// first 10 minutes
election integrity investigation — quick-start
election integrity — first 10 minutes. preserve artifacts before canvass closes. print this, check boxes, then run the primary tools.
checklist
- identify the specific artifact in question: voter roll export, e-pollbook log, ballot image, chain-of-custody transfer form, or election-night results file.
- hash every export sha-256 immediately — official canvass timelines are short and files may be overwritten after certification.
- obtain artifacts through official public records channels where available — unofficial copies have chain-of-custody gaps that undermine any analysis.
- note the jurisdiction, election date, precinct or county, and the specific claim being investigated before running any tool.
- pull the official results file and the unofficial election-night totals separately — discrepancies between the two are normal and explainable; document both.
- preserve any cast-vote record (CVR) exports if available — these are the per-ballot machine records, not the final certified totals.
- export the e-pollbook activity log if in scope — check-in timestamps, device identifiers, and poll-worker actions.
- note which tabulation software vendor and version produced the artifacts — output format and field names vary significantly.
- do not publish preliminary findings before the canvass is certified — premature claims have caused irreversible reputational damage to researchers.
- begin the primary tool path below — election artifact integrity analyzer.
primary tools
- 01email spoofing and SPF/DKIM/DMARC header validatorpaste raw email headers or drop eml file · validate authentication headers · detect spoofing indicators · surface spf dkim and dmarc results · identify header inconsistencies indicating spoofed or forged email · runs locally
- 02email impersonation pattern detectordrop multiple eml files or paste headers · detect display name spoofing domain lookalikes and reply-to hijacking · identify impersonation patterns targeting specific individuals or organizations · surface BEC and CEO fraud indicators · runs locally
- 03ai generated text fingerprint analyzerlinguistic metrics · burstiness · repetition · ai likelihood score · export csv · runs locally
- 04ai generated image provenance analyzerpng tEXt chunk inventory · sd metadata · stripped metadata flag · provenance csv · runs locally
- 05document metadata inconsistency finderdrop docx xlsx pptx pdf · core app props vs pdf info · temporal author revision heuristics · tracked changes timeline · runs locally
- 06metadata consistency checkerdrop a JPEG · PNG · or video · compare EXIF date vs file date vs filename date vs GPS timestamp · flag inconsistencies · dimension mismatches · runs locally
- 07ela image tampering detectordrop a JPEG · error level analysis · detect localized re-compression · flag tampered regions · visualize ELA map · runs locally
- 08copy-move forgery detectordrop an image · block-matching copy-move scan · suspicious region overlay · heuristic clone map · runs locally