Buy vs build · threat-to-tool matrix · owned-gear sufficiency · cost-vs-coverage · the three-path build comparison

14.1 About this volume

This is the synthesis volume of the CameraDetection series. Every prior volume addressed one detection modality, one product tier, one design path, or one owned-gear profile in depth. The question Vol 14 answers is the one that precedes all of that detail: which tool or approach is right for this threat model, this budget, and what I already own?

The series established three constraints that this volume inherits verbatim and applies to every table, chart, and recommendation that follows. They are restated here because they shape every comparative conclusion in this volume, including the cost-vs-coverage chart in §5 and the buy-vs-build decision tree in §2:

Constraint 1 — Non-emitting cameras defeat every RF method. SD-only and wired cameras transmit nothing. No RF sweeper, Wi-Fi scanner, traffic analyzer, or spectrum analyzer finds them. Only optical lens retroreflection (SpyFinder Pro, Glint Finder), thermal imaging (FLIR ONE), NLJD semiconductor-junction detection (REI ORION), or physical search addresses this class. No amount of money spent on RF gear — from a $25 K18 sweeper to a $13,000–$16,000 REI MESA 2.0 — closes the SD-wired gap on the RF side.

Constraint 2 — Wi-Fi detection is fingerprint plus behavior, not magic. Vendor OUI matching breaks under MAC randomization and generic ESP32/Realtek module chipsets. The traffic-rate / motion-correlation tell from Vol 3 §5 is the more robust signal, but requires active traffic. A “clean” Wi-Fi scan means no camera-brand device was visible at scan time — not that no Wi-Fi camera is present.

Constraint 3 — Analog and cellular cameras need different radios. A 2.4 GHz 802.11 scan is completely blind to FM-video carriers on 1.2 GHz, 2.4 GHz, and 5.8 GHz analog bands. A HackRF or RTL-SDR sweep is the required instrument for those bands. The two paths are complementary, not interchangeable.

Volume map — what this volume synthesizes:

Vol 9 — the commercial-detector survey (prices, what each tier catches, the what-it-actually-catches matrix from §8.2, the buy-decision guidance from §8.4). Every commercial product price in this volume is taken from Vol 9; if any figure here differs, Vol 9 is authoritative.
Vol 8 §5 — the fork-vs-scratch-vs-Pi decision guide (the three-path comparison matrix in §5.1; the recommended default path in §5.4). The §6 recap in this volume reproduces that matrix; if any entry differs, Vol 8 is authoritative.
Vol 11 §7 — the owned-gear × emission-class matrix (every tool Jeff owns or plans to own, rated against ten camera emission classes). The §4 sufficiency table in this volume derives from Vol 11 §7.2; if ratings differ, Vol 11 is authoritative.

All detection-coverage and price claims in this volume are spec-sourced pending bench verification unless explicitly noted otherwise, consistent with the project-wide provenance note established in Vol 1 §6.

[FIGURE SLOT — Vol 14, § 1] Side-by-side photograph of three representative sweep instruments: a K18-class RF sweeper (cheap tier, ~$25), a SpyFinder Pro SF-103P lens finder (consumer optical, ~~$148), and a FLIR ONE Gen 3 thermal attachment clipped to a smartphone (~~$199–$249). These three instruments represent the three physics principles — RF power detection, optical retroreflection, and thermal — that a layered sweep combines. Source: Photo Helper search “hidden camera detector RF sweeper SpyFinder lens finder FLIR ONE thermal comparison” — or Vol 9 vendor product pages (KJB Security, kjbsecurity.com; Teledyne FLIR, flir.com). Caption when filled: “Figure 14.1 — Three instruments, three physical principles. No single instrument covers all camera classes; the three together cover the most ground at consumer price points. All spec-sourced pending bench comparison. Photo: [credits]. [Licenses].“

14.2 Buy vs build

14.2.1 The core question

The buy-vs-build decision is not binary. It is a sequence of smaller decisions:

What gap needs closing? The answer depends on which camera classes your threat model includes and which the existing gear already covers.
Does a commercial product close that gap more efficiently than a build? Some gaps — the SD-only lens gap — are closed most cost-effectively by a $148 off-the-shelf optical instrument. Others — the Wi-Fi camera confidence-scoring gap — are closed most efficiently by a firmware fork on hardware already owned.
Is a build a meaningful improvement over buying? A Marauder fork running on an owned Ruckus Game Over provides more actionable Wi-Fi camera intel than a $30 K18 sweeper, at $0 marginal cost. But no build provides better non-emitting coverage than a SpyFinder Pro. The two sides of the buy-vs-build question serve different emission classes.

Core principle: buying always wins for the optical (lens retroreflection) gap; building wins for the Wi-Fi depth gap when the hardware is already owned.

14.2.2 When buying wins

Table 1 — 2.2 When buying wins

Scenario	Buy-wins reason	Best buy	Price (spec-sourced)
Non-emitting camera detection at sweep range	No build — firmware or hardware — finds a powered-off SD-only camera at 3–5 m sweep distance. The SpyFinder Pro SF-103P’s coaxial LED ring + viewport does, for any camera with a lens. This gap is physics, not engineering. See Vol 9 §5.2 for full specifications and the retroreflection physics in Vol 4 §5.	SpyFinder Pro SF-103P	~$148
Thermal triage for powered cameras	A FLIR ONE Gen 3 added to a phone sweeps a room for powered electronics in minutes. No embedded firmware build provides this capability. Vol 9 §6.1 covers specifications; Vol 4 §9 covers the HeatDeCam research (>95% classification accuracy).	FLIR ONE Gen 3	~$199–$249
First-pass Wi-Fi scan for travelers with no other gear	Fing (free) on the room’s Wi-Fi network discovers and OUI-identifies any naively installed camera on the property network in 2 minutes. It operates at the network layer (ARP + mDNS + SSDP), outperforms any K18-class RF sweeper for Wi-Fi cameras, and requires no additional hardware. Vol 9 §7.1 and Vol 11 §6.1 cover the Fing workflow.	Fing app	Free
Professional sweep with powered-off camera risk	The REI ORION NLJD is the only active-electronic method that works on a powered-off camera. Its harmonic-ratio discrimination (2nd/3rd harmonic) distinguishes a semiconductor junction from passive intermodulation. No consumer or DIY build approaches this. Vol 9 §4.1 covers the full ORION specification.	REI ORION 2.4 HX NLJD	~$10,000–$15,000
Calibrated spectrum analysis	The REI MESA 2.0 provides genuine spectral resolution, sensitivity calibration, and signal-type discrimination (SmartBars, Mobile Bands mode, LTE band identification) that no consumer or DIY build replicates. Vol 9 §4.2 covers the specification comparison against consumer RF sweepers.	REI MESA 2.0	~$13,000–$16,000

The K18 sweeper is not on the buy-wins list. A K18-class RF sweeper ($20–$30) is a broadband Schottky-diode power detector with no frequency selectivity. It is blind to SD-only cameras, wired cameras, 5.8 GHz analog cameras, cellular cameras, and Wi-Fi cameras not currently transmitting; its 2.4 GHz Wi-Fi camera detection range in a realistic ambient-RF environment is 1–3 m. A Marauder station scan with manual OUI lookup produces more actionable output than any K18-class unit — at $0 marginal cost on owned hardware. The JMDHKK K68+ ($60–$80, mid-tier) adds a Hall-effect magnetic sensor but shares the K18’s fundamental limitation of having no frequency selectivity and remaining blind to all non-emitting cameras. Do not buy a K18-class sweeper when you own Marauder modules. (Vol 9 §2–3 covers the complete K18 and mid-tier analysis.)

14.2.3 When building wins

Table 2 — 2.3 When building wins

Scenario	Build-wins reason	Best build	Marginal cost
Wi-Fi camera confidence scoring on owned hardware	Stock Marauder on the AWOK or Game Over performs station enumeration and OUI lookup but requires manual OUI-vs-table matching. The four-layer Marauder fork (Vol 8 §2) adds camera-vendor OUI filter, traffic-rate ring buffer, confidence scorer (CONF_NONE / CONF_OUI / CONF_MEDIUM / CONF_HIGH), and dedicated RSSI-walk display — at $0 marginal cost on owned hardware. This produces better Wi-Fi camera output than any commercial product at the same price point ($0).	Fork ESP32 Marauder on Ruckus Game Over	$0
Full IEEE OUI database coverage	The Pi sniffer path (Vol 8 §4) loads the complete IEEE OUI database (5+ MB, trivially fits in RAM) without flash constraints. This enables detection of white-label cameras on generic Espressif or Realtek OUI blocks that the Nyan Box (20+ brand DB) and Marauder fork (100–400 DRAM-constrained entries) both miss. No commercial product in the consumer or mid tier provides this.	Raspberry Pi sniffer with RTL8812AU	~$55–$120
Multi-person sweep coordination	The Pi sniffer’s Flask web UI (Vol 8 §4.6) provides a shared-screen live view of camera candidates accessible from any device on the local network. No commercial detector at any price point provides a team-sweep coordination mode.	Pi sniffer with Flask web UI	~$55–$120
mDNS/ONVIF discovery scanning	The Pi sniffer path can run `python-zeroconf` and `wsdiscovery` to actively discover cameras announcing `_rtsp._tcp` or `_onvif._tcp` services — the most definitive Wi-Fi camera confirmation short of watching demodulated video. Vol 8 §5.3 covers this capability. No consumer detector performs ONVIF discovery.	Pi sniffer with zeroconf + wsdiscovery	~$55–$120
RTSP port probing	Once a camera IP is discovered, a TCP probe to port 554 confirms it is streaming. The Pi sniffer supports this via Python’s socket library. No consumer detector does this.	Pi sniffer (Vol 8 §5.3)	~$55–$120

Build-wins boundary. Building always wins for Wi-Fi camera depth and analysis — the quality of Wi-Fi camera detection is strictly higher when you build on capable hardware than when you buy a consumer RF sweeper. Building never wins for optical lens finding (SD/wired gap), thermal triage, NLJD (powered-off), or professional TSCM spectrum analysis. The two halves are complementary: buy the optical instrument, build or leverage the Wi-Fi tool.

14.2.4 The master buy-vs-build decision tree

┌──────────────────────────────────────────────────────────────────────────────┐
│              BUY VS BUILD — MASTER DECISION TREE                             │
├──────────────────────────────────────────────────────────────────────────────┤
│                                                                              │
│  START: What gap are you trying to close?                                    │
│  │                                                                           │
│  ├─ SD-only / wired cameras (non-emitting, no RF)                            │
│  │    │                                                                      │
│  │    ├─ At sweep range (2–5 m)?                                             │
│  │    │    → BUY SpyFinder Pro SF-103P (~$148)                               │
│  │    │      Coaxial LED ring + viewport; finds any lens at 0.6–14 m        │
│  │    │      regardless of power state. No build closes this gap.            │
│  │    │                                                                      │
│  │    ├─ Thermal triage also wanted?                                         │
│  │    │    → BUY FLIR ONE Gen 3 (~$199–$249)                                │
│  │    │      Finds powered electronics by heat. Misses powered-off cameras. │
│  │    │                                                                      │
│  │    └─ Powered-off camera, professional sweep?                             │
│  │         → BUY REI ORION NLJD (~$10,000–$15,000)                          │
│  │           Semiconductor junctions respond to RF excitation even off.     │
│  │                                                                           │
│  ├─ Wi-Fi / IP cameras                                                       │
│  │    │                                                                      │
│  │    ├─ On-network (camera joined property Wi-Fi)?                          │
│  │    │    → FREE: Fing app on phone                                         │
│  │    │      Identifies any camera-brand device in 2 minutes.               │
│  │    │                                                                      │
│  │    ├─ Off-network / own AP? You own AWOK or Game Over?                   │
│  │    │    YES → BUILD: Fork ESP32 Marauder on Game Over (§6; $0)           │
│  │    │         Camera OUI filter + traffic-rate ring buffer + RSSI walk.   │
│  │    │                                                                      │
│  │    ├─ You don't own Marauder modules — do you own or want a Pi?          │
│  │    │    YES → BUILD: Pi sniffer (~$55–$120)                               │
│  │    │         Best Wi-Fi detection; web UI; full IEEE OUI DB.             │
│  │    │                                                                      │
│  │    └─ You own none of the above                                           │
│  │         → BUY Nyan Box (~$80–$120) — purpose-built; 20+ brand OUI DB    │
│  │           OR BUILD from scratch (Vol 7; $50–$200)                        │
│  │                                                                           │
│  ├─ Analog wireless cameras (1.2 / 2.4 / 5.8 GHz FM video)                 │
│  │    │                                                                      │
│  │    ├─ Own HackRF One + PortaPack?                                         │
│  │    │    → NO NEW PURCHASE NEEDED. Sweep with PortaPack Looking Glass     │
│  │    │      (standalone) or osmocom_fft + GNU Radio (host). Vol 11 §5.2.  │
│  │    │                                                                      │
│  │    └─ Don't own HackRF                                                    │
│  │         → BUY HackRF One or RTL-SDR (RTL-SDR covers 1.2 GHz without     │
│  │           upconverter; HackRF covers all three bands).                   │
│  │           No ESP32 build reaches these bands at all.                     │
│  │                                                                           │
│  └─ Cellular / 4G cameras                                                    │
│       → No reliable consumer or DIY option. LTE uplink bursts on licensed   │
│         bands at low duty cycle; even the REI MESA 2.0 marks this ⚠.       │
│         Best available: HackRF spectrum survey as a complementary pass to   │
│         note unexpected LTE activity. Do not rely on this for confirmation. │
└──────────────────────────────────────────────────────────────────────────────┘

14.2.5 Scenario walkthroughs

14.2.5.1 Airbnb traveler — phone only

Constraint: No accessories; departure in an hour.

Fing network scan (2 min): join the room Wi-Fi, run Fing. Any device with a camera-brand OUI (Hikvision, Wyze, Reolink, Eufy, Dahua, TP-Link Tapo, Ring, Blink, Nest) is a camera candidate. Note the MAC address, associated SSID, and any _rtsp._tcp service announced.
Glint Finder / phone flash (5 min): hold phone at eye level; walk 1 m from every surface. A bright blinking spot (on when flash fires, off when it cycles) is a lens retroreflection.
IR-LED spotting in darkness (3 min): open front-facing camera; turn off lights; scan for glowing white/purple clusters that indicate active night-vision IR LEDs.

Covers: on-network Wi-Fi cameras; large-aperture lenses at < 1–2 m; cameras with active IR illumination. Misses: off-network cameras; pinhole lenses at sweep distance; analog wireless; cellular; SD-only cameras not at close range.

14.2.5.2 Airbnb traveler — phone plus SpyFinder Pro

What the SpyFinder Pro adds at this tier: The coaxial LED ring (red, high-brightness array surrounding a central viewing port) finds camera lenses at up to 14 m stated range (vendor spec, Vol 9 §5.2). Critically, it finds the lens of a powered-off SD-only camera that a Fing scan, Marauder station scan, and HackRF sweep all miss — because lens retroreflection is passive; no power state is required. For a traveler carrying one accessory, the SpyFinder Pro is the highest single-item return on investment in the consumer market. Vol 9 §8.3 shows it as a standalone outlier in the price-vs-coverage chart. All specifications spec-sourced from KJB Security product pages, pending bench verification.

14.2.5.3 Homeowner with bench gear (Marauder modules + HackRF)

Owned gear already covers:

AWOK / Game Over (Marauder): on- and off-network Wi-Fi cameras at 2.4 GHz; manual OUI workflow; RSSI walk; BLE scan
HackRF + PortaPack: analog wireless cameras on 1.2 / 2.4 / 5.8 GHz; spectrum sweep + FM-video demodulation to confirm
Phone / Fing: on-network Wi-Fi cameras; fast first pass

What is missing: lens-retroreflection at sweep range (phone flash geometry only covers < 1–2 m). Best single add: SpyFinder Pro SF-103P (~~$148, spec-sourced) closes this gap. Second add: FLIR ONE Gen 3 (~~$199–$249, spec-sourced) adds thermal triage for powered electronics.

Build option at $0: Fork ESP32 Marauder on the Ruckus Game Over (Vol 8 §2 design). Upgrades from stock manual-OUI workflow to automatic camera-candidate scoring, traffic-rate motion-correlation, and a dedicated RSSI-walk display mode — a meaningful capability gain at zero cash outlay.

14.3 Which detector for which threat

14.3.1 Emission class and scenario framework

Hidden cameras divide into emission classes (from Vol 1’s taxonomy) that determine which detection methods physically apply. The matrix below organizes recommendations across three dimensions:

Emission class + power state: what the camera does or does not transmit
User scenario: Airbnb traveler (phone + 1 accessory, 10-minute sweep) / homeowner with bench gear (thorough multi-modality sweep) / professional TSCM investigator (documented, instrument-grade sweep)

Each cell names the best available tool for that combination. Owned-gear tools are identified (owned as of 2026-06-26 per Vol 11 §1). All prices spec-sourced from Vol 9.

14.3.2 The threat-to-tool matrix

Table 3 — 3.2 The threat-to-tool matrix

Camera class	Power state	Airbnb traveler	Homeowner (bench gear)	Pro TSCM
Wi-Fi/IP (on-net)	Active streaming	Fing (free) — discovers + OUI-ids camera on joined network in 2 min	Fing + AWOK/Game Over Marauder `scanap` + `scansta`	Fing + REI MESA 2.0 (calibrated; confirms emission type)
Wi-Fi/IP (on-net)	Standby (low traffic)	Fing (beacon still visible; camera still listed)	Fing + PCAP capture + tshark traffic analysis (Vol 3 §5 motion-correlation)	MESA 2.0 detects beacon with SNR calibration
Wi-Fi/IP (off-net / isolated AP)	Active	⚠ Glint Finder: close-range lens only; no consumer RF tool finds off-net AP	AWOK/Game Over `scanap` finds isolated AP; RSSI walk to it; Fing if joinable	MESA 2.0 locates RF carrier; Fing on isolated SSID if joinable
Wi-Fi/IP (off-net / isolated AP)	Standby	⚠ Glint Finder only at close range	Game Over `scanap`: off-net AP still emits beacons; RSSI walk	MESA 2.0
Analog 2.4 GHz FM video	Active (always-on carrier)	❌ No phone-tier tool reaches FM-video carriers; K18 ⚠ at 1–3 m only	HackRF + PortaPack: sweep 2.4 GHz; WFM-demod to confirm (Vol 11 §5.2–5.3)	MESA 2.0: full spectral carrier identification; direction-finding
Analog 5.8 GHz FM video	Active	❌ K18 above practical sensitivity ceiling at 5.8 GHz	HackRF + PortaPack: sweep 5.8 GHz; higher gain required	MESA 2.0 (6 GHz antenna set)
Analog 1.2 GHz FM video	Active	❌ No phone-tier tool	HackRF + PortaPack: sweep 1.2 GHz	MESA 2.0
Cellular/4G	Active (burst uplink)	❌ No consumer tool	❌ HackRF can observe LTE uplink burst but cannot confirm it is a camera vs a phone	⚠ MESA 2.0 Mobile Bands mode identifies LTE activity; cannot distinguish camera from phone traffic
BLE camera	Advertising	⚠ Phone BLE scan for named devices	AWOK `scanble` or Game Over `scanble`; match BLE device name to camera brand	Calibrated BLE protocol analyzer
SD-only (non-emitting)	Powered, recording	⚠ Glint Finder / phone flash: close-range lens only (< 1–2 m)	SpyFinder Pro SF-103P (~~$148) + FLIR ONE Gen 3 (~~$199–$249) for thermal	SpyFinder Pro + FLIR E85 (320×240 thermal) + borescope inspection
SD-only (non-emitting)	Fully off	⚠ Glint Finder at close range only	SpyFinder Pro SF-103P (~$148): lens is passive even powered-off	SpyFinder Pro + REI ORION NLJD (~$10,000–$15,000): semiconductor junctions respond to 2.4 GHz excitation even with power off
Wired (PoE/coax, no RF)	Powered	SpyFinder Pro (lens); cable-trace heuristic (Vol 6 §5)	SpyFinder Pro + FLIR ONE Gen 3 (heat from PoE injector / DVR electronics) + physical cable trace	SpyFinder Pro + FLIR E-series + Lockhart conducted-signal detector (~$1,500–$5,000, Vol 9 §4.4)
Wired (PoE/coax, no RF)	Off	SpyFinder Pro (lens only; cable not warm)	SpyFinder Pro + physical cable trace	SpyFinder Pro + REI ORION (junctions) + cable trace

Critical observations from the matrix:

The SpyFinder Pro is the only consumer-tier tool with meaningful non-zero coverage across all camera classes and all power states. Its lens-retroreflection physics is class-agnostic and power-state-agnostic. At ~$148 (spec-sourced), it represents the highest single-purchase coverage expansion at the consumer tier.
The HackRF One is the only owned tool with non-zero coverage of analog wireless cameras. No ESP32 firmware build, no K18 sweeper, no phone app, and no Nyan Box reaches FM-video carriers. The HackRF + PortaPack H2+ owned by Jeff provides this coverage at $0 marginal cost.
Cellular cameras have no reliable consumer or DIY detection path. LTE burst uplink on licensed bands is indistinguishable from phone traffic by any sub-$5,000 instrument. This class is the honest blind spot of the entire survey at personal-use budget levels.
Pro TSCM adds three capabilities no consumer or DIY option provides: (a) powered-off semiconductor junction detection (ORION NLJD), (b) calibrated spectrum analysis with signal-type discrimination (MESA 2.0), and (c) conducted-signal detection of PLC video on power lines (Lockhart). These are not cost-effective for personal use; they define the professional sweep ceiling.

14.3.3 Scenario walkthroughs

14.3.3.1 Scenario A: Airbnb bedroom — suspected Wi-Fi camera on property network

Most likely case. Naively installed cameras almost always join the property router for easy remote viewing. Fing covers this with zero accessories.

Action sequence:

Join the property Wi-Fi network. Open Fing → Scan Network → wait 30–60 seconds.
Flag any device with a camera-brand OUI (Hikvision, Wyze, Reolink, Eufy, Dahua, TP-Link Tapo, Ring, Blink, Nest, Axis, Amcrest). Confirm with Fing’s port scanner (port 554 RTSP, port 8899 ONVIF) and the Services view (_rtsp._tcp service announcement).
If a camera-brand device is found: use the AWOK Marauder manual RSSI walk (owned; Vol 11 §3.3) or Nyan Box RSSI-walk mode (once acquired; Vol 11 §2.3). Physically inspect the area at peak RSSI.

Gap after this procedure: SD-only cameras installed without any network connection; analog wireless cameras streaming to a nearby receiver. Add SpyFinder Pro sweep (§3.3, all scenarios) and HackRF spectrum scan (Vol 11 §5.2) to close those gaps.

14.3.3.2 Scenario B: Vacation rental — suspected analog wireless camera

Profile: Older or off-the-shelf hidden camera setup; camera streams FM video to a receiver; no Wi-Fi beacon; Fing shows nothing. A K18 sweeper may also miss it at 5.8 GHz.

Right tool: HackRF + PortaPack. Using Looking Glass mode (wideband passive spectrum sweep in Mayhem firmware), set center frequency to 2450 MHz, bandwidth to 20 MHz. A persistent narrowband carrier — 6–8 MHz wide, not shaped like a 22 MHz 802.11 OFDM channel — between 2.4 and 2.5 GHz is a camera-class indicator. Tune to the carrier, switch to receive mode, set WFM demodulator (gqrx or GNU Radio), listen for the composite-video 50/60 Hz sync tone. If confirmed, walk toward the signal by watching the signal strength indicator while moving. Vol 11 §5.2–5.3 covers the full HackRF sweep and demodulation procedure.

What this scenario confirms: HackRF ownership is the decisive factor for analog wireless cameras. Without it, no consumer-tier instrument at the Airbnb-traveler price point reliably reaches the 2.4 GHz and 5.8 GHz FM-video bands.

14.3.3.3 Scenario C: Corporate hotel sweep — professional TSCM posture

Profile: Executive-level sweep; adversary may have advance knowledge of sweep timing; powered-down device is a real possibility (the adversary’s counter-countermeasure).

Required toolkit beyond the consumer tier:

SpyFinder Pro (lens retroreflection — all classes, all power states)
FLIR ONE Pro (~$399, spec-sourced; higher sensitivity NETD < 70 mK vs Gen 3’s < 150 mK)
REI ORION 2.4 HX NLJD (~$10,000–$15,000) + REI ORION 900 HX (deeper wall penetration; same price tier) — the instrument that catches the adversary-who-powered-down-the-camera case
REI MESA 2.0 (~$13,000–$16,000) — calibrated spectrum with signal-type discrimination and LTE band recognition
Lockhart conducted-signal detector (~$1,500–$5,000) — PLC video on building power lines

The ORION addresses the specific professional scenario where an adversary with advance knowledge of the sweep timing has powered down cameras to defeat every other detection method. At ~$12,500 median, the ORION is beyond personal/traveler budgets but is the appropriate tool for a sweep where this threat model applies.

14.4 Owned gear vs dedicated device

14.4.1 What the owned lineup covers today

The assessment in this section is grounded in Vol 11 §7.2’s master gear × emission-class matrix as of 2026-06-26. All ratings are spec-sourced pending bench verification. If any rating here conflicts with Vol 11 §7.2, Vol 11 is authoritative.

Table 4 — 4.1 What the owned lineup covers today

Tool	Status	Camera-finding role	Key limitation
AWOK Dual Touch V3 (Marauder v1.12.x)	Owned — AWOKflip	Wi-Fi AP + station scan; manual OUI lookup; RSSI walk; BLE `scanble`	No native camera-confidence mode; manual OUI-vs-table required
Ruckus Game Over (Marauder v1.12.x)	Owned — game-over-host	Same as AWOK + CC1101/NRF24 daughter slot (hardware present; no sweep firmware yet)	CC1101 not yet enabled for camera sweep in stock Marauder v1.12.x
Flipper Zero (multiple units, Momentum/Xtreme)	Owned	BLE scan natively; sub-GHz with custom FAP; Wi-Fi only with devboard	No Wi-Fi capability without devboard; weakest scanner in lineup
Flipper Zero + Wi-Fi Devboard (Marauder on devboard)	Owned	Marauder capability on devboard; station scan + RSSI walk	Single radio; smaller display than AWOK; no dual-radio advantage
HackRF One + PortaPack H2+ (JSTVRO-built)	Owned	Analog wireless sweep (1.2 / 2.4 / 5.8 GHz); spectrum analysis; FM-video demodulation to confirm	Not a Wi-Fi scanner; analog cam only in standard use
Phone	Always available	Fing (on-net Wi-Fi scan); Glint Finder (lens < 2 m); IR-LED spotting; magnetometer (low confidence)	Close-range limitations; no RF analysis capability
Nyan Box	Aspirational (~$80–$120)	Native camera detection; 20+ brand OUI DB + heuristics; RSSI walk	2.4 GHz only; closed-source firmware; aspirational hardware

14.4.2 The owned-gear sufficiency table

This table answers: for each camera emission class, does the owned gear provide sufficient coverage, or does a dedicated tool add meaningful capability?

Ratings: ✅ Owned gear sufficient | ⚠ Owned gear marginal; dedicated tool meaningfully improves | ❌ No coverage in owned gear; dedicated tool required

All ratings spec-sourced, consistent with Vol 11 §7.2.

Table 5 — 4.2 The owned-gear sufficiency table

Camera class	Owned gear sufficiency	Dedicated tool that improves	Improvement
Wi-Fi/IP (same-net, active)	✅ Fing (free) covers this in 2 minutes	Nyan Box (~$80–$120): adds native camera-confidence scoring	Automatic scoring vs manual OUI lookup
Wi-Fi/IP (off-net, isolated AP)	✅ AWOK/Game Over: `scanap` detects isolated AP; RSSI walk to it	Nyan Box: mDNS/SSDP fingerprinting adds confirmation layer	Service-level confirmation (ONVIF/RTSP)
Analog 2.4 GHz FM video	✅ HackRF + PortaPack: full-band sweep + WFM demod confirmation	—	Nothing at consumer tier improves over owned HackRF
Analog 5.8 GHz FM video	✅ HackRF + PortaPack: covers 5.8 GHz (higher gain required)	—	RTL-SDR (aspirational) does not reach 5.8 GHz
Analog 1.2 GHz FM video	✅ HackRF + PortaPack	—	RTL-SDR (aspirational) also covers 1.2 GHz; redundant given HackRF
BLE camera	✅ AWOK/Game Over `scanble` + Flipper BLE; reliable BLE advertiser detection	—	No commercial tool meaningfully improves BLE camera detection. Note: BLE cameras are rare in practice
Cellular/4G	❌ No owned gear detects cellular cameras reliably	REI MESA 2.0 (~$13k–$16k)	Even MESA only identifies LTE activity; cannot confirm camera vs phone
SD-only (powered, recording)	⚠ Glint Finder / phone flash: lens at < 1–2 m only	SpyFinder Pro SF-103P (~$148)	Lens detection at 2–14 m; all camera classes; all power states
SD-only (fully off)	⚠ Glint Finder at close range only; no electronic detection	SpyFinder Pro SF-103P (~$148)	Lens passive even powered-off; works at sweep range
Wired camera (PoE/coax)	⚠ Glint Finder at close range only	SpyFinder Pro (lens) + FLIR ONE Gen 3 (~$199–$249)	Thermal finds PoE electronics heat; SpyFinder finds lens at sweep range
Non-emitting (thermal triage)	❌ No thermal instrument owned	FLIR ONE Gen 3 (~$199–$249)	80×60 px thermal; NETD < 150 mK; MSX visual overlay (spec-sourced, Vol 9 §6.1)
Powered-off camera (NLJD)	❌ No NLJD owned	REI ORION 2.4 HX (~$10,000–$15,000)	Harmonic-ratio NLJD; semiconductor junctions respond even powered-off

The SD-wired gap is the most significant unfilled column in the owned lineup. Every ⚠ or ❌ in the SD-only and wired rows shares the same root cause: the owned gear is entirely RF-based and optical-gap-limited, and SD-only/wired cameras produce no RF. This gap is not closed by adding more RF gear — it is closed only by adding an optical or thermal instrument. The SpyFinder Pro at ~$148 (spec-sourced) is the single highest-ROI add-on for the current bench, regardless of how many firmware builds are completed.

14.4.3 Where a dedicated tool adds value

Based on the sufficiency table, dedicated tools add value in three ranked tiers for this specific lineup:

Tier 1 — Critical (closes the primary gap):

The owned lineup has strong Wi-Fi (Marauder modules), strong analog-wireless (HackRF), and reasonable phone-based coverage — but zero lens-retroreflection capability at sweep range. The SpyFinder Pro SF-103P (~$148, spec-sourced from Vol 9 §5.2) closes this gap for every camera class in every power state. This is the single highest-ROI add-on for the current bench.

Tier 2 — Significant (closes a secondary gap):

The FLIR ONE Gen 3 (~$199–$249, spec-sourced from Vol 9 §6.1) adds thermal triage for powered electronics — identifying powered hidden cameras by their heat signature. Vol 9 §6.2 covers defeat mechanisms (insulation, low-power sensors, thermal equilibrium), establishing that thermal is a triage tool, not a definitive detector. Combined with the SpyFinder Pro, these two add-ons provide near-complete consumer-tier coverage for all powered camera classes and all non-emitting cameras via optics.

Tier 3 — Professional tier (documented for completeness; beyond personal budget):

The REI ORION NLJD (~~$10,000–$15,000) addresses the adversary-who-powered-down-the-camera scenario. The REI MESA 2.0 (~~$13,000–$16,000) provides calibrated spectrum analysis. These are not cost-effective for personal use but define the ceiling. Coverage gaps accepted at the personal tier: (a) powered-off cameras without NLJD, (b) LTE-band camera traffic distinguishable from phone traffic, (c) PLC video on power lines without a Lockhart detector.

14.4.4 Recommended add-ons for the owned kit

Priority-ranked add-ons for the bench as of 2026-06-26, with prices spec-sourced from Vol 9:

Table 6 — Priority-ranked add-ons for the bench as of 2026-06-26, with prices spec-sourced from Vol 9

Priority	Add-on	Cost (spec-sourced)	Gap closed
1 — Critical	SpyFinder Pro SF-103P	~$148	Lens retroreflection at sweep range (2–14 m) for all camera classes and all power states
2 — Significant	FLIR ONE Gen 3	~$199–$249	Thermal triage for powered electronics; NETD < 150 mK; 80×60 px (spec-sourced)
3 — Optional, $0	Fork ESP32 Marauder on Game Over (Vol 8 §2 design)	$0	Upgrades Wi-Fi camera detection from manual-OUI to automatic confidence scoring + RSSI-walk display
4 — Optional, low $	Nyan Box (~$80–$120, aspirational)	~$80–$120	Purpose-built Wi-Fi camera detection; 20+ brand OUI DB + heuristics + real-time RSSI walk; complementary to rather than replacement for Marauder fork

14.5 Cost-coverage trade-offs

14.5.1 Scoring coverage

Coverage is scored against ten camera emission scenarios derived from Vol 1’s taxonomy and Vol 4’s power-state capability matrix. This extends the 8-scenario framework from Vol 9 §8.3 by adding BLE camera detection and analog 1.2 GHz as separate rows, making the scoring more granular across the full emission class set.

The ten emission scenarios:

Table 7 — The ten emission scenarios:

#	Scenario
1	Wi-Fi/IP (same-net, active streaming)
2	Wi-Fi/IP (off-net / isolated AP, active)
3	Analog wireless 2.4 GHz FM video (active carrier)
4	Analog wireless 5.8 GHz FM video (active carrier)
5	Analog wireless 1.2 GHz FM video (active carrier)
6	BLE camera (advertising)
7	Cellular / 4G (bursty LTE uplink)
8	SD-only non-emitting (powered, recording)
9	SD-only non-emitting (fully powered off)
10	Wired / PoE camera (no RF; powered)

Scoring key: ✅ = 1 point; ⚠ = 0.5 point; ❌ = 0 points; 🔬 Research = 0 points (detectable in principle per published research; no practical sweep implementation). Maximum = 10. All ratings spec-sourced from Vol 9 (commercial tools), Vol 11 §7.2 (owned gear), and Vol 8 §5.2 (build paths). Lens retroreflection (SpyFinder Pro) physically detects any camera lens regardless of emission class or power state — but a blind full-room sweep without a prior RF/network locating pass is not reliable detection; ⚠ is used where no pre-location cue exists to tell the operator where to point the lens finder.

Table 8 — 5.1 Scoring coverage

Tool / approach	1	2	3	4	5	6	7	8	9	10	Score	Cost
K18 RF sweeper	⚠	⚠	✅	❌	⚠	❌	❌	❌	❌	❌	2.5	~$25
JMDHKK K68+	⚠	⚠	✅	❌	⚠	❌	❌	❌	❌	⚠	3.0	~$60–$80
Fing (phone, free)	✅	❌	❌	❌	❌	❌	❌	❌	❌	⚠	1.5	Free
Glint Finder (phone, free)	⚠	⚠	⚠	⚠	⚠	⚠	⚠	⚠	⚠	⚠	5.0	Free
SpyFinder Pro SF-103P	✅	✅	✅	✅	✅	⚠	⚠	✅	✅	✅	9.0	~$148
FLIR ONE Gen 3	✅	✅	✅	✅	✅	❌	⚠	✅	❌	✅	7.5	~$199–$249
REI MESA 2.0	✅	✅	✅	✅‡	✅	⚠	⚠	❌	❌	⚠	6.5	~$13,000–$16,000
REI ORION NLJD (2.4 HX)	❌	❌	❌	❌	❌	❌	❌	✅	✅	✅	3.0	~$10,000–$15,000
Marauder fork on Game Over (build, $0)	✅	✅	❌	❌	❌	✅	❌	❌	❌	❌	3.0	$0
Nyan Box (aspirational)	✅	✅	❌	❌	❌	⚠	❌	❌	❌	❌	2.5	~$80–$120
Pi sniffer (build)	✅	✅	❌	❌	❌	⚠	❌	❌	❌	❌	2.5	~$55–$120
HackRF + PortaPack (owned)	❌	❌	✅	✅	✅	❌	❌	🔬	❌	❌	3.0	Owned
Fing + SpyFinder + FLIR ONE (combined)	✅	✅	✅†	✅†	✅†	✅	⚠	✅	✅	✅	~9.5	~$347 combined
ORION + MESA + SpyFinder (combined)	✅	✅	✅	✅	✅	⚠	⚠	✅	✅	✅	9.0	~$28,000+ combined

† Fing + SpyFinder provides lens-retroreflection coverage for analog cameras (SpyFinder finds the lens regardless of transmission state); FLIR ONE provides thermal confirmation for powered analog cameras. Analog carrier RF detection (to locate the RF source before physical inspection) still requires HackRF or MESA.

‡ REI MESA 2.0 Analog 5.8 GHz coverage requires the 6 GHz antenna set (Deluxe kit or accessory), per Vol 9 §8.2.

Scoring note on Glint Finder (5.0/10) vs SpyFinder Pro (9.0/10). Both instruments operate on the same lens-retroreflection principle (Vol 4 §5), but Glint Finder’s phone-flash geometry is off-axis relative to the viewing sensor by 2–5 cm. This reduces retroreflective coupling at sweep distance (2–5 m) significantly compared to the SpyFinder Pro’s coaxial ring design. The ⚠ (0.5 point) vs ✅ (1 point) distinction between the two instruments reflects this practical range difference, not a difference in underlying physics. At < 0.5 m, both are comparably effective. SpyFinder’s ⚠ ratings in the BLE camera and Cellular/4G columns reflect the absence of a pre-location cue in those classes: lens retroreflection physically detects any lens, but reliably locating an unknown camera to sweep past at close range still requires a prior RF or network scan; sweeping a full room blind is possible but not reliable detection in this scoring framework.

14.5.2 The cost-vs-coverage chart

This chart shows coverage score (emission-class scenarios covered) vs cost (logarithmic scale). The key insight: the SpyFinder Pro at $148 is a sharp outlier — dramatically higher coverage per dollar than any other single instrument in the market.

  COVERAGE SCORE vs COST
  (score 0–10; ✅=1pt, ⚠=0.5pt per emission-class scenario)
  All claims spec-sourced.

  Score
  10.0 │
       │
   9.5 │       ╌╌╌╌ Fing + SpyFinder + FLIR ONE combined (~$347): ~9.5 ╌╌╌╌
       │
   9.0 │                          ★ SpyFinder Pro (~$148)
       │
   8.0 │
       │
   7.5 │                                      ◆ FLIR ONE Gen 3 (~$199–$249)
       │
   7.0 │
       │
   6.5 │                                                    ◆ MESA 2.0 (~$13k–$16k)
       │
   6.0 │
       │
   5.0 │  ● Glint Finder (free)
       │
   4.0 │
       │
   3.0 │  ● Marauder fork ($0)      ◆ ORION NLJD (~$12.5k)
       │  ● HackRF (owned; $0 new)
       │  ● K68+ (~$70)
   2.5 │  ● Nyan Box (~$100)  ● Pi sniffer (~$80)
       │  ● K18 (~$25)
   1.5 │  ● Fing (free)
       │
   0   └──────┬──────────┬────────────┬──────────┬──────────┬──────────→ Cost
              $0        $25–80       $148      $199–400   $10k–$16k

   ★ = best single-product value at consumer tier
   ◆ = commercial single-purpose instrument
   ● = build path, owned gear, or free tool

   ╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌
   THE RF SPENDING TRAP:
   K18 ($25, ~2.5) → K68+ ($70, ~3.0) → MESA 2.0 (~$13k–$16k, ~6.5)
   = up to $16,000 of RF spending — SD-only + wired cameras remain at ❌
     on every instrument in the RF column.
   A $148 SpyFinder Pro scores 9.0/10 — highest of any single tool on the
   lens-detection dimension — but locating an unknown camera to sweep past
   at close range still requires the prior RF/network scan; no single
   purchase closes every class.
   ╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌

14.5.3 The SD-wired gap and the RF spending trap

The cost-vs-coverage chart reveals one structural pattern that dominates all budget decisions:

No amount of RF spending closes the SD-wired gap. The transition from K18 (~~$25) to K68+ (~~$70) to REI MESA 2.0 (~$13,000–$16,000) improves RF sensitivity, frequency resolution, and signal-type discrimination — but every instrument in the RF column shares the same fundamental blindspot: a camera that does not transmit produces no signal for an RF instrument to receive. SD-only and wired cameras score ❌ on every RF tool regardless of price. The gap is not about sensitivity; it is about physics.

The methods that close the SD-wired gap are, in cost order:

Table 9 — The methods that close the SD-wired gap are, in cost order

Method	Instrument	Cost (spec-sourced)	Mechanism	Limitation
Optical lens retroreflection	SpyFinder Pro SF-103P	~$148	Converging lens optics retroreflect coaxial illumination toward source; every camera lens does this	False positives from curved glass surfaces (eyeglasses, bottles); requires physical investigation of each glint
Phone flash (approximate)	Glint Finder / phone front cam	Free	Same physics; off-axis geometry reduces effective range	Marginal at > 1–2 m; inferior to SpyFinder Pro at sweep distance
Thermal imaging	FLIR ONE Gen 3	~$199–$249	Infrared emission from powered electronics; NETD < 150 mK	Misses fully powered-off cameras; defeat mechanisms (insulation, low power, thermal equilibrium) described in Vol 9 §6.2
NLJD	REI ORION 2.4 HX	~$10,000–$15,000	2nd/3rd harmonic from semiconductor junctions; ratio discriminates vs passive intermodulation	Professional tier; harmonic-ratio discrimination requires calibration; tap test for false-positive rejection
Physical search	None — operator-executed	$0	Examines every plausible hiding location directly	Labor-intensive; misses cameras in concealed locations without physical disassembly

The practical implication for budget planning: At every budget level from $0 to $16,000+, a $148 SpyFinder Pro is the single highest-ROI purchase for closing the gap that RF spending cannot close. It should be purchased before any additional RF instrument (K18, K68+, or mid-tier) and before any ESP32 firmware build is undertaken. An operator with Fing (free) + SpyFinder Pro (~$148) has better coverage of the non-emitting camera class than an operator with a $13,000–$16,000 REI MESA 2.0 and no optical instrument.

14.5.4 Value sweet spots

Table 10 — 5.4 Value sweet spots

Budget level	Best approach	Combined score	Honest gap remaining
$0	Fing + Glint Finder + IR-LED spotting (all phone-based)	~5.5/10	Off-net cameras; analog wireless; SD-only at sweep distance; cellular; powered-off
~$148	+ SpyFinder Pro SF-103P	~9.0/10	Analog wireless (HackRF closes this if owned); cellular; powered-off NLJD
~$350	+ FLIR ONE Gen 3	~9.5/10	Cellular; powered-off NLJD; PLC conducted-signal
Owned bench + ~$150	Fing + SpyFinder + AWOK Marauder + HackRF	~9.5/10	Cellular; powered-off NLJD; PLC conducted-signal
$10k–$30k+	Pro TSCM kit (ORION + MESA + SpyFinder + Lockhart)	~9.5–10/10	Cellular still ⚠ (instrument cannot distinguish camera from phone); diminishing returns above ~$30k

The asymptote at 9.5/10 reflects two remaining gaps at every budget level: (1) cellular/4G cameras remain ⚠ even for the MESA 2.0 because the instrument cannot distinguish a camera’s LTE uplink from phone traffic without additional context; (2) the Lockhart conducted-signal detector ($1,500–$5,000, spec-sourced) is the only instrument that addresses PLC video on building power lines, and even it does not close all wired-camera scenarios. The “perfect 10” sweep does not exist in any commercially available configuration.

14.6 The three build path comparison

14.6.1 The three-path decision matrix

This matrix reproduces the load-bearing comparison from Vol 8 §5.1. Vol 8 §5.1 is the canonical source; this section is a recap for synthesis purposes. If any entry here differs from Vol 8 §5.1, Vol 8 is authoritative. All costs USD approximate, spec-sourced as of 2026-06-26.

Table 11 — 6.1 The three-path decision matrix

Criterion	Fork ESP32 Marauder (AWOK/Game Over)	Fork Nyan Box	Raspberry Pi sniffer	From-scratch ESP32-S3 (Vol 7 reference)
Build effort	LOW — add camera module to existing working firmware; no new hardware	MEDIUM — extend a camera-aware codebase; Nyan Box is aspirational hardware	MEDIUM — Pi + adapter setup, Python environment	HIGH — BOM sourcing, PCB or devkit wiring, full ESP-IDF firmware
Time to first prototype	Lowest — days if Marauder already runs on target module	Medium — days once hardware in hand	Low-Medium — Pi + adapter off-the-shelf; software is a Python script	Highest — PCB spin or devkit wiring + full firmware from bare ESP-IDF
Wi-Fi detection ceiling	MEDIUM — OUI filter, traffic-rate watch, RSSI walk; constrained by ESP32 SRAM	MEDIUM-HIGH — stock 20+-brand DB + heuristics; same SRAM ceiling	HIGH — full scapy flow statistics; full IEEE OUI DB in RAM; arbitrary Python algorithms; web UI	MEDIUM-HIGH — same ESP32-S3 hardware as best ESP32 option; purpose-built
Non-Wi-Fi camera ceiling	LOW — CC1101 daughter on Game Over covers sub-GHz only; 2.4/5.8 GHz analog needs HackRF add-on	LOW — same ESP32 ceiling	LOW (base) — Pi + RTL-SDR could add analog sweep as extension; not in cam_sniff.py base design	MEDIUM — optional CC1101/RTL-SDR add-on slot designed in (Vol 7 §7)
Portability	HIGH — handheld Flipper module; battery-powered; pocket-size	HIGH — handheld; battery-powered; pocket-size	LOW — Pi + adapter + battery bank; bag item	HIGH — purpose-built handheld designed for field carry
Marginal cost	$0 — already-owned AWOK/Game Over modules	~$80–$120 (aspirational; hardware must be acquired)	~$55–$120 (Pi Zero 2 W + RTL8812AU adapter, Vol 8 §4.2)	$50–$200 (BOM + PCB)
OUI database size	Small subset — DRAM/PSRAM constrained; 100–400 entries	20+ brands (vendor DB); extensible but flash-constrained	Full IEEE OUI DB (5+ MB; no RAM constraint)	Small-to-medium subset; PSRAM on ESP32-S3 helps (Vol 7 §5.4)
Traffic-rate / motion-correlation	Yes — added by fork (Vol 8 §2.5 design; 500 ms ring buffer)	Partial — stock may include rate heuristics; explicit VBR correlation is the fork extension (Vol 8 §3.4)	Yes — best implementation; full-precision floating-point statistics	Yes — native in from-scratch design (Vol 7 §4.4)
RSSI-walk localization	Yes — added by fork (Vol 8 §2.6; EMA filter + dedicated display state)	Yes — stock walk meter; fork improves display (Vol 8 §3.4)	Yes — RSSI column in terminal/web UI; dedicated bar mode is a Python addition	Yes — native; full-screen bar + EMA (Vol 7 §6)
Web UI / shared screen	No	No	Yes — Flask endpoint (Vol 8 §4.6); multi-user sweep over local network	No — single-user TFT only
Deauth-confirm capability (consenting environments only)	Yes — Marauder native; Camera Deauther hook trivial	Yes — Camera Deauther is native stock feature in Nyan Box	Yes — scapy injection requires adapter with injection support; consenting-environment only	Yes — designed in (Vol 7)
Upgrade path	Bounded by ESP32-S3 hardware ceiling	Bounded by ESP32-WROOM-32U hardware	Essentially unlimited — swap Pi model, add RTL-SDR, extend in Python	Bounded by ESP32-S3 hardware

14.6.2 Emission classes covered per path

All four paths share the same structural ceiling: every path is a Wi-Fi scanner. This is constraint #1 from Vol 1 §7.1 restated in the build context. No build path covers non-emitting cameras through its Wi-Fi scan layer; optical, thermal, and physical methods must be layered on top regardless of which path is chosen.

Table 12 — 6.2 Emission classes covered per path

Emission class	Fork Marauder	Fork Nyan Box	Pi sniffer	From-scratch ESP32-S3
Wi-Fi / IP cameras	✅ OUI filter + traffic-rate	✅ OUI + heuristics + traffic-rate (ext.)	✅ Best precision; full IEEE OUI DB	✅
Analog wireless 1.2 GHz	❌	❌	❌ (base design)	❌ (optional add-on; Vol 7 §7)
Analog wireless 2.4 / 5.8 GHz	❌ CC1101 ≠ FM-video demodulation	❌	❌ (base; RTL-SDR extension possible)	❌ (optional add-on)
Cellular / 4G	❌	❌	❌	❌
Bluetooth cameras	⚠ Marauder `scanble`	⚠ If BLE scan enabled	⚠ scapy can capture BLE advertisers	⚠ ESP32 BLE scan
SD-only / non-emitting	❌ RF-blind	❌ RF-blind	❌ RF-blind	❌ RF-blind; optional IR-LED ring add-on (Vol 7 §7.3)
Wired cameras (no RF)	❌ RF-blind	❌ RF-blind	❌ RF-blind	❌ RF-blind; optional IR-LED ring

No build path in this volume covers non-emitting cameras. For any sweep where SD-only or wired cameras must be ruled out, pair whichever build path you choose with an optical lens finder (SpyFinder Pro SF-103P ~$148 or Glint Finder free at close range), a thermal camera (FLIR ONE Gen 3 ~$199–$249 for powered cameras), and physical inspection of plausible hiding locations. The build provides the Wi-Fi detection layer; the optical and thermal instruments provide the coverage the build cannot reach. This is the correct layering at every budget level.

14.6.3 Recommended default path

Default recommendation (drawn verbatim from Vol 8 §5.4, the authoritative source):

Fork ESP32 Marauder on the owned Ruckus Game Over module.

The Ruckus Game Over is already owned, already running Marauder, and is the most capable ESP32 Marauder platform in the lineup — ESP32-S3 with 8 MB PSRAM, which removes the OUI-table size constraint that limits the AWOK Dual Touch V3. The camera fork adds three focused additions — camera-vendor OUI filter, traffic-rate ring buffer, RSSI-walk display mode — on a firmware that is already verified working on the hardware. This is the lowest-risk path to a first working prototype. Time to bench is lowest; marginal cost is zero.

When to deviate to Fork Nyan Box (from Vol 8 §5.4):

You have acquired the Nyan Box and it is on the bench
You want the smallest code delta: stock camera detection is already present; the fork adds traffic-rate precision and OUI DB updates (Vol 8 §3.4)
Note the source-availability caveat from Vol 8 §3: the Nyan Box firmware is likely closed-source; verify that firmware source is published before committing to this path

When to deviate to the Pi sniffer (from Vol 8 §5.4):

Large property; web UI and multi-person coordination matter
White-label ESP32-based cameras (OUI = Espressif) are suspected; full IEEE OUI DB needed
Post-capture statistical analysis (pandas, CSV) or ONVIF/mDNS discovery scanning matters
Fixed-site deployment on AC power (hotel room, office)

When to deviate to From-scratch Vol 7:

Building a standalone kit for someone without a Flipper/AWOK/Game Over rig
Purpose-built form factor matters; the optical lens-finder ring (IR-LED ring) add-on designed into Vol 7 §7.3 is a requirement from day one
No owned ESP32 module available

14.6.4 Quick decision flow

┌───────────────────────────────────────────────────────────────────────────┐
│  FORK vs SCRATCH vs PI — QUICK DECISION FLOW (reproduced from Vol 8 §5.4) │
├───────────────────────────────────────────────────────────────────────────┤
│                                                                           │
│  Own AWOK Dual Touch V3 or Ruckus Game Over?                              │
│  │                                                                        │
│  ├─YES──► ★ DEFAULT: Fork ESP32 Marauder on Game Over                    │
│  │           ├─ Camera-layer delta: LOW effort                           │
│  │           ├─ Marginal cost: $0                                         │
│  │           └─ Time to first prototype: days                             │
│  │                                                                        │
│  └─NO──► Do you own / will you acquire a Nyan Box?                        │
│            │                                                               │
│            ├─YES──► Fork Nyan Box                                         │
│            │           ├─ Smallest code delta                            │
│            │           └─ Camera detection pre-built in stock firmware    │
│            │                                                               │
│            └─NO──► Is portability a hard requirement?                     │
│                      │                                                     │
│                      ├─YES──► Build from scratch, Vol 7                   │
│                      │           └─ Best handheld form factor             │
│                      │                                                     │
│                      └─NO──► Raspberry Pi sniffer (Vol 8 §4)             │
│                                  ├─ Best Wi-Fi detection capability       │
│                                  ├─ Web UI for team sweeps                │
│                                  └─ ~$55–$120 hardware cost               │
└───────────────────────────────────────────────────────────────────────────┘

  ─────────────────────────────────────────────────────────────────────────
  REGARDLESS OF WHICH PATH YOU CHOOSE:
  Every build path above covers Wi-Fi cameras only.
  Add SpyFinder Pro (~$148, spec-sourced) to close the SD-only / wired /
  non-emitting gap that no build path in this volume addresses.
  Add FLIR ONE Gen 3 (~$199–$249, spec-sourced) to add thermal triage.
  The build provides the Wi-Fi layer; optics and thermal provide the rest.
  ─────────────────────────────────────────────────────────────────────────

14.7 Resources

14.7.1 Cross-series pointers

This volume is explicitly a synthesis; it consumes and recaps content from prior volumes rather than introducing new primary material. The following table maps each section in this volume to its primary sources.

Table 13 — Cross-series pointers

This volume’s section	Primary source volumes
§2 Buy vs build	Vol 9 §8.4 (buy-decision guidance); Vol 8 §5 (build decision); Vol 4 §5 (lens retroreflection physics)
§3 Which detector for which threat	Vol 9 §8.2 (what-it-actually-catches matrix); Vol 4 §4 (power-state capability matrix); Vol 11 §7.2 (owned-gear matrix)
§4 Owned gear vs dedicated device	Vol 11 §7 (capability and limit table; the authoritative source for §4 of this volume)
§5 Cost-coverage trade-offs	Vol 9 §8.3 (price vs capability chart; this volume extends it to 10 scenarios and adds build paths)
§6 Three build path comparison	Vol 8 §5.1–5.4 (the authoritative three-path matrix and decision guide)

Detection physics foundations (for entries in the matrices above):

Vol 2 — RF and spectrum physics: why broadband Schottky detectors behave as they do; the signal chain diagrams underlying the K18 and mid-tier analysis in §5
Vol 3 §5 — traffic-rate / motion-correlation: the VBR-encoder tell that is the most robust Wi-Fi detection signal; the algorithm the Marauder fork and Pi sniffer both implement
Vol 4 §4 — the power-state capability matrix: the original 9-method × camera-state framework that §3.2’s threat-to-tool matrix derives from
Vol 4 §5 — optical lens retroreflection physics: why every camera lens retroreflects, why coaxial geometry matters, why the SpyFinder Pro outperforms Glint Finder at range
Vol 4 §7 — NLJD physics: harmonic ratio, tap test, false-positive rejection; the underlying science for the ORION coverage in §3.2

Per-modality deep dives:

Vol 5 §4 — Wi-Fi camera OUI fingerprinting and SSID patterns; Vol 5 §5 — RSSI-walk localization (EMA filter, walk procedure)
Vol 6 §2–3 — Analog wireless camera bands (1.2 / 2.4 / 5.8 GHz) and FM-video demodulation
Vol 7 — from-scratch ESP32-S3 design (OUI DB build §5; traffic-rate accumulator §4.4; RSSI-walk display §6; lens-finder ring add-on §7.3)
Vol 8 §2–4 — the three fork paths in full depth; Vol 8 §5 — the authoritative three-path decision matrix

Survey volumes:

Vol 9 — complete commercial detector survey (K18 through REI ORION/MESA; SpyFinder Pro; FLIR ONE; phone apps); the what-it-catches matrix (§8.2) and buy-decision guidance (§8.4) are the primary sources for §2.2 and §3.2 in this volume
Vol 10 — open-source / DIY project survey; fork-worthiness matrix; Marauder camera-detection gap analysis (§2)
Vol 11 — owned-gear × emission-class matrix (§7.2; the authoritative source for §4 of this volume); gear selection flowchart (§7.3)
Vol 12 — the room-sweep methodology (the sequencing and stage-order playbook that this volume’s decision guides feed into; Airbnb field version in Vol 12 §4)

Operational posture:

_shared/legal_ethics.md — the hub-wide legal envelope; deauth-confirm and analog FM-video demodulation are active techniques gated to consenting-environment use; every scan in this series is passive unless explicitly noted otherwise

14.7.2 Commercial products referenced in this volume

All prices are spec-sourced from Vol 9, consistent with that volume’s Amazon / vendor page citations as of 2026-06-26. Bench verification of performance claims pending.

Table 14 — Commercial products referenced in this volume

Product	Vol 9 section	Price (spec-sourced)	Role in this volume
K18-class RF sweeper (generic, WishRing, HawkSpy, Sensico)	Vol 9 §2.5	~$20–$30	§2.2 callout (buy-wins-not listed); §5 baseline scoring
JMDHKK K68	Vol 9 §3.1	~$50–$65	Mid-tier baseline
JMDHKK K68+	Vol 9 §3.1	~$60–$80	§5 scoring; mid-tier representative
JMDHKK M8000 bundle	Vol 9 §3.1	~$80–$100	Mid-tier bundle
SpyFinder Pro SF-103P	Vol 9 §5.2	~$148	#1 priority add-on; §2.2, §4.4, §5, §6.4
FLIR ONE Gen 3	Vol 9 §6.1	~$199–$249	#2 priority add-on; thermal triage
FLIR ONE Pro	Vol 9 §6.1	~$399	Higher-sensitivity alternative (NETD < 70 mK)
FLIR Edge Pro	Vol 9 §6.1	~$499+	Wireless thermal attachment; same triage role
REI ORION 2.4 HX NLJD	Vol 9 §4.1	~$10,000–$15,000	Pro-tier; powered-off semiconductor junction detection
REI ORION 900 HX NLJD	Vol 9 §4.1	~$10,000–$15,000	Pro-tier; deeper wall penetration complement
REI MESA 2.0	Vol 9 §4.2	~$13,000–$16,000	Pro-tier; calibrated spectrum analysis
Lockhart conducted-signal detector	Vol 9 §4.4	~$1,500–$5,000	Pro-tier; PLC video on building power lines
Fing app	Vol 9 §7.1	Free / premium	Free first-pass Wi-Fi camera scan; §2.5, §3.3
Glint Finder app	Vol 9 §7.3	Free	Phone-based lens retroreflection; §2.5

14.7.3 Build paths referenced in this volume

Table 15 — Build paths referenced in this volume

Build path	Authoritative design vol.	Marginal cost	Status	Key reference
Fork ESP32 Marauder on Ruckus Game Over	Vol 8 §2	$0	Default recommendation	Vol 8 §5.4
Fork Nyan Box	Vol 8 §3	~$80–$120 (hardware)	Conditional on firmware source availability; see Vol 8 §3 caveat	Vol 8 §3, §5.4
Raspberry Pi sniffer (Pi Zero 2 W + RTL8812AU)	Vol 8 §4	~$55–$120	Build-ready design (not yet built)	Vol 8 §4.2, §5.4
From-scratch ESP32-S3	Vol 7	$50–$200	Build-ready design (not yet built)	Vol 7 in full

This is Volume 14 of a fifteen-volume series. Next: Vol 15 is the laminate-ready cheatsheet — a field-ready quick-reference card summarizing the sweep order, OUI quick-list, lens-glint technique, and decision-tree escalation guide for the room-sweep procedure.

CameraDetection Volume 14 — Comparisons & Decision Guide