CaseCapture Package Validator

CaseCapture Package Validator is a static, offline HTML and JavaScript application for validating evidence packages generated by CaseCapture OSINT.

The validator calculates and compares SHA-256 hashes, checks the structure of the evidence ZIP, verifies the package manifest, identifies missing or modified artifacts, and produces reviewable HTML and JSON validation reports.

No installation, executable, administrator privileges, web server, Python environment, or internet connection is required.

Key features

• Runs locally in a current web browser
• Processes selected packages entirely on the local computer
• Calculates the SHA-256 hash of the complete evidence ZIP
• Verifies an optional companion .zip.sha256.txt file
• Checks ZIP structure, duplicate entries, unsafe paths, compression support, and CRC-32 values
• Locates and validates the root-level manifest.json
• Verifies the manifest integrity value used by supported CaseCapture releases
• Recalculates the SHA-256 hash of every artifact listed in the manifest
• Reports missing, modified, invalid, and unexpected files
• Exports HTML and JSON validation reports

Current compatibility

Version 0.1.0 is designed for evidence packages generated by CaseCapture OSINT 0.5.1 using manifest version 3.

Packages produced by later versions may still be inspected, but the validator should display a compatibility warning when the package format has not been formally tested.

Use the validator

1. Download the latest validator release from the repository's Releases page.
2. Extract the release ZIP to a normal folder.
3. Open index.html in a current version of Chrome, Edge, or Firefox.
4. Select the CaseCapture evidence .zip file.
5. Optionally select the matching .zip.sha256.txt file.
6. Select Validate package.
7. Review the summary and individual artifact results.
8. Save an HTML or JSON validation report when needed.

Do not extract or edit the evidence package before validation. The original ZIP and its separately preserved SHA-256 value should be retained according to agency policy.

Privacy and network behavior

The validator is a static local application. Evidence packages are processed in browser memory and are not uploaded by the validator.

The included Content Security Policy blocks network connections from the application. The project does not require analytics, telemetry, accounts, cloud storage, or remote services.

What a passing result means

A passing result confirms that:

• the selected ZIP could be read;
• the supported manifest structure was present;
• the manifest integrity value matched;
• every listed artifact was present; and
• every listed artifact matched its recorded SHA-256 value.

When a matching companion checksum file is supplied, a passing result also confirms that the complete ZIP matches that separately recorded SHA-256 value.

A passing result does not independently authenticate:

• the original online content;
• the identity or authorship of an account;
• the website or platform operator;
• the investigator;
• the accuracy of the source computer's clock; or
• the software build that originally created the package.

Internal hashes can be recalculated by someone intentionally rebuilding a modified package. Preserve the original ZIP hash separately. Future versions may add cryptographic signature verification.

Supported browsers

Use a current version of:

• Google Chrome
• Microsoft Edge
• Mozilla Firefox

The validator relies on modern browser APIs, including Web Crypto and native decompression support. Older browsers may not support all required functionality.

Repository structure

.
├── index.html
├── validator.js
├── styles.css
├── README.md
├── LICENSE
├── CHANGELOG.md
├── SECURITY.md
├── SUPPORT.md
├── CONTRIBUTING.md
└── .github/
    ├── ISSUE_TEMPLATE/
    └── PULL_REQUEST_TEMPLATE.md

Development

No build process is required.

To test a change:

1. Clone or download the repository.
2. Open index.html locally.
3. Validate a known-good CaseCapture package.
4. Validate controlled test packages containing a modified artifact, missing artifact, incorrect companion checksum, and malformed manifest.
5. Confirm that no external network request is made.

Keep the application compatible with direct local opening through a file:// URL. Avoid dependencies or browser features that require a local server unless the project formally changes that requirement.

Reporting security issues

Do not disclose a suspected security vulnerability through a public issue. Follow the instructions in SECURITY.md.

Support and questions

See SUPPORT.md before opening an issue.

Contributing

Contributions and controlled test results are welcome. See CONTRIBUTING.md.

License

Copyright © 2026 Richard Theberge.

This project is distributed under the terms in LICENSE.

Related project

CaseCapture Package Validator is intended to validate packages generated by the separate CaseCapture OSINT browser-extension project. Validation does not replace agency evidence procedures, legal review, independent authentication, or testimony concerning how a capture was performed.