creator safety · stalker & NCII
non-judgmental post-incident triage for adult creators — NCII leaks, impersonation, doxxing, processor deplatforming notices, stalker DMs. metadata and exports only · not subscriber surveillance · runs locally.
entry point: evidence manifest generator. work the primary tools top-down — all local, no upload.
start here · primary tools
ordered. work top-down. the first tool is the suggested entry point for this case type.
- evidence manifest generatordrop evidence files · compute md5 sha1 sha256 · chain of custody manifest · case number · analyst · export pdf and csv · runs locally
- doxxing victim investigation kitdrop social posts + pii exposure logs + threat messages · build victim safety report · runs locally
- sextortion ncii investigation kitdrop extortion messages + payment demands + platform reports · build ncii case package · runs locally
- sextortion takedown notice package generatordrop incident evidence · output platform-specific takedown notice templates · runs locally
- payment processor subpoena response normalizer stripedrop stripe subpoena response · parse merchant + transaction artifacts · runs locally
- payment processor subpoena response normalizer paypaldrop paypal subpoena response · parse account + transaction artifacts · runs locally
- ai generated image provenance analyzerpng tEXt chunk inventory · sd metadata · stripped metadata flag · provenance csv · runs locally
- ela image tampering detectordrop a JPEG · error level analysis · detect localized re-compression · flag tampered regions · visualize ELA map · runs locally
also useful · secondary tools
supporting and follow-up tools. surface as the investigation widens.
- online defamation harassment litigation kitdrop social posts + dm exports + platform takedown logs · defamation evidence package · runs locally
- ios imessage deletion artifact detectordrop ios sms.db · rowid gaps · join orphans · deleted_messages tombstones · ck_sync_state=2 · two-db guid compare · bulk deletion · runs locally
- iOS WhatsApp artifact forensic extractordrop iOS WhatsApp ChatStorage.sqlite and Contacts.sqlite · parse all chats, messages, groups, and media references · reconstruct conversation timelines with delivery status · surface location shares, contact cards, and deleted message placeholders · runs locally
- multi-source entity resolverdrop forensic csvs · resolve names emails usernames ips across sources · probabilistic entity profiles · runs locally
- domain reputation analyzerpaste domains or IPs · score by entropy · TLD risk · homoglyph detection · DGA patterns · punycode abuse · age heuristics · no external lookup · runs locally
- social media subpoena response normalizer twitter xdrop twitter / x subpoena response · parse account + dm data · runs locally
- social media subpoena response normalizer redditdrop reddit subpoena response · parse account data · runs locally
- payment processor subpoena response normalizer squaredrop square subpoena response · runs locally
- fatcousin multi tool super timeline correlatordrop any fatcousin findings csv/json · unified timestamp-sorted timeline · runs locally
- fatcousin cross export ioc hash correlatordrop hash/ioc csv from any fatcousin tool · shared indicator intersection report · runs locally
- case report generatorfill in case number · examiner · dates · findings · drop evidence files for auto hash · generates structured forensic report PDF · runs locally
proof & methodology
synthetic reference investigations and investigation playbooks for this case type — fixture-locked goldens, local binders, evidence order, and tool paths.
investigation guide: creator safety · stalker & NCII — methodology →
side-by-side: compare case types →
run as a case-kit pipeline
no curated stack for this case type yet. tracked in the forensics rollout — pipelines roll out one case type at a time.