Hash

A fixed-length fingerprint computed from a file's content. If even one byte changes, the hash changes: the standard way to prove a file has not been altered.

SHA-256 / SHA-512

Cryptographic hash functions from the SHA-2 family, among the most used in forensics for acquisition integrity.

BLAKE3 / XXH3 / CRC32

Fast modern algorithms: BLAKE3 is cryptographic and parallel; XXH3 and CRC32 are non-cryptographic checksums, useful for quick checks.

Entropia

A measure of byte "disorder" (0-8). High values indicate compressed or encrypted data; useful to spot hidden content or anomalies.

ssdeep (fuzzy hash)

A "fuzzy" hash that stays similar when a file changes slightly: it lets you find near-identical files or variants.

C2PA / Content Credentials

A standard that embeds provenance and edit history into media, cryptographically signed. Probatio reads and validates its manifest.

JUMBF

A binary container used by C2PA to embed the manifest inside a file (e.g. a JPEG).

YARA

A rule language to recognise patterns in files and malware. Probatio applies YARA rules updatable from an endpoint.

Magic bytes

The first bytes of a file that reveal its real type regardless of extension: Probatio uses them to unmask deceptive extensions.

Hash percettivo

A hash that represents an image's appearance: two similar images have close perceptual hashes, even if the bytes differ.

Marca temporale RFC 3161

A cryptographic attestation, issued by an authority (TSA), that a piece of data existed at a certain date. Probatio applies it to the report.

PEC (Posta Elettronica Certificata)

Italian certified email, legally equivalent to registered mail with return receipt: the provider signs the envelope and the receipts. It is verified by checking that signature and the certification data.

daticert.xml

The certification data file inside a PEC: type, sender, recipients, subject, date and identifier. It is covered by the provider's signature, unlike the envelope headers.

SPF

DNS record through which a domain declares which servers may send mail on its behalf (RFC 7208).

DKIM

Cryptographic signature applied by the sending server over the message's headers and body; the public key is in the signing domain's DNS (RFC 6376).

DMARC

DNS policy requiring the visible sender's domain to be aligned with those authenticated by SPF or DKIM, and saying what to do if it isn't (RFC 7489).

Authenticode

Microsoft's format for signing Windows executables and installers: a hash of defined parts of the file, signed and often timestamped.

Notarizzazione (macOS)

Apple's automated check of a signed app or disk image; the resulting ticket can be “stapled” to the file and read even offline.

SHA256SUMS

A text file listing the expected hashes of several files: Probatio verifies it in batch, like sha256sum -c.

OCR

Optical character recognition: turns the image of a page into text. In a searchable PDF the recognised text sits, invisible, over the page image, and can be searched and copied.

Indice Gulpease

A readability index designed for Italian (0-100, higher = easier), computed from letters, words and sentences. For English the Flesch Reading Ease is normally used.

EMF / WMF

Windows metafiles: images described as a sequence of drawing commands (records) rather than pixels. Outlook often attaches them compressed (.emz, .wmz); some records have been used in attacks, which is why Probatio reads them without letting them be drawn.

OLE (oggetto incorporato)

The format Office uses to embed a document inside another (a drawing in an email, a spreadsheet in a text). It can hold several levels, and the declared class can be faked: Probatio recognises the application from the stream names.

Glossary