# fileForensics
Source: https://docs.file.ai/forensics/overview

> Run every forensic check on a file at once, and find out whether to trust it before you act on it.

fileForensics

# fileForensics

Copy pageCopy page

Run every forensic check on a file at once, and find out whether to trust it before you act on it.

Copy pageCopy page

fileForensics checks the original file for signs of editing, AI generation, reuse and hidden content, and reports a verdict per check. Use it on ID scans, bank statements, claim evidence and any file where a forgery costs money.

## 

[​

](#two-ways-to-run-it)

Two ways to run it

## At upload

Add `FILE_FORENSICS` to `enabledProducts` on `POST /v1/files/upload`. **All 19 checks** run once the file is stored.Use it alone with `storageOnly: true`, or together with `FILE_SCOUT` to extract and check the same file.

## On a stored file

Call `POST /v1/forensics` with the file’s `file_id` and the checks you want in `spec_filter`, then poll the run.Use it to check files you uploaded earlier, or to run only some checks.

At upload, fileForensics only

```
curl -X POST "$FILEAI_BASE_URL/files/upload" \
  -H "x-api-key: $FILEAI_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "fileName": "bank-statement.pdf",
    "fileType": "application/pdf",
    "enabledProducts": ["FILE_FORENSICS"],
    "storageOnly": true
  }'
```

Here `FILEAI_BASE_URL` is `https://api.orion.file.ai/prod/v1`, or your [regional host](/authentication#regions). `enabledProducts` works only on the single upload route and needs a workspace enabled for these products; see [Upload options](/ingest/uploads#upload-options) for the rules. An upload-time run starts only for a valid file that isn’t a duplicate (password-protected Office files are skipped), and is skipped if the file already has a live run. Read the result with `GET /v1/forensics/files/{file_id}`, which returns the **newest run** for the file. If you later start another run with `POST /v1/forensics`, that run becomes the newest.

## 

[​

](#what-it-checks)

What it checks

19 checks, grouped by what they catch:

Group

Checks

Editing

Cloned regions, revision history, different producers across pages

AI generation

AI-generated images, PDFs and Office files (a text check is listed but not yet active)

Reuse

Exact duplicates, appearance on the web

File structure

File signature, polyglot files, trailing data, entropy, active content, attachments, encryption

Provenance

Content credentials (C2PA), digital signatures, creation tools

Each check reports `none`, `issue`, `skip` or `error`. See [Detectors](/verify/forensics#detectors) for every key and what it returns.

## 

[​

](#how-the-checks-add-up)

How the checks add up

*   **All checks start together.** A run starts every requested check on the file at the same time, and results appear as each one finishes.
*   **Each check reports on its own.** There is no single overall score: a run can be `complete` and still contain an `issue`.
*   **Your code makes the call.** Most teams route a file to review when any check reports `issue`, and treat `skip` (the check doesn’t apply to this file type) as neutral. For a set of related files, such as a claim pack, combine the results across files; see [Insurance claim evidence pack](/examples/claim-evidence-pack).

## 

[​

](#how-usage-is-counted)

How usage is counted

fileForensics is metered at **one unit per completed run** started at upload, whatever the number of checks. Runs that end in error, fail or are cancelled are not charged. For plans and prices, see [Billing](/account/billing).

## 

[​

](#next-steps)

Next steps

## Run a check

Check a stored file and read the verdict in five minutes.

## KYC example

Choose checks per file and route on the result.

## Detectors and results

Every check, status and error.

## Run it from your assistant

The MCP server’s fileForensics tools.

[Previous](/extract/data-types)[

Run a check

Check a stored file for signs of editing or AI generation, and read the result, in about 5 minutes.

Next

](/quickstart/forensics)

⌘I

## On this page

*   [Two ways to run it](#two-ways-to-run-it)
*   [What it checks](#what-it-checks)
*   [How the checks add up](#how-the-checks-add-up)
*   [How usage is counted](#how-usage-is-counted)
*   [Next steps](#next-steps)