# fileForensics
Source: https://docs.file.ai/forensics/overview

> Run 55 checks on a file at once, and find out whether to trust it before you act on it.

fileForensics

# fileForensics

Copy pageCopy page

Run 55 checks on a file at once, and find out whether to trust it before you act on it.

Copy pageCopy page

fileForensics runs **55 checks** on the original file for signs of editing, AI generation, reuse and hidden content, and reports each result. Use it on ID scans, bank statements, claim evidence and any file where a forgery costs money.

photo\_4.jpg$0.05 per run

→ 4 of 55 checks · 1 flagged, so send the file to review

## 

[​

](#start-here)

Start here

## Quickstart

Check a stored file and read the result in five minutes.

## Try the Sandbox

See every check on the Developer Portal, with no code.

## API reference

Start, poll, retry and delete runs.

## 

[​

](#how-it-works)

How it works

1

Start a run

At upload, or later on a stored file. See [Turn it on](#turn-it-on).

2

All checks start together

Every requested check runs on the original file at the same time, and results appear as each one finishes.

3

Each check reports on its own

There is no overall score, so a `complete` run can still contain an `issue`.

4

Your code makes the call

Most teams send a file to review on any `issue`, and treat `skip` (the check doesn’t apply to this file) as neutral. For related files, such as a claim pack, combine the results; see [Insurance claim evidence pack](/examples/claim-evidence-pack).

## 

[​

](#what’s-included)

What’s included

55 checks in three layers:

Layer

Checks

What they cover

Results

File checks

18

What the file is: metadata, fingerprint, fonts, page quality, barcodes and more

`checks.<key>`, with every run

Forensic checks

20

Signs of tampering in the file itself (see below)

`forensics.<key>`

Integrity questions

17

Whether the content holds together, answered from the file’s text, its page images and its signatures

`forensics.document_integrity_decisions`

The 20 forensic checks, grouped by what they catch:

Group

Checks

Editing

Cloned regions, revision history, different producers across pages

AI generation

AI-generated images, PDFs and Office files (a text check is listed but not yet active)

Reuse

Exact duplicates, appearance on the web

File structure

File signature, polyglot files, trailing data, entropy, active content, attachments, encryption

Provenance

Content credentials (C2PA), digital signatures, creation tools

Visual explanation

An attention heatmap showing where the image classifier looked; it is not a verdict on its own

Content integrity

The 17 integrity questions, combined into one decision

Each forensic check reports one of these statuses:

`status`

Meaning

`none`

Nothing found.

`issue`

Something to review.

`found`

Information reported, not a problem, such as a file signature that matches its type.

`skip`

The check doesn’t apply to this file.

`error`

The check failed.

Each integrity question answers `signal`, `no_signal` or `insufficient_evidence`, and an overall decision combines them. A signal is something to look at, not a fraud verdict. When the integrity questions aren’t enabled, `document_integrity_decisions` reports `skip` with a note that it is disabled. See [Checks & results](/verify/forensics#detectors) for every key.

## 

[​

](#turn-it-on)

Turn it on

## At upload

Add `FILE_FORENSICS` to `enabledProducts` on `POST /v1/files/upload`. **All 55 checks** run once the file is stored.Use it alone with `storageOnly: true`, or with `FILE_SCOUT` to extract and check the same file.

## On a stored file

Call `POST /v1/forensics` with the file’s `file_id` and the forensic checks you want in `spec_filter`, then poll the run. The 18 file checks come with every run that includes a forensic check.Use it to check files you uploaded earlier, or to run only some checks.

At upload, fileForensics only

```
curl -X POST "$FILEAI_BASE_URL/files/upload" \
  -H "x-api-key: $FILEAI_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "fileName": "bank-statement.pdf",
    "fileType": "application/pdf",
    "enabledProducts": ["FILE_FORENSICS"],
    "storageOnly": true
  }'
```

Here `FILEAI_BASE_URL` is `https://api.orion.file.ai/prod/v1`, or your [regional host](/authentication#regions). `enabledProducts` works only on the single upload route and needs a workspace enabled for these products; see [Upload options](/ingest/uploads#upload-options). An upload-time run starts only for a valid file that isn’t a duplicate and has no live run. Password-protected Office files are skipped. Read the result with `GET /v1/forensics/files/{file_id}`, which returns the file’s **newest run**. A later `POST /v1/forensics` run becomes the newest for the file.

## 

[​

](#pricing)

Pricing

fileForensics costs **$0.05 per completed run**, whatever the number of checks. A run started at upload is charged once it completes; runs that end in error, fail or are cancelled aren’t charged. See [Billing](/account/billing).

## 

[​

](#next-steps)

Next steps

## Checks & results

Every check, status and error.

## Claim evidence pack example

Nine files checked at once, turned into one decision.

## KYC checks

Choose checks per file and route on the result.

## Run it from your assistant

The MCP server’s fileForensics tools.

[Previous](/examples/warehouse-sync)[

Quickstart

Check a stored file for signs of editing or AI generation, and read the result, in about 5 minutes.

Next

](/quickstart/forensics)

⌘I

## On this page

Back to top

*   [Start here](#start-here)
*   [How it works](#how-it-works)
*   [What’s included](#what%E2%80%99s-included)
*   [Turn it on](#turn-it-on)
*   [Pricing](#pricing)
*   [Next steps](#next-steps)