Blog · Forensics

From “a face” to “a face, and where it came from”

A face in a folder is a screenshot. A face that can point back to its exact source frame is a record. That difference is chain of custody — and it’s a feature you have to build on purpose.

DawaImg showing a face record with its chain back to the source file

Provenance is the product

Most face software treats the face as the product. Detect it, group it, search it, done. DawaImg is built around a different claim: the face is the entry point, and the provenance is what you actually get. Producing “a face” is easy — a screenshot can do that in any tool. The hard part, the part worth shipping, is a face that carries a chain pointing back to the material it came from, because a chain like that has to be built by software that genuinely tracked your source data.

That is the difference between a tool that shows you faces and one that gives you records. Everything else in DawaImg — the grouping, the search, the offline speed — exists in service of that chain.

See the record chain in the app

Every face in DawaImg walks back to its source. Free on Windows & macOS.

The four records, in order

The chain is made of four record types, and they nest in strict order. Each one records exactly where the next one came from:

  • SourceRecord. The file you actually supplied — a photo, an export, an archive. What it is, what it’s named, and a fingerprint of its contents.
  • ResourceRecord. The material derived from that source: a decoded video stream, a rendered document page. It points back to the source.
  • FrameRecord. The exact position inside the resource — a frame index and timestamp, or a page number.
  • FaceRecord. The detected face, its crop, and links back to the frame, the resource, and the source. No step is reconstructed on the fly; every link is stored.

Non-destructive: originals never modified

DawaImg never writes back to your source media. No re-encoding, no trimming, no renaming, no metadata stripped away. The analysis lives in its own record store next to your files, so the sources keep their original shape — hash a file before a review and after it, and you get the same answer. That sounds like bookkeeping until someone asks why the material you handed in looks exactly like the material you handed back.

Reproducibility is what makes it defensible

A record is defensible because it can be re-derived. Since the chain from a FaceRecord back to its SourceRecord is stored data rather than an inference, anyone — you, a reviewer, or the you of six months from now — can take any face in the results and walk it back to the exact file that produced it. Same source, same resource, same frame, every time.

The v39.0 case study is the test case: roughly one million files surfaced about 2,000 faces, processed offline in about five to six hours, with around 98 percent recall and two false positives — both, fittingly, images of wood. Every one of those hits retained its full chain. That is the practical meaning of chain of custody in software: not only that the tool is accurate, but that its accuracy can be shown.