Technical information

System requirements

• Windows 10 or Windows 11, 64-bit (x64). SAMM does not run on macOS, ChromeOS, tablets, or phones.
• Microsoft Edge WebView2 Runtime. It is already installed on Windows 11 and on most up-to-date Windows 10 computers. If it's missing, the SAMM installer downloads it from Microsoft: see WebView2 for computers where that can't work.
• Screen: 1024 × 768 or larger. A second monitor is handy for presentations.
• Disk space: about 230 MB for the app, plus room for your cases. Imported evidence is copied into the case folder, so plan space for the video you work with.
• Hardware: any modern 64-bit PC. Maps are drawn with graphics acceleration (WebGL), which the built-in graphics of a recent PC provide, so no separate graphics card is needed. Videos that have to be re-encoded are converted on the computer's graphics chip when it can, otherwise on the processor, so a faster computer makes large video imports quicker. On a remote or virtual desktop, see Remote and virtual desktops.
• Internet: needed to sign in and for satellite maps. See working offline.

Installing SAMM

1. The person uses the download link in the email that invited them, or signs in at app.sammapper.com and downloads SAMM from their Profile page.
2. They run SAMM_<version>_x64-setup.exe. It installs SAMM for the current user, into %LOCALAPPDATA%\Programs\SAMM, and doesn't need administrator rights.
3. They open SAMM, enter their work email (and the code from their email, if it has one), then select Continue. We email them a sign-in code.

Two Microsoft checks may stop a new download the first time:

• Edge: "SAMM_<version>_x64-setup.exe isn't commonly downloaded." Select ... (More actions) next to the file, then Keep, then Show more, then Keep anyway.
• Windows: "Windows protected your PC." Choose More info, check that the publisher is Wooden Nickels LLC, then choose Run anyway.

Both checks go by how many people have downloaded a file, so a new version can show them for a while. Updates SAMM installs itself don't go through them.

Computers that only allow approved software: AppLocker's default rules let standard users run programs only from the Windows and Program Files folders, so they block the installer and a copy installed for one person in %LOCALAPPDATA%. On those computers IT installs SAMM for everyone (see Installing for IT) or allows SAMM by its publisher (see Allowing SAMM).

The installer also adds a Start menu shortcut and opens .samm case files with SAMM.

Installing for IT

To install SAMM for everyone who uses a computer, run the installer with administrator rights (or as SYSTEM from your deployment tool):

SAMM_<version>_x64-setup.exe /S /AllUsers

The install folder is fixed: SAMM always goes in one of those two folders, and an update stays where SAMM already is. On computers with AppLocker or App Control, installing for everyone puts SAMM in Program Files, which AppLocker's default rules already allow.

• Updates: a copy installed for everyone is updated by IT. Run the newest installer with the same command; it installs over the old copy and keeps everyone's settings and cases. On those computers SAMM doesn't offer updates; it tells people "IT installs updates on this computer".
• Copies people install themselves update themselves: SAMM offers each new version, and the person chooses when to install it.
• SAMM open during an install: a silent install closes it first, so schedule installs and updates for when SAMM isn't in use.
• The newest installer: your agency admin can download it from the Profile page at app.sammapper.com, or email support@sammapper.com for a link.
• Removing SAMM: run "C:\Program Files\SAMM\uninstall.exe" /S /AllUsers. Cases are never deleted by the installer or the uninstaller.

WebView2

SAMM's window runs on the Microsoft Edge WebView2 Runtime. When the installer doesn't find it, it downloads Microsoft's small WebView2 setup program from go.microsoft.com and runs it, and that program downloads the runtime from Microsoft. If either download fails, the installer stops and SAMM isn't installed. That happens on computers without internet access and behind a proxy that asks for a sign-in, and it can happen when a deployment tool runs the installer as SYSTEM, which doesn't use the proxy settings people have.

On images and computers that may not have it, deploy Microsoft's WebView2 Evergreen Runtime first (its Evergreen Standalone Installer, x64, works offline), then SAMM. Microsoft keeps the Evergreen Runtime up to date after that.

Allowing SAMM

The installer and every program SAMM installs are signed by SAMM's publisher, Wooden Nickels LLC, with a timestamp. Windows shows that name in the User Account Control prompt and in each file's Properties, on the Digital Signatures tab. Allow SAMM by that publisher, not by file hash or folder: each release brings new files. Don't tie a rule to one certificate's thumbprint either: the signing certificate is renewed every few days, so the next release has a different one.

The files are in C:\Program Files\SAMM (installed for everyone) or %LOCALAPPDATA%\Programs\SAMM (installed for one person):

SAMM's window itself runs in Microsoft's WebView2 (msedgewebview2.exe), which is signed by Microsoft.

AppLocker and App Control for Business

• AppLocker: add an Executable rule: Allow, Everyone, with a Publisher condition. Browse to a signed SAMM file such as samm-mediamapper.exe and move the slider to Publisher, so the rule names Wooden Nickels LLC with any product name, file name and version. That one rule covers SAMM, FFmpeg, SAMM Player, the installer and every update, wherever they are. If you also enforce DLL rules, add the same publisher rule there: the installer's helper files are signed the same way.
• App Control for Business (WDAC): allow SAMM's signer with a Publisher rule made from a signed SAMM file (Publisher level). Hash and file name rules would need a new rule for every release.
• Or install SAMM for everyone with /S /AllUsers: AppLocker's default rules already allow Program Files. SAMM Player in case packages still needs the publisher rule, because it runs from wherever the package is unzipped.

Antivirus and EDR

If your antivirus or EDR quarantines FFmpeg or stops SAMM, add an exception by signer (Wooden Nickels LLC) where your product supports it, rather than by folder: a folder exception also lets in anything else saved there. When FFmpeg is quarantined, video imports and conversions fail, and Check this computer (below) reports the video converter as missing or blocked. Restore it from quarantine, or reinstall SAMM.

Controlled folder access

Windows Security's Controlled folder access stops programs it doesn't know from changing files in protected folders such as Documents and Desktop. SAMM saves case packages, reports and videos wherever people choose, often in those folders, and FFmpeg writes the videos. If it is turned on, add both as allowed apps: C:\Program Files\SAMM\samm-mediamapper.exe and C:\Program Files\SAMM\ffmpeg.exe (or the same files in %LOCALAPPDATA%\Programs\SAMM). Use Windows Security > Virus & threat protection > Ransomware protection > Allow an app through Controlled folder access, or the allowed applications list in your Defender policy. If a save is still blocked, Windows Security's Protection history names the program it stopped.

Network and firewall

All of SAMM's traffic is outbound HTTPS on port 443. SAMM doesn't open any inbound ports. If your network filters traffic, allow these hosts:

If the status addresses are blocked, SAMM still works; it just can't warn people about an outage. Links in SAMM open in the person's web browser: sammapper.com, app.sammapper.com, status.sammapper.com, and the map credits' pages at Mapbox and OpenStreetMap.

Apart from Mapbox's standard map-usage reporting, SAMM has no third-party analytics or tracking. Crash reports are sent only when the user clicks Send report.

Proxies and HTTPS inspection

• Proxies: SAMM's own connections (sign-in, check-ins, updates, map keys, Sam and the status check) use the fixed proxy in the Windows proxy settings of the person's account (Settings > Network & internet > Proxy > Manual proxy setup), or the HTTPS_PROXY environment variable. They don't run a proxy script or detect one (PAC or WPAD: "Use setup script" and "Automatically detect settings"), and they can't sign in to a proxy that asks for a Windows sign-in. The map is loaded by WebView2, which follows all of the Windows proxy settings. If your network relies on a proxy script or proxy sign-in, let the SAMM hosts above through without them, or set a fixed proxy.
• HTTPS inspection: SAMM checks certificates against the Windows certificate store, as the map does. Inspection works when the inspection certificate is in Trusted Root Certification Authorities on that computer. If it isn't, SAMM says the network replaced its security certificate: trust the inspection certificate, or exempt the SAMM hosts from inspection.

Check this computer, in SAMM under Help > Support and on the sign-in screen, tests the connections to SAMM, updates, downloads and the map, and reports the proxy, graphics, clock, cases folder and video converter, each with its fix. Copy for IT copies the whole report, so people can send it to you.

Sign-in email

Sign-in codes, invitations, quotes and invoices come from noreply@sammapper.com, sent through SMTP2GO, SAMM's email service. A sign-in code works for 30 minutes. If your mail filter holds or quarantines outside mail, allow that sender so codes arrive in time.

Remote and virtual desktops

On Citrix, other virtual desktops (VDI) and Remote Desktop:

• Graphics: maps are drawn with graphics acceleration (WebGL). With software graphics they work, but slowly; without WebGL they can't be drawn at all. Turn on GPU acceleration for the desktops in your virtual desktop platform. For Remote Desktop into a PC with a graphics card, the Group Policy "Use hardware graphics adapters for all Remote Desktop Services sessions" lets sessions use it. Check this computer shows which graphics SAMM gets.
• Install for everyone: put SAMM in the image with /S /AllUsers. A copy installed for one person lives in their profile.
• Cases folder: on pooled or non-persistent desktops, %LOCALAPPDATA% is often not kept between sessions, and SAMM's default cases folder, %LOCALAPPDATA%\SAMM Cases, would go with it. Before anyone saves a case, set the CasesFolder policy to a folder that persists, such as a share: see Setting the cases folder.
• Sign-in: SAMM keeps the sign-in in Windows Credential Manager. Where the profile isn't kept, people sign in again, with a code by email, each session.

Where data is stored

• Cases and evidence: %LOCALAPPDATA%\SAMM Cases\<case number> - <case name>\ on the computer, a private folder that OneDrive does not sync and other Windows accounts cannot open. IT can set a different folder, such as an evidence server: see Setting the cases folder. Imported files are copied into the case folder, and each case keeps an append-only audit log of changes.
• What our servers store: nothing about your cases. No evidence, no case names or numbers, no lead detectives. We keep only your account (email, agency, role), which computers are signed in (name, OS, IP, SAMM version), and feedback text you send.
• Sign-in token: stored in Windows Credential Manager, not in a file.
• Logs: %LOCALAPPDATA%\com.samm.mediamapper\logs\ (three rotating 5 MB files). Support may ask for these.
• Backups: back up the SAMM Cases folder (%LOCALAPPDATA%\SAMM Cases, or the folder IT set) with your agency's normal backup tools. Cases can also be exported as a single .samm file.

Setting the cases folder

IT can choose where SAMM keeps cases, such as an evidence server, or a folder that persists on virtual desktops. People can't change it in SAMM; Settings > Case storage shows it as set by IT.

• The setting: the string value CasesFolder (REG_SZ or REG_EXPAND_SZ) in HKLM\SOFTWARE\Policies\SAMM for everyone on the computer, or HKCU\SOFTWARE\Policies\SAMM for one person. The computer setting wins when both are set. Set it with Group Policy, Intune or a script; email support@sammapper.com for SAMM's Group Policy template (ADMX).
• A folder for each person: environment variables are expanded, so \\evidence-server\samm$\%USERNAME% gives each Windows account its own folder.
• Permissions are yours: SAMM creates the folder if the person is allowed to, but never changes its permissions. Give each person modify rights to their own folder, plus whatever supervisor or evidence-custodian access your policy requires.
• No fallback: if the folder can't be reached (server offline, VPN down), SAMM says so and offers Try again. It never keeps evidence anywhere else instead.
• Cases already on the computer: SAMM offers to copy them into the new folder, checking every file against the original.

More detail is in the security section of the Features page.

Working offline

SAMM checks in with our servers when it starts and every 30 minutes while it runs. If the network is down, SAMM keeps working; a lost connection never signs anyone out.

• Works offline: opening cases, reviewing evidence, video tools, timelines, and presentations. Locations still show on the map; the satellite imagery behind them needs a connection.
• Needs a connection: signing in, satellite and street maps, address search, and road routing.
• Offline limit: SAMM keeps working for up to 30 days after its last successful check-in. After that it asks the user to sign in again before opening cases.

Sign-in and seats

• No passwords. People sign in with their work email and a sign-in code we email them. Codes work for 30 minutes, so mail held by a filter for a few minutes still arrives in time, and lock after 5 wrong tries. Mail comes from noreply@sammapper.com (see Sign-in email).
• One computer per person at a time. Signing in on a new computer signs that person out of the previous one.
• Seats. A seat is one computer signed in to SAMM. Your agency's license sets how many. When every seat is in use, the next sign-in signs out the computer that has been idle longest.
• Web dashboard sign-ins (at app.sammapper.com) never use a seat.
• Agency admins add people from the dashboard (one work email or a pasted list), see which computers are signed in, sign any of them out, and suspend accounts. A signed-out computer loses access at its next check-in, within 30 minutes.

Updates

SAMM checks for a new version each time it starts. The person chooses when to install it: update now, remind later, or skip that version. Nothing installs silently. Every update is cryptographically signed, and SAMM verifies the signature before installing. Copies IT installed for everyone are updated by IT with the same silent command: see Installing for IT.

Supported file types

Video that won't play as-is is converted to MP4 (H.264) automatically; FFmpeg is included, so nothing else needs installing. Proprietary recorder audio (for example NICE, Verint, DSS, VOX, or WMA) must be exported to a standard format first.

Sharing with prosecutors

Export a case as a portable package: a single .zip with SAMM Player, the case file, and a README. The recipient extracts it, opens SAMM Player, and drags in the case file. Nothing is installed, the case opens read-only, and the case never leaves their computer. The README includes a SHA-256 hash so they can confirm the case file hasn't changed. SAMM Player needs Windows 10 or 11 with WebView2, and an internet connection for the map: api.sammapper.com for its map key, and Mapbox for the imagery. On computers that only allow approved software, SAMM Player needs the publisher rule in Allowing SAMM.