Recursive ForensicsTesla Dashcam Decrypter
Decrypt Tesla 2026.20+ encrypted dashcam and Sentry Mode footage locally, and analyze its embedded telemetry — built from the ground up for forensic soundness.
Windows 11 · single signed executable, no installer · footage never leaves the workstation.
What it does
From an encrypted USB or a mounted forensic image, all the way to a mapped, analyzed trip — on one workstation.
Local decryption
Reverses Tesla's per-clip AES-128-CBC encryption on your machine. Only the clip IDs are ever sent to Tesla to fetch keys; the video itself is never uploaded.
Telemetry & mapping
Extracts embedded SEI telemetry — speed, GPS, heading, gear, driving events — and exports a Google Earth track, a speed graph, and multi-camera stitched video.
Case-ready output
Per-clip MD5 hashes, a column-aligned decrypt log, and a declared recording time zone carried through every export — organized around a case reference.
A workflow that mirrors the process
Four stages, left to right — nothing locked, so you can jump straight to analysis if you already have decrypted clips.
Prepare the evidence
Image the USB to E01, verify the acquisition hashes, and mount it read-only — tracked against a case reference.
Set up the run
Declare the recording time zone, point at the source and output, and choose an account (token or saved keystore).
Decrypt
Optionally filter by time frame, then decrypt — watching per-clip status, size, and key source as it runs.
Examine
Telemetry table, Google Earth map, speed graph, multi-camera stitch, and driving-event detection.
Built for forensic soundness
Evidence integrity and a minimal trust footprint are design constraints, not afterthoughts.
Footage stays local
Decryption happens entirely on the workstation. Only clip identifiers are sent to Tesla to retrieve keys — the video is never transmitted.
Stores no credential
The bearer token lives in memory for the session and is gone at close. The app persists no account credential anywhere.
Works from a mounted image
Point it at a read-only E01 mount and decrypt to a separate output — the source stays untouched.
Signed, verified releases
Every release is cryptographically signed. The app verifies the signature against a built-in key before trusting an update, so a compromised host cannot push a malicious build.
Licensed to registered examiners
Runs only with a valid, signed license — issued per examiner or machine, and verifiable offline for isolated forensic environments.
Hash-verified integrity
Per-clip MD5 values and a persistent decrypt log make the output straightforward to document and re-verify.
Download
Current release for Windows 11. Requires a valid license to run.
Tesla Dashcam Decrypter
Single signed executable · no installer · ~120 MB
updates.recursiveforensics.com and resolves once the R2 updates bucket is populated with the signed release (see the app repo's RELEASE.md). Update the version label and link each release.