What it means
An iCloud return arrives as OpenPGP files with a separate key. Opening it by hand means a command-line keyring, a decrypted copy with no record of where it came from, and a key that stays on the machine.
What to look for
The questions to ask: Is the encrypted original left exactly as it arrived? Is the decrypted output hashed and tied to the original? Is the key held only for the operation and never saved? Is there a record a prosecutor can read?
How DEVI does it
In DEVI, the return is decrypted on the examiner's own computer. The original is read-only, the output is hashed and checked before it is kept, the key is held in memory for the operation only, and a verification record names both hashes.
See it on a test case
Walk through it with us
Tell us how your department handles this today, and we will show how DEVI does it.