The Problem

Investigators and OSINT analysts routinely need to extract EXIF metadata from large batches of images and videos, plot GPS coordinates on a map, and reconstruct timelines of where and when media was captured. Doing this manually with individual files is slow and error-prone. Existing tools are often commercial, require uploads to third-party servers, or lack batch processing.

What This Does

Refloow Geo Forensics is an Electron-based desktop application that automates batch EXIF extraction, geospatial visualization, and timeline reconstruction. It runs fully locally—no data leaves the machine. The core logic lives in src/src/utils/scanner.js, which defines scanDirectory, countFiles, and walk to traverse directories. The Express server in src/src/server.js handles API routing via src/src/routes/api.js, and src/main.js creates the Electron window loading src/public/index.html.

The tool supports Windows, Linux, and macOS with installers for Microsoft Store and Snap. It uses ExifTool as the extraction engine, which means broad file-type support.

How It Is Wired

Execution starts at src/main.js → createWindow(), which launches the Electron app and the Express server via startServer() in src/src/server.js. The server exposes API routes from src/src/routes/api.js. The scanner module (src/src/utils/scanner.js) is the workhorse—it's imported by two modules and contains the directory traversal logic (walk, countFiles, scanDirectory). The import graph is small: 5 modules, 4 edges, no cycles. The scanner is the hub with the widest blast radius; everything routes through its directory-walking logic.

The dependency graph shows src/src/server (instability 0.67) and src/src/routes/api (0.5) as moderately unstable—they depend on other modules and are depended upon. The scanner (instability 0) is stable but carries the most logic: 25 branch points over 77 lines. A run does this: scan a directory → extract EXIF via ExifTool → serve results through the API → render on the map in the UI. No external network calls are made.

How To Use It

git clone https://github.com/moses-y/Refloow-Geo-Forensics
cd Refloow-Geo-Forensics/src
npm install
npm start

The src/package.json defines the dependencies and scripts. No environment variables are required—the app runs entirely locally. Windows users have install.bat and start.bat at the repo root.

Real-World Use

An analyst receives a folder of 500 photos from a field investigation. They launch the app, point it at the folder, and get: a map with all GPS-tagged photos plotted, a chronological timeline of capture times, and the ability to preview images in the sidebar. The analyst can then toggle between map layers (satellite, topographic, dark mode) to cross-reference locations without uploading anything.

Code Health & Issues

Static analysis found 2 issues:

  • High - Duplicated code blocks: 47 repeated 6-line blocks across src/main.js, src/src/routes/api.js, src/src/server.js, and src/src/utils/scanner.js. Extract shared helpers and DRY the repeated logic.
  • Medium - High branching density: src/src/utils/scanner.js has 25 branch points over 77 lines. Decompose the decision-heavy logic.

SDLC observations: No test files exist, despite CI being configured via GitHub Actions. The workflows have several issues: no least-privilege permissions for GITHUB_TOKEN, no Dependabot, npm install instead of npm ci, no dependency vulnerability scan, 8 generated build files committed to src/build/, no persist-credentials: false on checkout, and no job timeouts. The repo has a license (AGPL v3) and a lockfile, and no committed secrets were found.

The Bottom Line

The tool solves a real problem for OSINT investigators and does it locally, which is a meaningful privacy advantage. The codebase is small and simple to understand, but it needs tests and CI hardening before it's production-grade. The duplicated logic and dense branching in the scanner will make maintenance harder as features grow. Suitable for investigators who need quick, local batch geolocation and are comfortable with the current maintenance burden.