What DEVI is
DEVI makes software for digital forensic examiners and publishes independent research on the tools and methods they depend on.
The tools cover the everyday, high-stakes parts of an examination: verifying hashes, confirming that evidence has not changed, decrypting provider returns, and producing a record that can go into a case file. Three are available now: DEVI Validate, an offline evidence hash checker for Windows; DEVI Decrypt, an offline Windows utility for Apple and iCloud OpenPGP provider returns; and DEVI Registry, a sourced JSON and YAML reference of application and artifact metadata. Each is listed on the Tools page with its current version.
DEVI stems from experienced digital forensic examiners working real casework: investigations where the evidence lives on phones, computers, and cloud accounts, and where every result has to stand up in court.
What the work demands
Digital evidence ends up in court, and every step taken with it has to hold up there. An examiner has to show where the evidence came from, who handled it, and that nothing about it changed along the way. That is chain of custody, and the hash values recorded when evidence is acquired are how a file is shown to be the same file months or years later.
The work also has to be documented and repeatable. Another examiner, starting from the same evidence and the same method, should reach the same result. A finding that cannot be explained or reproduced does not carry much weight, however confident the person presenting it.
Every tool in the process carries part of that load. If an examiner cannot say what a tool did to the evidence, they cannot fully stand behind the result it produced.
Why DEVI exists
For many examiners, the hardest part of digital forensics is not the work. It is finding tools that can be trusted.
Plenty of utilities exist. Many are abandoned, with no updates in years and no one to ask when a result looks wrong. Some are closed off, with no way to see how they reach an answer. Others give no clear account of what they actually do to the evidence: whether they open it read-only, what they write, and what they leave out of a report.
The good tools are out there, but they are hard to find. They are scattered across old forum threads, personal pages, and word of mouth, and a new examiner has little way to tell a well-tested tool from one that simply happens to run. When a hash or a report ends up in a case file, "it seemed to work" isn't good enough.
What examiners need is not a longer list of utilities. It is a short, dependable set of tools for the everyday parts of the job, such as verifying a hash or confirming that an image has not changed, each with a plain record of what it did. Tools that can be handed to a new examiner without a page of caveats. That is what DEVI builds.
Principles
Every DEVI tool is built around the same five principles.
- Offline. The tools run on the examiner's own computer and never send evidence anywhere. DEVI Validate opens evidence read-only, and its only network request is an optional update check that is off by default.
- Focused. Each tool does one job, and does it the same way every time.
- Documented. Each tool records exactly what it did, in a form that can go into a case file. DEVI Validate produces a PDF verification record named by hash.
- Verifiable. Every release is published with its SHA-256 hashes, and the Windows apps are Authenticode-signed, so a download can be checked before it is trusted. The Trust and Security page lists the hashes and shows how to check them.
- Validatable. Each tool page states what the tool reads, what it writes, and what it does not do. DEVI Validate and DEVI Decrypt include a built-in self-test, and DEVI Registry ships a script that checks its records, so a lab can validate a release under its own procedures.
Goals
The aim is simple: that examiners find DEVI early, and spend their time on the case instead of wondering whether their tools can be trusted. Beyond that, DEVI is working toward four things.
- A trusted starting kit. A small set of tools a new examiner can rely on from the first case, each clear about what it does and what it does not do.
- Community-tested validation. A shared record of how each release performs, built from examiners' own testing on their own systems, so that validation work is shared instead of repeated alone in every lab.
- Practical resources. Plain guides for the parts of the job that are easy to get wrong, starting with how to verify a download and document the result.
- Developer articles. Writing on what examiners run into in real casework, and what it takes to build tools that hold up.
Built by working digital forensic examiners
DEVI comes from casework, where every result has to be explained, repeated and defended in court. It is made by the DEVI Ops Team, part of an independent U.S. company.
Research and writing
DEVI's insights come from the same practice: what examiners see in casework.
Two sections hold the writing.
- Forensics is a searchable notebook of mobile and computer forensic findings. The insights already published there keep their URLs.
- Developers is insights into software engineering: the habits that make software correct, repeatable, and explainable.
Read side by side, the two answer different questions. Forensics is what an examiner needs from the record. Developers is how the software is written, and what it is for.
Who owns DEVI
DEVI is owned and operated by DEVI Ops LLC, a U.S. company. Our software is developed in the United States, and our services run on U.S.-based infrastructure: Amazon Web Services in its US East region.
The public website is delivered through Cloudflare's global network. Like most software, DEVI's tools use some third-party components, whose authors are worldwide.
Independence
DEVI is independent. It is not affiliated with, sponsored, or endorsed by any employer, agency, or vendor, and nothing published here is a statement of any agency's policy. Nothing on this site is case material.