Verifying an acquisition's integrity
You recompute the hash of a forensic image (DD/E01) and compare it with the hash recorded at acquisition time: Probatio confirms the copy has not been altered.
In the field
Use cases
Probatio comes from the forensic analyst's daily work. Here are typical situations where it saves time while keeping evidentiary rigor.
Photo authenticity (C2PA)
You analyse an image and Probatio extracts its C2PA Content Credentials, validates the signature and shows provenance, author and edit chain — useful against deepfakes and manipulation.
Suspicious-file triage (YARA)
On a doubtful file you apply up-to-date YARA rules, check entropy, strings and executable headers, and compare against known hash-sets for a first classification.
Evidence inventory of a device
You scan an entire volume: Probatio catalogs every file with type, size, hash and content date, and produces a chronologically ordered PDF report.
Comparing two versions of an image
With perceptual hashes you tell whether two images are the same scene recompressed or a manipulation, and document the differences in a side-by-side report.
Timestamping a report
You generate the analysis report and apply an RFC 3161 timestamp from an accredited TSA: an independent proof of date, verifiable with OpenSSL.
A disputed PEC in court
The other side claims it never received a notice. You verify the delivery receipt, even if saved by Outlook as MSG: provider signature anchored to AgID, validity at the PEC's date, daticert.xml read from the signed part and compared with the original message. The report lists every check.
Documenting a phishing email
A client received a fake payment request. You document the server route, the SPF, DKIM and DMARC results, the links whose text shows an address other than the target, and the attachments, without opening anything: only facts anyone can re-check.
Emails handed over as Outlook files
The correspondence arrives as MSG files. You open it without Outlook and in an isolated process, read headers and attachments with their hashes, and convert it to EML, keeping the signature if the message was signed.
An archive received as evidence
A ZIP with thousands of files lands on your desk. You document its contents with per-entry hashes and the recomputed CRC without extracting anything, understand why Windows calls it “invalid”, and extract only what you need.
Who signed this installer?
You need to establish where a Windows executable comes from while working on a Mac, or whether a DMG is notarised while working on Windows. Probatio reads the signature from the bytes: signer, chain, timestamp and file integrity.
Tidying up a working disk
Years of scattered copies on a shared disk. You find identical files by SHA-256 and move them to quarantine, with the hash re-checked before every move and a report of what was removed and where it went.
Is the signed contract the one agreed?
The agreed draft and the PDF later digitally signed should match. PDF comparison finds every changed word, number or date with its page and context, flags stamps and added pages, verifies the signatures and ends with a plain verdict, in a report with the hashes of both files.
A file of scans to search through
Hundreds of photographed or scanned pages, skewed and without text. OCR to PDF straightens them, turns them and makes them searchable on the computer, without sending them to an online service; with “Text only” the source PDF stays intact, and the log declares what was done to every page.
Authenticity
Prove an image's origin
With C2PA Content Credentials, Probatio reads and validates a photo's provenance signature: who created it, with what, and how it was edited — a concrete help against deepfakes and manipulation.