

  1. Build your own one file for every combination you tick, or one of nine ready-made datasets.
  2. Tick the sources colour bars, sync cards, zone plates, a synthetic CCTV scene or your own clips.
  3. Sizes, frame rates, codecs the plan is counted as you go; combinations no real software makes are left out and listed.
  4. Make dataset every file measured as it's made, with a frame code in every frame.

02 · Check footage

Put it through the tool. See exactly what changed.

Run the dataset through the tool you're validating, then give Ground Truth what came out. It reads the frame code back from every frame and compares it with the original.

  1. Choose files… what the tool exported, converted, clipped or redacted.
  2. The dataset's manifest so every frame count is compared with the original's.
  3. Check intact or changed, with the frames missing, repeated or out of order.

03 · Make a computer

A Windows PC, used by people who never existed.

Choose the Windows version, the users and how much they used it, and the evidence to plant. Ground Truth installs it, uses it for months, shuts it down and images it as an E01, then reads it back with independent tools.

  1. Windows 7, 10 or 11 time zone, disk size and computer name.
  2. Users named or made up, with documents, photos, downloads and browsing.
  3. Evidence to plant USB sticks, deleted and recycled files, a timestomped file, remnants.
  4. Make computer then Check image reads it back with The Sleuth Kit and libewf.

04 · The answer key

Every answer, written down before you test.

Every dataset comes with a manifest: JSON for scripts, CSV for a spreadsheet and an HTML report to read or print. Compare what your tool reports with it, line by line.

  1. View report every file's measurements, hashes and frame MD5s.
  2. For a computer the facts a tool should report, and where each lives on the disk.

On screen

click to enlarge
Results: 48 files made, each measured against what was asked for, none differing
Results: every file made, then measured
Make: sources, sizes, frame rates and codecs ticked, with the plan counted
Make: tick what you need, every combination planned
Check footage: three exports from a tool, one intact and two with frames missing, repeated or out of order
Check footage: what a tool did, frame by frame
Make a computer: Windows version, users, how much they used it, and the case details for the E01
Computers: a whole Windows history, built to an E01
A finished computer: users, files, facts to find, deleted files and USB devices, with the E01's hashes
Computers: every file and fact in the manifest

At a glance

Platform
Windows 10 and 11
Requires
Nothing extra; FFmpeg is included
Outputs
Video files, E01 / DD images; JSON, CSV and HTML answer keys
Works offline
Yes. Everything is generated on the machine
Pricing
From £1,250, then £310 a year

Good to know

  • The images open in the usual forensic suites and parsers, but they're synthetic: there are no event logs or Prefetch files yet, and installed programs are stand-in files rather than working software.
  • Everything is generated from a seed, so the same settings always give the same dataset, and a colleague can rebuild it to check your results.
  • Mobile phone extractions aren't covered yet.

Ground Truth is in development

It isn't on general sale yet. Request early access to use it in your own validation work before release, report what works and what doesn't, and help shape the finished version. Early-access users get launch pricing locked in.

Planned pricing and licensing →

Single workstation

£1,250

then £310 a year from year two

Unit licence

£4,500

then £1,125 a year from year two

Planned launch prices, excluding VAT. A unit licence covers every workstation in one force's forensic unit.

  • Try it before release on your own validation work
  • Direct line to the developer for feedback
  • Launch pricing locked in for early-access users
Request early access Ask for a demo

Other software

all software →

See all the software