Products
Three tools shipped, two in beta
Each one runs on your own computer, opens evidence read-only and leaves a record you can check. Built for professionals who have to defend a finding. How to get a tool
DEVI Validate
Prove the evidence has not changed
Re-hash a file or a whole extraction folder offline and compare it with the hash list another tool wrote down.
- SHA-256, SHA-1 and MD5
- Sum files, CSV files and imager logs
- Match, Mismatch, Missing and Extra, file by file
- A PDF verification record for the case file
DEVI Decrypt
Open Apple and iCloud returns offline
Decrypt an OpenPGP provider return on the examiner's own computer. The original file is never changed.
- Password-locked or key-locked files
- The key and password are never saved
- The output is hashed and checked
- A PDF verification record of the decryption
DEVI Registry
Know where an app keeps its data
A sourced reference of app paths, parsers and legal-process contacts, with an offline Windows app to look it up.
- A public source for every claim
- Preservation, emergency and legal-process pages
- How far each claim was checked, and when
- Content-hash checked before a record is shown
DEVI Reader
Review a phone extraction report
Review a phone extraction report on your own computer. Search the whole device at once, see locations on an offline map, and tag what belongs in your exam report.
- Search the whole device at once
- See locations on an offline map
- Tag what belongs in your exam report
DEVI Sandbox
Open evidence links away from your exam computer
Open links found in evidence in a separate, disposable Windows session instead of on your exam computer. Mark each link done or flagged, then review the session in a case viewer.
- A separate, disposable Windows session
- Mark each link done or flagged
- Review the session in a case viewer
Which tool do I need?
Which tool do I need?
Five tools, three shipped and two in beta — for professionals who need a result they can defend. Start from the job, not the product name.
- DEVI ValidateYou need to prove evidence files have not changed. An offline, read-only evidence hash checker. Shipped v1.0.3.→
- DEVI DecryptYou have an Apple or iCloud OpenPGP return and its key. An offline Windows utility for Apple and iCloud OpenPGP provider returns. Shipped v1.0.3.→
- DEVI RegistryYou found an app and need its paths, parsers and legal-process contacts. A sourced database of application and artifact metadata, with an offline Windows app. Shipped v1.0.4.→
- DEVI ReaderYou received a phone extraction and need to read it. Beta, open for testing and evaluation.→
- DEVI SandboxYou need to open a link found in evidence without using your exam computer. Opens links in a separate, disposable Windows session. Beta, open for testing and evaluation.→
- .jpg
- .png
- CgBI
- .gif
- .webp
- .isdata
- .bmp
- .tif
- .ico
- .car
- .3gp
- .mp3
- .wav
- .txt
- .html
- .glsl
- .pem
- .db
- .sqlitedb
- .db-wal
- .db-journal
- .ldb
- .plist
- .nib
- .abx
- .cbor
- .digests
- TZif
- Tape log
- .zip
- .gz
- .lz4
- Cache marker
- .ufdr
- Raw TAR/ZIP
Pictures, video, audio, documents, databases, app and system files, archives, web caches and phone extractions, opened offline and read-only.
How it works
Three steps. No upload.
01
Open
Open the evidence on your own computer. DEVI reads it without changing it.
02
Check
Verify hashes, decrypt an Apple return, or look up an app. Nothing is sent to DEVI.
03
Record
Keep the result. Validate and Decrypt write a PDF record for the case file; Registry names the source of every claim.
Solutions
Built for the people who stand behind the evidence
Labs
Law enforcement labs
Verify, decrypt and document evidence on the lab's own computers.
Prosecutors
Prosecutors' offices
Records that say what was checked, how, and what the result means.
Private practice
Private practice
The same offline tools and limits, outside an agency.
Security
Your evidence stays with you
Six things that are true of every shipped tool, each one something you can check.
Works offline
Hashing, decrypting and lookups never use the network. The only request is an optional update check.
Evidence opened read-only
DEVI Validate and DEVI Decrypt read evidence without changing it.
Your case data stays with you
Evidence, keys, file names and hashes are never sent to DEVI.
Signed Windows apps
Every app and installer is Authenticode-signed, with a timestamp.
A SHA-256 for every file
Check any download against the value on its tool page.
Approved accounts only
The DEVI Ops Team reviews every account and every tool request.
Questions
Does DEVI see my evidence?
No. The tools work offline on your computer. Your evidence, keys, file names and hashes are never sent to DEVI.
How do I check a download?
Compare its SHA-256 with the value on the tool page, then check its signature. The Trust and Security page shows the commands.
How do I validate DEVI for my lab?
Check the download, run the tool's built-in self-test, and compare a public test image against the tool you use today. How DEVI is tested explains each release's testing.
Who approves access?
The DEVI Ops Team reviews every account and every tool request. We review every request, usually within the same business day.
Proof
Check our work, not our word
What DEVI publishes can be checked with ordinary tools, before you rely on it.
- A SHA-256 for every fileEach release file has a published SHA-256. Compare it with Get-FileHash or certutil.→
- Signed Windows appsThe apps and their installers are Authenticode-signed. Windows shows the signer in the file's Properties.→
- A source on every Registry claimEach DEVI Registry record cites its public sources and says how far each claim was checked.→
- Research with its sourcesThe forensics insights name the sources they read and the limits those sources state.→
Why DEVI
Why DEVI
Each DEVI tool does one job, on your own computer, and every record it writes names what was checked and how, so a finding can be repeated by someone else with ordinary tools. The full reasons, with their evidence, are on the why DEVI page.
Sandbox is the exception to the offline rule: it opens evidence links in a separate, disposable Windows session, not on your exam computer.
Get access
How to get a tool
Each approved account gets a monthly allowance that refills on the account's billing day. Opening and viewing evidence never uses it.
Who qualifies: Verified law enforcement, prosecution, defense and contractor examiners.
Licensed per examiner, not shareable. Each tool is approved on its own.
We review every request, usually within the same business day. Questions? contact@deviops.app
Create an account.
Sign up at deviops.app with the email you want to use for DEVI.
Complete your profile.
Who you are (law enforcement, prosecution, defense or contractor), your agency or firm, your role, and a supervisor or point of contact.
Request each tool.
Give a short reason and accept the license agreement. Each tool is approved on its own.
The DEVI Ops Team reviews it.
We email the decision to your sign-in address.
Resources
Latest insights
Research with its sources, written for examiners.
Bytes Before Meaning
Reading a file looks like one step. It is several, and each one is an interpretation, from bytes to text to lines to a table.
ReadWhere iMessage and SMS records live
iMessage, SMS, and RCS on an iPhone are reported in one SQLite file, sms.db.
ReadWhat a chat record shows
A chat an examiner reads usually has parties, a body or an attachment, and a time.
Read
Get access
Put DEVI on your own computers
We review every request, usually within the same business day. Verified law enforcement, prosecution, defense and contractor examiners.