Built for evidence review,
not guesswork.

[01] how-it-works · sha:6d8d6bf4f58d

How It Works

Four steps from evidence to reviewable case package

[03] proof · sha:2bfb8aa9224a

Proof

Don’t take our word for it. Run the verifier.

Every exported case package carries a SHA-256 manifest of its own contents and a standalone verifier. Anyone who receives the package — opposing counsel, a client, a court’s technical staff — can re-run that check without installing Archivist and without taking your word for anything.

evidence_package_sample-matter_20260725/
├── README.md
├── INTEGRITY_MANIFEST.json      SHA-256 of every file
├── CHAIN_OF_CUSTODY.json        who did what, when
├── PROCESSING_PROVENANCE.json
├── evidence/
│   ├── sources/
│   ├── findings/
│   └── annotations/
├── report/case_report.pdf
├── verification/verify.py       standalone, no install
└── viewer/index.html            offline case viewer

{
  "schema_version": "archivist-evidence-manifest/v1",
  "created_at": "2026-07-25T19:38:34.313674+00:00",
  "package_id": "evidence_package_sample-matter_20260725",
  "file_count": 9,
  "files": {
    "CHAIN_OF_CUSTODY.json":
      "sha256:4158116a4507b139b22bc0d6a5e4456347e8069f…",
    "evidence/findings/f-sample-matter-001.json":
      "sha256:9525213cb882ac19ddd27ace86c43a196bf3153d…",
    "README.md":
      "sha256:e4562d701dabdb2413b625843cc205dc44c7018b…"
  }
}

Untouched package verifies clean

$ python3 -m investigator verify evidence_package_sample-matter_20260725
INTACT: All files verified.
$ echo $?
0

Change one value and it refuses, loudly

$ # change one severity value inside one finding file
$ python3 -m investigator verify evidence_package_sample-matter_20260725
FAILED: Integrity check failed.
  Tampered: evidence/findings/f-sample-matter-001.json expected=sha256:9525213cb882ac19… got=sha256:9fec60c2a15f2d5f…
$ echo $?
1

$ python3 verification/verify.py
Verifying evidence package: evidence_package_sample-matter_20260725
============================================================
  [Package signature] PASSED
  [Manifest integrity] FAILED
    - TAMPERED: evidence/findings/f-sample-matter-001.json expected=sha256:9525213cb882ac19… got=sha256:9fec60c2a15f2d5f…
  [Chain of custody] PASSED
  [Annotation chain] PASSED
============================================================
RESULT: TAMPERED
One or more verification checks failed.

Transcripts above are real output from Archivist v6.1.0 against a demo case generated locally, not a client matter. Archivist is tamper-evident: it detects that a file changed after export. It does not prevent someone from changing a file, and it makes no claim about admissibility, which is a question for your jurisdiction and not a property of any tool.