verify-bundle

Verify Bundle

Re-hash files and compare against recorded hashes, validate BagIt manifests, and verify OpenTimestamps proofs.

When to use

• Confirming evidence integrity after transfer or archival
• Detecting accidental or malicious file modifications
• Auditing chain-of-custody milestones before handoff
• Validating OpenTimestamps anchors for immutability proof

Inputs to gather

• Path to evidence directory, BagIt bag, or individual file (required)

Procedure

1. If input is a BagIt bag (contains bagit.txt): run bagit.py --validate <dir>.
2. If input is a directory with a .sha256 manifest: re-run find <dir> -type f -exec sha256sum {} \;, compare output against manifest entries using diff.
3. For any .ots files found in or near the evidence: run ots verify <file> on each.
4. Aggregate results into a single PASS/FAIL report:
   • All files match recorded hashes: PASS
   • Any divergence: FAIL with per-file diff detail
   • All OpenTimestamps proofs valid: noted
   • Any OTS verify failure: FAIL with reason
5. Report to user: overall status, per-file divergence (if any), OTS proof validity, and recommendation (re-bag if needed, or escalate if tampering suspected).

Output / side effects

• Verification results printed to stdout (no files modified).
• User sees: PASS/FAIL status, detailed divergence if any, OTS validity.
• Read-only on all input files.

Safety / constraints

• This is a forensic read-only operation; it does not modify evidence.
• Verification failure does not imply intentional tampering; check for accidental overwrites, encoding changes (e.g., video transcoding), or filesystem timestamp updates.
• For large evidence sets, verification may take several minutes; inform user.
• OpenTimestamps verification requires the .ots files to be present alongside originals.