livestream impersonation / creator takeover
channel takeover · stream-key theft · live deepfake impersonation · OAuth grant abuse. evidence spans OBS/Streamlabs config, platform chat/VOD exports, and synthetic media artifacts.
entry point: obs streamlabs config forensic analyzer. work the primary tools top-down — all local, no upload.
start here · primary tools
ordered. work top-down. the first tool is the suggested entry point for this case type.
- obs streamlabs config forensic analyzerdrop obs / streamlabs profile + scenes config · surface stream-key references, source list, hotkeys
- twitch chat log forensic analyzerdrop twitch chat log export · parse user messages + moderation events
- youtube gaming stream chat forensic analyzerdrop youtube live chat replay json · parse messages, super-chats, mod actions
- video deepfake analyzerdrop a short video · sample frames · blink rate · face boundary flicker · temporal inconsistency score · runs locally
- ai synthetic voice generation artifact analyzeranalyze synthetic voice generation artifacts and identify possible AI-generated speech characteristics · spectrogram consistency, prosody, splice boundaries · runs locally
- google account activity export forensic deep analyzerdrop google takeout 'my activity' html/json · parse per-product activity timeline · flag credential recovery access events · csv/json export · runs locally
- casb oauth token abuse detectordrop casb oauth grant export · detect excessive scope grants · runs locally
also useful · secondary tools
supporting and follow-up tools. surface as the investigation widens.
- twitch stream vod metadata forensic extractordrop twitch vod metadata · parse stream timing + game category + chat overlay
- kick streaming chat log forensic analyzerdrop kick chat export · parse messages + tipping events
- face swap artifact detectordrop an image · jawline color mismatch · compression boundary heuristics · face-region signal table · runs locally
- deepfake voice cloning fraud investigation kitdrop call recordings + metadata + payment traces · build voice clone fraud evidence binder · runs locally
- url redirect chain tracerpaste shortened URLs · trace full redirect chain via proxy · detect malicious redirects · show final destination · flag suspicious hops · runs locally
- fatcousin multi tool super timeline correlatordrop any fatcousin findings csv/json · unified timestamp-sorted timeline · runs locally
- fatcousin cross export ioc hash correlatordrop hash/ioc csv from any fatcousin tool · shared indicator intersection report · runs locally
- case report generatorfill in case number · examiner · dates · findings · drop evidence files for auto hash · generates structured forensic report PDF · runs locally
proof & methodology
synthetic reference investigations and investigation playbooks for this case type — fixture-locked goldens, local binders, evidence order, and tool paths.
investigation guide: livestream impersonation / creator takeover — methodology →
side-by-side: compare case types →
run as a case-kit pipeline
no curated stack for this case type yet. tracked in the forensics rollout — pipelines roll out one case type at a time.