Check a pack yourself. No Finium account needed.
Every Finium export is a .zip with a hash manifest, a root hash, a custody log and an RFC 3161 timestamp token over the root hash. Anyone holding the pack can check it, offline, with the open-source evidence-verify tool.
Hash the pack locally.
A first check: compute the pack's SHA-256 here and compare it with the hash in your delivery note. The file never leaves your device.
Choose a pack to compute its SHA-256 locally. For the full check of manifest, root hash and timestamp token, use evidence-verify.
The manifest, root hash and timestamp token are checked with evidence-verify, offline.
Run evidence-verify.
Apache 2.0. Python standard library only, no network access. Available
# from a checkout of the repository python -m evidence_verify pack.zip python -m evidence_verify pack.zip --json python -m evidence_verify pack.zip --tsa-ca tsa.pem
Exit codes
- 0: pack integrity verified
- 1: verification failed: a tampered, missing or unlisted file
- 2: bad invocation, for example an unreadable --tsa-ca file
A pack without a timestamp token still exits 0, with a warning. Pass --tsa-ca to check that the token signer was issued by the authority you trust.
What a pass and a fail look like.
Illustrative output for a specimen pack. Not client material.
- ok manifest: 14 files, SHA-256 match
- ok root hash recomputed
- ok no unlisted or missing files
- ok timestamp token (RFC 3161): signature verified
- pass exit 0
- fail manifest: E2/post.html hash differs
- fail root hash does not recompute
- ok no unlisted or missing files
- fail timestamp token no longer matches root hash
- fail exit 1
What a pass proves, and what it doesn't.
A pass shows
- Every file listed in the hash manifest still matches its recorded SHA-256, custody log included.
- The root hash recomputes from the actual bytes, so the file set is exactly the set that was hashed.
- No unlisted file was added and no required file is missing.
- With a timestamp token: it covers the pack's root hash and its signature verifies. With --tsa-ca, the signer certificate was issued by the authority you supplied.
A pass does not show
- That the original capture is authentic. Hashes show the content did not change after the pack was assembled.
- That the content is true, lawful or unlawful. Counsel decides.
- That a court will admit the material. Admissibility is decided by courts and counsel.
- That the timestamp is qualified under eIDAS. The tool verifies the token signature; it does not check the provider's qualified status, revocation or the full certificate path.
How packs are built: the Finium Evidence Standard
See a pack built from one of your matters.
Start with your work email. You pick a time on the last step.