When the case is done, you hand off one package. This page documents the package format, the manifest, the SHA-256 hashes, and what a reviewing party (opposing counsel, a court, a regulator) can verify with off-the-shelf tools and no EMP license.
1. What's in the package
An export package contains the components you select and your licence supports. Core includes case-package export. Audit Timeline, Chain of Custody and Incident Maps require Standard or Professional; Timeline Recon and Link Analysis require Professional. The available components are:
- Incident Report (PDF): the human-readable summary, when selected.
- verify_integrity.html: a standalone browser verifier included with the manifest option, itself hashed and listed in the manifest.
- Manifest/: the JSON manifest, checksum text file and readable PDF, when enabled. Password-protected ZIPs require the manifest option.
- Audit Timeline/: the case action history as a PDF, with supported data when selected and entitled.
- Files/: the original files, preserved bit-for-bit, routed by type and entity.
- Evidence/: physical-evidence records, photos, and chain-of-custody PDFs.
- Timeline Recon/, Incident Maps/, Link Analysis/, Statements/: selected, eligible content supported by your licence. Draft maps and Statements are not substituted for retained artifacts.
2. The manifest
The manifest is the single source of truth for what's in the package and what each object's hash should be. It records the case ID, the export version, the export timestamp and actor, the hash algorithm (SHA-256), and for every evidence item: its stored name, its path inside the ZIP, its hash, its byte size, and when it was received. A reviewing party can re-hash each listed file and compare to the manifest. Matching these hashes checks consistency with the manifest, not the sender's identity.
3. The audit trail
When selected on Standard or Professional, the Audit Timeline export records supported case, evidence, custody and export actions with their recorded actor and time. Routine reads, navigation and playback diagnostics are excluded. EMP makes it cheap to produce and share rather than something you reconstruct by hand at deadline.
4. Package integrity: two levels of hashes
The SHA-256 of the complete ZIP is recorded outside the archive, in EMP’s package and export-audit record. The per-file hash of each evidence object is in the manifest inside the ZIP. A reviewer can recompute the file hashes from the ZIP; to confirm the exact container, they compare the ZIP’s SHA-256 against the recorded value from the exporting party. From the extracted package's root folder, run sha256sum -c Manifest/manifest.txt to check the files in the checksum list. This does not reproduce every manifest-policy check or detect arbitrary undeclared additions.
5. Verifying an export, end to end
First, calculate the on-disk ZIP's SHA-256 and compare it with the exporting party's independently obtained package record. Then check the included files against their manifest. The browser verifier checks supported package contents locally, without uploading them; it does not establish who created the package. Extract password-protected ZIPs with a compatible AES-ZIP tool before folder verification, and follow the verifier's instructions for large or unsupported archives.
6. What is NOT in the package
Case exports contain selected case records, reports and retained artifacts, not licence credentials or account recovery data. Review included actor details, report branding and case content before sharing. Partial exports ship a filtered manifest covering the included items.