Ingesto

The problem

Stop trusting drag & drop with your rushes.

A Finder or Explorer copy tells you nothing about data integrity. It reports that files moved. It does not report that they arrived intact. A single corrupt frame slips through without a sound, and you find it in the edit, three weeks after the card was formatted.

There is no warning, no error, no red line. The copy simply completes. Everything looks normal right up until the moment it isn’t, and by then the only copy that could have saved you was wiped on set.

Verified offload is the answer to that, and it is not new. DITs and data wranglers have worked this way for years. What is new is the price: the established tools run from $169 one-time to around $899 a year.

A plain copy is not a backup. It is a hope.

How it works

Read each source once. Write everywhere at once.

Every extra pass over a card is another chance for a tired card or a marginal reader to fail. So Ingesto reads each source exactly once and streams it to every destination simultaneously. Two SSDs and a NAS take the same time as a single drive, and the card does the work once.

Multi-source to multi-destination, in a single pass. Volumes appear and disappear the instant they mount or eject, with no refresh and no rescan. Cards are identified before they are copied, and flagged if they are unformatted or have already been ingested. When the copy finishes, the verification pass runs at whatever level the mode calls for.

Copy modes

Four levels of paranoia.

The right mode depends on what happens next. A card heading straight into a second verified pass does not need the same treatment as the only copy of a one-take stunt.

SECURE · every byte, straight from the disk

The copy finishes, then every file is read back from each destination and fingerprinted with xxHash. Only a match against the real, on-disk bytes turns the row green.

PRO · the double-read

A destination that verifies tells you the write went well. It tells you nothing about the card you are about to format. PRO re-reads the source after the verify pass and compares it against what was written. A card starting to develop bad blocks shows up right here, before the wipe, not later in the edit.

If the card has been ejected or is returning errors, that second read fails and the file is flagged. It is never silently passed.

PRO also writes a checksum list and an MHL manifest per folder, next to the media: xxHash64, xxHash128 or MD5, readable by Silverstack, YoYotta and OffShoot.

During the ingest

Every card, every destination, at a glance.

Once a run starts, the middle column becomes the queue. One block per card, one nested row per destination, each with its own bar. The colour of a bar says which phase it is in, copy, verify, or the second source read. A ring on the block says how far that card has come, weighted by bytes rather than by file count, so a card of four hundred small files and a card of six large ones both tell the truth.

Above them sit the numbers that matter while you wait: the file being handled right now, files and data remaining, current speed, and an ETA computed per phase rather than smoothed across copy and verification, because those two run at very different speeds. Network destinations carry a NETWORK tag, and finished blocks dim so the eye lands on what is still running.

Destinations are verified in parallel, grouped by physical device so two drives on the same bus do not fight each other. On a three-destination run that took nineteen seconds to verify, it now takes eleven. And when files do fail, they land in a retry queue instead of forcing a whole card to be done again.

Before anything is written

The mistakes that are caught at the door.

Two cards whose names resolve to the same destination folder are refused at Start, with both cards and the folder named. The check runs on the resolved name, so a template without a counter that would collide for a whole batch is caught too, before a single byte is copied.

A source or destination that vanished between the moment you loaded it and the moment you pressed Start is caught as well: a drive ejected, a network share that kept its mount point but stopped answering. Ingesto names the volume and tells you nothing was copied, rather than failing file by file for the next ten minutes.

And everything that defines a run is frozen at Start: naming template, copy mode, algorithm, double read, file filter, counter. Changing a field while card one is copying can no longer quietly give cards two and three a different folder name or a different mode. The interface locks the fields it froze, and leaves Pause, Cancel and the view selector alone.

The extras

Everything else you end up needing at 2am.

How it compares

Against the rest of the field.

Comparison data verified August 2026. Corrections welcome, tell me what I got wrong.