Trust-Evid AI

Inspiration

Digital evidence is easy to collect and hard to trust. Investigators receive CCTV footage, photos and videos from many sources, often with missing metadata, unclear provenance and no record of who handled a file. Sorting through it by hand is slow, and a file that has been edited or re-encoded can slip through. We wanted a tool that helps investigators decide which files deserve a closer look, shows whether a file has changed since intake, and keeps a reviewable record of every handoff, without ever claiming to prove that a file is authentic.

What it does

Trust-Evid AI is an evidence triage platform for law-enforcement investigators. Authorized users sign in with mandatory two-factor authentication, create a case, and upload images or videos with source and collection details. For each file, the platform:

• Computes a SHA-256 hash on the server from the stored original bytes and keeps the original in private storage.
• Runs deterministic checks: EXIF and metadata extraction, image dimensions and encoding, video container and codec details, and frame sampling with repeated-frame detection.
• Sends those findings to a hosted multimodal AI model, which returns a structured explanation with anomalies, uncertainty, limitations, next steps and a review priority.
• Records intake, analysis and review events in a hash-chained custody log.
• Lets investigators and examiners add review notes, retry failed processing, and download a structured evidence report.

Deterministic results, AI interpretation and human review are always shown separately. The interface never shows an “authentic” badge, because a clean result is not proof of authenticity.

How we built it

• Frontend and API: Next.js 14 (App Router) and TypeScript, with Supabase Auth for email/password sign-in and TOTP two-factor authentication.
• Database and storage: Supabase PostgreSQL with row-level security, plus private Supabase Storage for original evidence. Uploads go through signed URLs, and every API route checks authentication and case membership.
• Forensic worker: A Python FastAPI service that accepts only an evidence ID, authenticated with a shared secret. It streams the original from private storage, enforces size limits, and computes the hash, image metadata and EXIF, video ffprobe metadata and sampled frame hashes.
• AI layer: Gemini analyzes the deterministic findings only, without GPS or personal EXIF. Its output is checked against a schema, and failures are saved as incomplete without overwriting the deterministic results.
• Integrity and custody: Write-once hashes, a transactional finalization function in Postgres, and a hash-linked custody log.
• Deployment: Vercel for the web app and Render for the worker, with secrets kept in environment variables and tests that mock Supabase and the worker.

Challenges we ran into

Since it was our first experience building such a big MVP on our own so we ran into quite a lot of issues like understanding and finallizing the stack, making the backend and frontend work while deployed, fixing crazy ai hallucinations and getting used to and making the devmarketplace agent work correctly for us by experimenting different models. Also, this project taught us many things like how to supply prompts that do the work correctly, how to debug the ai output and how to deploy things and manage them.

Accomplishments that we're proud of

• A complete workflow from 2FA sign-in to a downloadable report, with data isolation between users. Server-side hashing over the actual stored bytes, with a write-once hash and conflict detection.
• A clear separation between measured findings, AI interpretation and human review, with limitations stated in every report.
• A real tamper-testing exercise with a repeatable set of modified files, and honest results on what each check does and doesn’t catch.
• AI failure handling that never substitutes fake text for a live model response.

And most importantly the chance to execute one of our dream idea into a reality and working version was one of the greatest achievement we can say.

What we learned

We learnt a quite of things (most of which have been described above) like how to do vibe coding efficiently, how to guide the ai in the right direction, which model family to use for which tasks and how to divide the task among team mates. Also we explored a lot on the side of hashing and chain of custody (which we knew quite a bit before due to our interests and background).

What's next for Trust-Evid AI

The greatest next thing would be to test this project out by real users and to pitch it to the place it deserves to be. Also, by running tests by real users will also help us learn and discover more about the possible extension of this thing from a product to a real world commodity that may help people in getting their cases resolved fast and without privacy concerns.

So the main purpose and next goal for Trust-Evid would be to further refine it through real users and to further carry it out in the real world scenario for the benefit of the common public.

Built With

• gemini
• github
• nextjs
• render
• supabase
• typescript
• vercel