Trust Center

Evidence stays on your computer

How DEVI Validate handles evidence

DEVI Validate is an offline, read-only evidence hash checker. It recomputes hashes and compares them with values from another tool or process.

• SHA-256, SHA-1, and MD5
• Sum files, CSV, and FTK Imager logs
• Match, Mismatch, Missing, and Extra results
• A PDF verification record named by hash
• A built-in self-test

Each lab should validate it under its own procedures. No certification is claimed.

Windows (x64). The .NET runtime is included in the download.

How DEVI Decrypt handles evidence

DEVI Decrypt is an offline Windows utility for decrypting Apple and iCloud OpenPGP provider returns. It reads the encrypted file without changing it, never uses the network to decrypt (the only request is an optional, signed update check), and does not save the key or the passphrase. Its PDF verification record never holds the key, the passphrase, or the decrypted contents.

Each lab should validate it under its own procedures. No certification is claimed.

How DEVI Registry is sourced

DEVI Registry is a sourced JSON and YAML database of application and artifact metadata, with an offline Windows app to look an app up. Every record cites public sources and carries a status that says how far each claim was checked. It is a reference, not a finding about a case. Lookups never use the network (the only request is an optional, signed update check), and the app checks the bundled data's content hash before it shows a record. Each lab should validate it under its own procedures.

CJIS status, in plain words

How a download is checked

DEVI Validate 1.0.3 is published as an installer and as a portable zip. Each file has its own SHA-256.

Download the installer and the portable zip from the DEVI Validate page after you sign in. This page publishes the check values, not the files.

Setup (win-x64)

The published SHA-256 for DEVI-Validate-Setup-1.0.3-win-x64.exe is f9359d1e126ad72bbc8cda8e8cfc9407d15258c0d905e922cacf780e5c865ecc. A checksum file is published beside the file.

On Windows, either command prints a hash of the file you downloaded. Compare it with the value above.

Get-FileHash .\DEVI-Validate-Setup-1.0.3-win-x64.exe -Algorithm SHA256

certutil -hashfile DEVI-Validate-Setup-1.0.3-win-x64.exe SHA256

Windows Setup installer (win-x64). The installer and the app are Authenticode-signed. Check the SHA-256 below before you run it. Windows can still show a SmartScreen warning for a newly signed release; that is reputation, not a failed signature. If it does, choose More info, then Run anyway.

Portable (win-x64)

The published SHA-256 for DEVI-Validate-1.0.3-win-x64.zip is 42a990c2071ea71851213f6906e963cdb506b2bd065a92c50ce1bed9b2127ba8. A checksum file is published beside the file.

On Windows, either command prints a hash of the file you downloaded. Compare it with the value above.

Get-FileHash .\DEVI-Validate-1.0.3-win-x64.zip -Algorithm SHA256

certutil -hashfile DEVI-Validate-1.0.3-win-x64.zip SHA256

Portable zip (win-x64). No install needed. Unzip the whole folder and open app\DEVI-Validate.exe. The app is Authenticode-signed. Check the SHA-256 below before you run it. Windows can still show a SmartScreen warning for a newly signed release; that is reputation, not a failed signature. If it does, choose More info, then Run anyway.

How a DEVI Decrypt download is checked

DEVI Decrypt 1.0.3 is published as an installer and as a portable zip. Each file has its own SHA-256.

Download the installer and the portable zip from the DEVI Decrypt page after you sign in.

Setup (win-x64)

The published SHA-256 for DEVI-Decrypt-Setup-1.0.3-win-x64.exe is 9c83c5cedfb161bcef37240387fa847648434aa9d96d8628429af8539a71f779. A checksum file is published beside the file.

On Windows, either command prints a hash of the file you downloaded. Compare it with the value above.

Get-FileHash .\DEVI-Decrypt-Setup-1.0.3-win-x64.exe -Algorithm SHA256

certutil -hashfile DEVI-Decrypt-Setup-1.0.3-win-x64.exe SHA256

Windows Setup installer (win-x64), per user, no administrator rights needed. The installer and the app are Authenticode-signed. Check the SHA-256 below before you run it. Windows can still show a SmartScreen warning for a newly signed release; that is reputation, not a failed signature. If it does, choose More info, then Run anyway.

Portable (win-x64)

The published SHA-256 for DEVI-Decrypt-1.0.3-win-x64.zip is bd4c1d2ef8c75a397d846cd7e554d39620548e5abfea7052dfd4907deabcd39d. A checksum file is published beside the file.

On Windows, either command prints a hash of the file you downloaded. Compare it with the value above.

Get-FileHash .\DEVI-Decrypt-1.0.3-win-x64.zip -Algorithm SHA256

certutil -hashfile DEVI-Decrypt-1.0.3-win-x64.zip SHA256

Portable zip (win-x64). No install needed. Unzip the whole folder and open app\DEVI-Decrypt.exe. The app is Authenticode-signed. Check the SHA-256 below before you run it. Windows can still show a SmartScreen warning for a newly signed release; that is reputation, not a failed signature. If it does, choose More info, then Run anyway.

How a DEVI Registry download is checked

DEVI Registry 1.0.4 is published as a Windows app, as an installer and as a portable zip. The data is 1.0.0, one zip of JSON and YAML files. Each file has its own SHA-256.

Download the installer, the portable zip, and the data zip from the DEVI Registry page after you sign in. The data zip holds data files, not a program, so it is not Authenticode-signed. Inside it, SHA256SUMS.txt lists every file's SHA-256, and verify_registry.py checks the records against the content hash in registry.json.

Setup (win-x64)

The published SHA-256 for DEVI-Registry-Setup-1.0.4-win-x64.exe is 8080264fc52d5bbc0bf1e43db35b659c69310bb5bbe911e92c95f11e68cbd9b2. A checksum file is published beside the file.

On Windows, either command prints a hash of the file you downloaded. Compare it with the value above.

Get-FileHash .\DEVI-Registry-Setup-1.0.4-win-x64.exe -Algorithm SHA256

certutil -hashfile DEVI-Registry-Setup-1.0.4-win-x64.exe SHA256

Windows Setup installer (win-x64), per user, no administrator rights needed. It bundles the 1.0.0 data. The installer and the app are Authenticode-signed. Check the SHA-256 below before you run it. Windows can still show a SmartScreen warning for a newly signed release; that is reputation, not a failed signature. If it does, choose More info, then Run anyway.

Portable (win-x64)

The published SHA-256 for DEVI-Registry-1.0.4-win-x64.zip is c0ea79e9fd6a608f63367de72ffcc22923f110f632bca5db0333bc0a62e990f6. A checksum file is published beside the file.

On Windows, either command prints a hash of the file you downloaded. Compare it with the value above.

Get-FileHash .\DEVI-Registry-1.0.4-win-x64.zip -Algorithm SHA256

certutil -hashfile DEVI-Registry-1.0.4-win-x64.zip SHA256

Portable zip (win-x64). No install needed. Unzip the whole folder and open app\DEVI-Registry.exe. The app is Authenticode-signed. Check the SHA-256 below before you run it. Windows can still show a SmartScreen warning for a newly signed release; that is reputation, not a failed signature. If it does, choose More info, then Run anyway.

Data (JSON/YAML)

The published SHA-256 for DEVI-Registry-1.0.0.zip is 05bfa3dc4bc761c3fe974055c6ef7acd102e16b01836ed8efa36db823e79e0d3. A checksum file is published beside the file.

On Windows, either command prints a hash of the file you downloaded. Compare it with the value above.

Get-FileHash .\DEVI-Registry-1.0.0.zip -Algorithm SHA256

certutil -hashfile DEVI-Registry-1.0.0.zip SHA256

Data zip (JSON and YAML), not a Windows program. Includes a README, the schema, SHA256SUMS.txt, and verify_registry.py. Unzip the whole folder. Check the SHA-256 below before you use it.

How to verify downloads

Download DEVI tools only from https://deviops.app.

The official addresses are https://deviops.app for the site and downloads, and two service hosts that are not pages: login.deviops.app for sign-in and api.deviops.app for the site's services.

Compare the file you downloaded with the SHA-256 published on this site.

DEVI Validate 1.0.3 is Authenticode-signed through Microsoft Artifact Signing: the installer, its uninstaller, the app, and the command-line tool. Each signature carries a timestamp. To check a file on Windows, open its Properties and choose Digital Signatures, or run Get-AuthenticodeSignature .\DEVI-Validate-Setup-1.0.3-win-x64.exe in PowerShell. The status should be Valid, with a certificate issued by Microsoft. A valid signature does not replace the SHA-256 check above. Windows can still show a SmartScreen warning for a newly signed release; that is reputation, not a failed signature.

DEVI Decrypt 1.0.3 is signed the same way: the installer, its uninstaller, and the app. To check it in PowerShell, run Get-AuthenticodeSignature .\DEVI-Decrypt-Setup-1.0.3-win-x64.exe.

The DEVI Registry 1.0.4 app is signed the same way: the installer, its uninstaller, and the app. To check it in PowerShell, run Get-AuthenticodeSignature .\DEVI-Registry-Setup-1.0.4-win-x64.exe.

Security describes access, where information lives, and how to report a vulnerability.

Validation

DEVI tools are licensed for use by approved DEVI accounts, and their source code is not published. What DEVI publishes is what an examiner needs to check a tool: the SHA-256 of every release file, Authenticode signatures on the Windows apps and their installers, and a product page that states what each tool reads, what it writes, what its record contains, and what it does not do. A valid signature shows the file came from DEVI unchanged; the SHA-256 shows it is the exact file published here.

DEVI Validate and DEVI Decrypt each include a built-in self-test that runs from inside the app. DEVI Registry ships verify_registry.py, which recomputes the content hash and checks every reference. Each lab should still validate a tool under its own procedures before relying on it.

What DEVI does not claim

• A verification record is a hash report. It is not a statement that a court or a standards body has accepted the result.
• A verification record is not an audit log of an agency's work, and nothing here is a compliance certificate.
• DEVI does not claim a court, standards-body, or laboratory certification. Each lab decides whether the tools meet its own requirements.
• Nothing on this site is legal advice, and nothing here says a result will be admitted.
• DEVI is independent. It is not affiliated with, sponsored, or endorsed by any employer, agency, or vendor.

Reporting a vulnerability

Email security@deviops.app. Please report a vulnerability before disclosing it publicly. The security page states how a report is handled.

A machine-readable contact file is published at /.well-known/security.txt.

Who owns DEVI

DEVI is owned and operated by DEVI Ops LLC, a U.S. company. Our software is developed in the United States, and our services run on U.S.-based infrastructure: Amazon Web Services in its US East region.

The public website is delivered through Cloudflare's global network. Like most software, DEVI's tools use some third-party components, whose authors are worldwide.

Contact

Questions about trust, access or a tool go to contact@deviops.app. The contact page lists every address.