What gets in the way
Three problems, and the tool for each
Proving the evidence has not changed
Every report rests on the extraction being the one that was acquired. Re-checking hashes by hand is slow, and a typo in one value is easy to miss.
The answerDEVI ValidateRe-hashes files and folders offline, compares them with the acquisition tool's own list and writes a PDF verification record.Apple and iCloud returns arrive encrypted
Provider returns come as OpenPGP files with a separate key or password, and the decrypted copy has to be accounted for.
The answerDEVI DecryptDecrypts on the examiner's computer, never changes the original, and hashes and records the output.Knowing where an app keeps its data
Apps change often, and notes on where their data lives are spread across forums, blogs and old reports.
The answerDEVI RegistryA sourced reference of app paths, parsers and legal-process contacts, with a public source for every claim.
Plain about the limits
What DEVI does not claim
Every tool states what it does and what it does not do, so the record holds up when someone asks.
- No court, standards-body or laboratory certification is claimed. Validate each tool under your lab's own procedures.
- A verification record is a hash report. It is not an audit log of the lab's work or a compliance certificate.
Solutions
Also built for
Prosecutors' offices
Records that say what was checked, how it was checked, and what the result does and does not mean.
See how it helpsFederal
Signed Windows tools that do their work without a network connection, with a published SHA-256 for every download.
See how it helpsPrivate practice
The same offline tools and the same limits, for consultants, corporate investigators and defense experts.
See how it helps
Get access
Put DEVI on your own computers
We review every request, usually within the same business day. Verified law enforcement, prosecution, defense and contractor examiners.