Evidence integrity and the evidence package

Why it matters

If your evidence is challenged, you need to show it hasn’t changed since you added it, and that it was you who added it. PIToolkit records that proof automatically as you upload, on every plan including Free.

What’s recorded for every exhibit

A SHA-256 fingerprint of the file, computed in your browser when you add it. It’s stored encrypted under the case key.
A tamper-evident chain. Each exhibit’s record is linked to the one before it in the case, using a key specific to that case. Altering, reordering or deleting an exhibit’s record breaks the chain in a way the check detects.
Your digital signature (Ed25519). Made with your key when you upload, it covers the exhibit’s place in the chain, its contents and its capture details. It shows which investigator’s account added it.
Capture details: capture time, location (from photo data, if present) and a device identifier, sealed with the case key and covered by your signature. See Uploading evidence for where each comes from.
A signed chain head. Every time you add or remove an exhibit, you also sign a summary of the whole chain, including how many exhibits were removed.

Removing an exhibit doesn’t break the chain

When you remove an exhibit, you sign a removal statement that’s recorded in the chain. The remaining exhibits still verify. The package lists removed exhibits and doesn’t re-check their contents, and it flags any removal that has no signed statement.

Timestamps: what they are and aren’t

Capture time is covered by your signature.
The time PIToolkit received the file comes from PIToolkit’s own clock and is not signed.
Independent trusted timestamps (RFC 3161) from an outside timestamp authority aren’t available yet. They’re coming in a future release. The package says plainly that no exhibit has one.

Building the evidence package

On a case, open the More case actions menu and choose Generate evidence package. PIToolkit checks every exhibit against the record kept when it was added, then produces a download. Choose Download package when it’s ready.

You need an unlocked workspace and at least one exhibit on the case. The package is available on every plan.

The package is a ZIP file containing:

verification-report.html: the human-readable report. Open it in any browser and print it to PDF if you need a paper copy. It includes the results for each exhibit, the method used, and an investigator attestation with your name, email, firm and public signing key.
evidence-metadata.csv: the recorded details for every exhibit, including fingerprints, capture time, location and device identifier.
timestamps.csv: the capture and receipt times for each exhibit.
manifest.json and manifest.sig: a list of everything in the package, signed with your key.
README.txt: what each file is.

The evidence files themselves aren’t in the package. They stay in the case. Download the exhibits you need separately and hand them over alongside the package.

Reading the result

The report opens with a summary such as “This case verified.” or “This case did not fully verify.”, and counts, for example “12 of 12 exhibits verified”. Each exhibit is marked with results such as “Content verified” and “Signature verified”, or a clear failure like “CONTENT DOES NOT MATCH THE RECORD”.

What the package can’t prove

The report states its own limits, and you should read them before relying on it:

Anyone can recompute a file’s SHA-256 and compare it with the report. Re-running the signature and chain checks needs the case keys, so those can’t be repeated from the package alone.
The chain head is held by PIToolkit and isn’t independently timestamped. If an earlier chain head you really signed were put back in place of a later one, exhibits added (or removals signed) after it wouldn’t show as missing.
Receipt times are PIToolkit’s own clock, not signed and not independently timestamped.

We’d rather you know these limits now than have an opposing expert point them out.