EvidentlySo home

How to verify an export

The short answer: Each EvidentlySo PDF names the capture file it came from and prints that file’s fingerprint (a SHA-256 code). To check it, get the capture file, compute its fingerprint with a free built-in tool, and compare. If the two codes match exactly, the capture file is the same unchanged file the PDF names as its source.

What you need

  • The PDF
  • The capture file it names. It’s in the customer’s Dropbox, in the EvidentlySo app folder. [APP: confirm the exact folder and file name format]

Find the fingerprint in the PDF

It’s printed on [APP: confirm location, e.g. the first page / the record of what’s included], labeled “Capture file fingerprint (SHA-256).”

Compute the capture file’s fingerprint

Windows

Open PowerShell and run:

Get-FileHash "C:\path\to\capture-file" -Algorithm SHA256

Mac

Open Terminal and run:

shasum -a 256 /path/to/capture-file

Linux

Run:

sha256sum /path/to/capture-file

Compare

The code from the tool should match the code printed in the PDF, character for character. Letter case doesn’t matter.

  • They match: the capture file hasn’t changed since the PDF was made.
  • They don’t match: this isn’t the same file, or it has been changed.

What this does and doesn’t show

“The fingerprint lets anyone with the archived capture file confirm it is the exact, unchanged file this PDF names as its source. It does not show the capture is complete. For example, messages deleted from the phone before capture won’t be in it.”

Related: For attorneys · FAQ

This is general information, not legal advice.