Screenshot Analyzer for Digital Investigations

This tool helps classify and tag screenshots for digital investigations by analyzing image content using Google Cloud Vision API and providing structured metadata.

Features

• Multi-language OCR to extract text from screenshots
• Entity recognition and tagging to detect names, phone numbers, amounts, threats
• Image classification to categorize screenshots into:
  • Chat
  • Transaction
  • Threat
  • Adult content
  • Uncategorized
• SafeSearch detection for adult, violent, or racy content
• Dynamic tag library that grows and adapts as you process more images
• Search and filter by text, tags, or category
• Export capabilities in JSON, CSV, or PDF formats for legal reporting

Output Format

The tool returns data in the following JSON structure:

{
  "image_id": "<auto-generated>",
  "file_hash": "<sha256-hash>",
  "detected_text": "<OCR text output>",
  "entities": ["<extracted entities>"],
  "labels": ["<image labels>"],
  "tags": ["<combined tags>"],
  "category": "<chat|transaction|threat|adult_content|uncategorized>",
  "safe_search": {
    "adult": "<UNLIKELY|POSSIBLE|LIKELY|VERY_LIKELY>",
    "violence": "<UNLIKELY|POSSIBLE|LIKELY|VERY_LIKELY>",
    "racy": "<UNLIKELY|POSSIBLE|LIKELY|VERY_LIKELY>"
  },
  "timestamp": "<ISO timestamp>"
}

Requirements

• Python 3.6+
• Google Cloud Vision API credentials
• SQLite database (included)
• Python packages:
  • google-cloud-vision
  • opencv-python
  • pillow
  • pytesseract
  • spacy
  • fastapi
  • uvicorn
  • sqlalchemy
  • reportlab (for PDF export)

Installation

1. Install Python dependencies:

pip install -r requirements.txt

2. Download spaCy model:

python -m spacy download en_core_web_sm

3. Set up Google Cloud Vision API:
   • Create a project in Google Cloud Console
   • Enable the Vision API
   • Create a service account and download credentials JSON
   • Rename the JSON file to gcp-credentials.json and place it in the project directory
   • Or set the GOOGLE_APPLICATION_CREDENTIALS environment variable

Usage

GUI Interface

python analyzer_gui.py [path_to_credentials.json]

Command Line

python screenshot_analyzer.py <image_path> [credentials_path]

REST API Server

python screenshot_analyzer.py --server [port] [credentials_path]

API Endpoints

• POST /upload: Upload and process an image
• GET /search: Search for images by text, tags, or category
• POST /export: Export search results to a file (JSON, CSV, PDF)

Database Schema

The system uses SQLite to store images, tags, and metadata:

• images: Stores image metadata, OCR text, category, etc.
• tags: Stores unique tags with frequency counts
• image_tags: Links images to tags (many-to-many)

Project Structure

• screenshot_analyzer.py: Core analyzer with Google Vision integration
• analyzer_gui.py: GUI interface
• analyzer_cli.py: Command-line interface
• batch_processor.py: Batch processing script for multiple images
• advanced_features.py: Additional features and enhancements

Development

This tool follows a modular design that allows for easy extension and customization. The core screenshot analyzer can be used independently of the GUI or API components.

License

MIT License