Your Canary · help & recovery

Help for your Canary.

Something wrong? Start at the Help Desk: say what you see and land on the fix. Below: what your Canary can do, how to check it's yours, and how to recover it.

Show me

Everything your Canary can do

Every tool below is already in the device or one click away. Nothing to install.

🔌 Watch a plug-in 🩺 Run the Doctor ⚡ Flash it in your browser

The on-device keys work over USB serial at 115200 baud: press one, watch it answer. Developer detail has the technical version of each.

🔎 Check it's really your Canary

Every Canary draws a shape from its public key: unique to it, and completely different if the key changes. Your browser draws the same shape straight from the device, so you can compare them by eye. No account; nothing leaves your machine.

Plug in over USB, then connect. We'll ask it to introduce itself.

Then check by eye: press l on the Canary over USB serial — it prints this same shape on its own screen. If the two match, the device in your hand is the one that made your evidence. If they don't, something's been swapped. What can the sticker on the case prove? See Sticker Check.

🛡️ Why plugging it in is safe

Malicious USB sticks attack by typing on their own. A Canary is built not to:

✋It never types on its own. Plugging it in types nothing. START-HERE on its drive is an ordinary bookmark, and a BOOT tap types this page's address (plus a launcher hotkey, if you picked one with o). Either way, a person chose it.
🔒One fixed destination. The only address the device can ever type — or put in that shortcut — is this help page (securacv.com/canary). It cannot type commands, run programs, or reach anywhere else — the firmware refuses any other address.
💾Your files are read-only. When your Canary appears as a drive, it is read-only over USB — you can copy evidence off, but nothing on your computer can alter or erase what's on it.
🔌Off by default. Typing ships turned off, and exists only in the opt-in USB build.

1Browse your files

On the USB onboarding build, your Canary also shows up as a read-only drive, like a flash drive: no app, no driver, no account. Open it in your file manager (or Files on an iPhone or iPad) and your evidence is just files.

/WITNESS/The append-only, signed witness log (records.jsonl). The tamper-evident record of what happened — never who.
/HEALTH/Device diagnostics and health history.
/CHAIN/A backup of the hash-chain head used for integrity checks.
/VAULT/Sealed evidence snapshots (.svlt), encrypted to your key — see unsealing below.
Check it yourself. Copy /WITNESS/records.jsonl to your computer and run tools/verify_witness_log.py from the repository to confirm every entry's signature and the unbroken chain.

2Recover your device

Your evidence lives on the SD card, and the device rebuilds its bookkeeping from it.

1

To recover

Re-seat the SD card and reboot. The chain head is rebuilt from the card automatically. Nothing to reinstall.

2

The log outlives a reset

A factory reset erases only the device's stored settings (Wi-Fi, name, keys cache in NVS). It never touches the witness evidence on the SD card.

3

The SD card wins on boot

At startup the Canary compares its cached position with the log on the SD card and adopts the card's version — but only if it's further ahead and its signature verifies under this device's key.

Hold BOOT for 5 seconds only if you mean it. That triggers a factory reset of settings. Your SD evidence survives, but the device will need setup again.

3Unseal your evidence

Sealed snapshots (.svlt files in /VAULT) are encrypted to your public key as they're captured. The Canary holds only that public key, so it is structurally unable to open them.

1

Copy them off

From the read-only drive, copy the .svlt files in /VAULT to your computer.

2

Unseal with your private key

Run tools/unseal_snapshot.py with your private key. The images decrypt on your machine — never on the device, never on our servers.

Console quick reference

Over USB serial at 115200 baud:

uOpen this help page (announces a preview, then waits for a BOOT press)
oUSB onboarding status; cycle the launch method (manual / macOS / Windows / Linux)
vRecovery guide
kUnseal guide
sDevice status
iDevice identity (id + public key)
BOOTTap = open this page · 2s = status · 5s = factory reset
Want a BOOT tap to wait for you? Press o and set the launch method to manual: the address goes into a field you've focused, and you press Enter.