FEDIS : Forensic Evidence Declaration & Integrity Statement

When digital evidence is shared via cloud links instead of direct file attachments, the risk of integrity challenges increases exponentially. Opposing parties may question whether the downloaded file matches the original acquisition, whether it has been modified, or whether the cloud link provides adequate chain of custody documentation. To ensure probative value remains unassailable, a technical certification framework is essential.

We explain why the Forensic Evidence Declaration & Integrity Statement (FEDIS™) provides a professional international framework for structuring, documenting, and independently verifying digital evidence — designed for digital evidence that must withstand professional, adversarial, regulatory, and cross-border examination.

What is the Forensic Evidence Declaration & Integrity Statement (FEDIS™)

The Forensic Evidence Declaration & Integrity Statement (acronym FEDIS™, coined by Informatica in Azienda to identify this specific forensic certification framework) is a structured forensic technical statement designed to accompany digital evidence throughout professional, judicial, regulatory, investigative, and cross-border examination, addressing three fundamental elements:

• Integrity – the file is unaltered and verifiable through SHA-256 and SHA-512 cryptographic hashes
• Authenticity – who acquired the evidence, with which tools, and according to which certified procedures
• Chain of custody – complete and documented traceability from acquisition to deposition

Unlike a simple screenshot capture or an undocumented file, FEDIS™ is Built in alignment with leading international forensic standards and evidentiary frameworks. FEDIS™ is structured with reference to ISO/IEC 27037:2012, the eIDAS framework for qualified electronic signatures and timestamps, and relevant U.S. evidentiary principles under Federal Rules of Evidence 901 and 902:

• ISO/IEC 27037:2012 – International guidelines for identification, collection, acquisition and preservation of digital evidence
• eIDAS – EU Regulation No. 910/2014 (qualified electronic signature and qualified electronic timestamp)
• Federal Rules of Evidence (FRE 901/902) – US evidentiary principles relevant to authentication and self-authentication of digital evidence

The result is a document that is technically robust, professionally structured, and independently verifiable, dramatically reducing the possibility of challenges by opposing parties and providing the court with an objective and independent verification tool.

In summary, FEDIS™ (Forensic Evidence Declaration & Integrity Statement):

• enables the sharing of certifications via a verifiable link, particularly useful for electronic filings and communications with law firms and authorities.
• drastically reduces disputes regarding the origin and integrity of digital evidence.
• is designed for international and cross-border digital evidence workflows, providing a robust and independently verifiable technical layer that can accompany evidence across different systems, custodians, infrastructures, and jurisdictions. The technical verification layer remains independently usable regardless of where the evidence is stored, transmitted, delivered, or examined — this is a jurisdiction-independent technical verification layer, not a jurisdiction-independent legal effect.

FEDIS™ Is Not Legal Equivalence: It Is Evidentiary Structuring

FEDIS™ must not be confused with a claim of automatic legal equivalence across jurisdictions.

A FEDIS™ document does not state that a digital file is automatically accepted by every court in the world. Instead, it provides a structured forensic statement that makes the evidence objectively verifiable by lawyers, judges, court-appointed experts, auditors and opposing parties.

This distinction is essential.

FEDIS™ does not replace the evaluation of the competent authority, the procedural rules of the jurisdiction, or the role of the court. Its function is different: it reduces uncertainty by documenting the technical conditions that normally support evidentiary reliability.

In practical terms, FEDIS™ answers the questions that usually generate disputes:

• Which file is being certified?
• When was the evidence package created?
• Which acquisition method was used?
• Which cryptographic hashes identify the file?
• Who issued the declaration?
• Which signature and timestamp mechanisms support authenticity and date certainty?
• Who is responsible for preserving the evidence after delivery?

This is why FEDIS™ should be understood as an evidentiary structuring layer, not as a shortcut around legal admissibility rules.

Why Cloud Links Require FEDIS™ Certification

Modern litigation increasingly relies on electronic filing systems with strict file size limitations (typically 30-60 MB). When certified material exceeds these limits, attorneys must provide download links to cloud storage instead of direct file attachments. In this scenario, FEDIS™ becomes essential because:

“The link itself proves nothing about the integrity of the downloaded content”
“Anyone could modify the file on the cloud server after acquisition”
“There’s no way to verify that what we download today is what was acquired originally”
“The chain of custody is broken when files are transferred to third-party cloud storage”

With FEDIS™ attached to the cloud-hosted evidence, FEDIS™ transforms integrity questions into objectively testable technical questions through independent cryptographic verification. Rather than relying solely on assertions about the delivery platform, the parties can directly verify whether the examined file corresponds to the file identified in FEDIS™, because:

• SHA-256 and SHA-512 cryptographic fingerprints provide robust, independently reproducible reference values for verifying the digital integrity and correspondence of the examined file
• Under Article 41 of Regulation (EU) No 910/2014 (eIDAS), a qualified electronic timestamp benefits from the presumption of the accuracy of the date and time it indicates and the integrity of the data to which the date and time are bound. RFC 3161 remains the underlying technical timestamping protocol
• The Qualified Electronic Signature identifies the signatory through the corresponding qualified certificate and, under Article 25 of Regulation (EU) No 910/2014 (eIDAS), has the equivalent legal effect of a handwritten signature
• Documented chain of custody provides structured documentation of the handling and custody of the evidence throughout the documented custody period, creating a clear and reviewable custody record up to the documented transfer of custody to the client

The judge, court-appointed expert, and opposing party can independently verify the hash: if it matches the one reported in FEDIS™, the examined file cryptographically corresponds to the file identified in FEDIS™, providing an objective and independently reproducible verification of file correspondence and digital integrity. No trust is required: the verification is technical and objective.

Recent Case Study: When FEDIS™ is Missing, Challenges Arrive

Just days ago, an attorney reported receiving a formal challenge from opposing counsel regarding the integrity of files in a certification deposited without FEDIS™.

The adverse party questioned:

• The possibility that files had been modified after acquisition
• The absence of an objective verification system for integrity
• The lack of alignment with international forensic standards

Result: procedural complications, need for supplementary expert testimony, extended timelines, and increased costs for the client.

With FEDIS™ attached from the beginning, the parties would have had an immediate, objective, and independently verifiable technical reference for addressing the integrity question. The court-appointed expert would have simply recalculated the hash of the deposited file and verified its correspondence with FEDIS™.

Real Case Study: When FEDIS™ Is Missing, Challenges Become Inevitable

The case is presented in anonymized and generalized form, for educational and professional purposes only. Similar situations occur regularly across multiple jurisdictions.

In a real proceeding, a lawyer reported receiving a formal challenge regarding the integrity of digital evidence that had been submitted without FEDIS™.

The forensic acquisition had been performed correctly, and the files were digitally signed and timestamped. However, the absence of FEDIS™ from the outset allowed procedural objections to emerge, unnecessarily complicating the case.

General Context (Applicable in Italy and Internationally)

Whenever digital evidence is submitted via cloud links or external storage (a common practice due to file size limitations), opposing parties may attempt to raise doubts concerning:

• possible alterations after acquisition;
• lack of an independent integrity verification mechanism;
• absence of verifiable cryptographic hashes;
• alleged non-alignment with forensic standards.

This occurs in Italian proceedings as well as in international contexts (USA, UK, EU, Canada, Australia), because the issue is not legal in nature. It is technical.

What Changes Between Italy and International Jurisdictions

In Italy, challenges are often constructed by confusing procedural document formats with technical evidence formats, exploiting electronic filing limitations.

Internationally, objections typically focus on chain of custody, absence of independently verifiable hashes, or lack of authentication mechanisms (“How do we know this is the same file?”).

In both scenarios, the underlying issue is identical: without FEDIS™, integrity must be explained. With FEDIS™, it can simply be verified.

Why the Absence of FEDIS™ Opens Three Attack Vectors

1. Confusion between documents and evidence
   The forensic container is treated as a simple attachment rather than as primary technical evidence.
2. Challenge to the delivery channel
   Without publicly verifiable hashes, it becomes possible to argue that today’s downloaded file may differ from the original acquisition.
3. Lack of objective verification
   A technical report may describe the procedure, but without FEDIS™ there is no independent technical control point.

Typical Consequences

• need for additional technical defensive submissions;
• risk of supplementary expert examinations;
• extended procedural timelines;
• increased client costs.

How FEDIS™ Would Have Enabled Immediate Technical Verification

Had FEDIS™ been attached from the beginning, the response would have been straightforward:

No trust is required. Verification is technical, objective, and independent.

The integrity question can then be addressed through an objective and independently reproducible cryptographic comparison.

Lesson Learned

FEDIS™: A Common Technical Language Between Experts, Lawyers, and Courts

FEDIS™ (Forensic Evidence Declaration & Integrity Statement) provides a universal verification point:

• cryptographic hashes (SHA-256 / SHA-512);
• unique file identification;
• qualified electronic signature;
• qualified electronic timestamp;
• structured integrity statement.

Whether before an Italian court or an international tribunal, the principle remains the same:

evidence does not need to be trusted. It must be verifiable.

Why FEDIS™ Does Not Create a New Central Trust Dependency

A common misunderstanding is to assume that a forensic statement creates a new central trust dependency.

FEDIS™ is designed to avoid that risk.

The verifier does not need to trust a private platform, a cloud repository, or the original acquisition environment. The core verification mechanism is independent:

• the file is identified through SHA-256 and SHA-512 cryptographic hashes;
• the statement is signed with a Qualified Electronic Signature;
• the Qualified Electronic Timestamp provides independent date certainty;
• the integrity check can be repeated by any qualified third party using standard tools.

This means that the evidentiary value does not depend on the continued availability of the original system, the cloud link, or the certifying platform. FEDIS™ preserves a verification surface that remains independently usable even when the original delivery platform is no longer available.

If the file exists and the hash corresponds to the values reported in FEDIS™, the integrity of the evidence package can be independently verified.

FEDIS™ therefore acts as a verification boundary, not as a central authority that must be trusted blindly.

The FEDIS™ Verification Process: Simple and Objective

Verification is extremely simple and can be performed by anyone with basic technical skills:

1. Download the certified file from the cloud link or physical media provided
2. Calculate the SHA-256 or SHA-512 hash of the file using free software such as:
   • Windows: HashTab, 7-Zip, certUtil (command line)
   • Mac: Terminal with command shasum -a 256 filename
   • Linux: Terminal with command sha256sum filename
   • Online: web services (not recommended for sensitive files)
3. Compare the obtained hash with the one reported in FEDIS™
4. Verification result:
   • ✅ Matching hashes → the examined file cryptographically corresponds to the file identified in FEDIS™
   • ❌ Different hashes → the examined file does not cryptographically correspond to the file identified in FEDIS™; the discrepancy requires investigation before reliance is placed on that file

This procedure can be performed at any time, even years later, and constitutes objective, independently reproducible cryptographic verification of the evidentiary material’s integrity.

Practical Application in Legal Proceedings

When depositing forensic certification with FEDIS™, you can include an effective formula in legal documents such as:

This simple declaration:

• ✅ Provides the opposing party, legal counsel, forensic experts, and the competent authority with an objective and independently verifiable technical reference — moving the integrity discussion from assertion to independently reproducible technical verification
• ✅ Makes technical challenges extremely difficult
• ✅ Demonstrates professional diligence and use of internationally aligned forensic references
• ✅ Provides the court with an objective verification tool

When FEDIS™ is Indispensable

FEDIS™ is particularly recommended (if not indispensable) in the following cases:

🔴 Electronic Filings with Links to Large Files

Electronic filing systems have size limitations (often 30-60 MB). When certified material exceeds these limits, attorneys must deposit a download link instead of the file itself. In this scenario, FEDIS™ becomes essential because it provides an independently verifiable cryptographic reference that allows the downloaded file to be compared with the evidence file identified in FEDIS™. Matching cryptographic hashes demonstrate that the examined file cryptographically corresponds to the referenced evidence file.

⚖️ High-Conflict Litigation

When opposing counsel is expected to systematically challenge every piece of evidence, FEDIS™ provides preventive technical shielding.

🌍 Cases with International Parties or Cross-Border Validity

FEDIS™ combines internationally relevant forensic references with independently verifiable technical elements designed to remain usable across jurisdictions, and is structured with reference to U.S. evidentiary principles (Federal Rules of Evidence) and EU regulations (eIDAS). FEDIS™ is designed to support professional examination of digital evidence across international and cross-border contexts.

📅 Evidence Intended for Multi-Year Preservation

In lengthy proceedings or cases with potential appeals, FEDIS™ ensures that even years later, the integrity of the original file can be verified.

💼 Particularly Sensitive or Strategic Digital Material

Compromising chats, emails with contractual agreements, web pages with defamatory content, damaging online reviews: anything that can make a procedural difference deserves maximum evidentiary protection.

Structure and Content of FEDIS™

A complete Forensic Evidence Declaration & Integrity Statement typically includes:

1. Document information – creation date, reference to certified file, Jurisdictional Scope: International (EU, USA, and other jurisdictions)
2. Evidence description – content type, source, acquisition method (FAW – Forensic Acquisition Workflow)
3. Cryptographic fingerprints – SHA-256 and SHA-512 cryptographic fingerprints associated with the evidence file identified in the statement, enabling independent and reproducible integrity verification
4. Legal and technical framework – structured with reference to ISO/IEC 27037:2012, eIDAS, Federal Rules of Evidence
5. Professional Declaration – a formal professional declaration concerning the activities performed and documented in relation to the referenced digital evidence
6. Chain of custody – structured chain-of-custody documentation covering the period from acquisition until the documented transfer of custody to the client
7. Retention policy – instructions on retention periods and client responsibilities
8. Qualified Electronic Signature and Qualified Electronic Timestamp – with corresponding validation data independently examinable through appropriate validation tools

Example of a FEDIS™ Evidence Structure

A complete FEDIS™ document may include, for example, the following technical and legal elements:

• document creation date and location;
• file reference and evidence package identification;
• jurisdictional scope;
• evidence description and acquisition method;
• reference to forensic acquisition workflow;
• SHA-256 and SHA-512 cryptographic fingerprints;
• chain of custody documentation;
• legal and technical framework references, including ISO/IEC 27037, eIDAS and Federal Rules of Evidence;
• Professional Declaration by the forensic expert;
• retention policy and custody transfer conditions;
• Qualified Electronic Signature and Qualified Electronic Timestamp information.

This structure makes the evidence package understandable not only to technical experts, but also to lawyers, courts, auditors and external reviewers.

The goal is not to ask the reader to trust the certifier. The goal is to give the reader enough technical information to verify the evidence independently.

The international FEDIS™ version is drafted in English to maximize accessibility, professional usability, and ease of examination in international and cross-border contexts, and is digitally signed with a qualified electronic certificate under eIDAS to support authenticity and integrity verification.

Proper Preservation of FEDIS™-Certified Evidence

To ensure accessibility and validity of evidence over time, it is essential to follow preservation best practices:

📂 Redundancy Principle (3-2-1 Rule)

Element	Preservation	Validity Duration	Notes
Certified file	Hard drive + USB + Cloud	Unlimited if intact	Redundant backup mandatory
Technical report	Printed + digital	Unlimited	Describes evidence structure
FEDIS™	Printed + digital	Unlimited (date certainty)	Contains verification hashes
Cloud link	Temporary	Variable (months/years)	For immediate sharing only
SHA-256/512 hash	Reported in FEDIS™	Immutable and permanent	Enables integrity verification

⚠️ Important: The cloud link serves for temporary sharing with the Court or opposing parties, but does not guarantee unlimited preservation. It is essential to preserve certified files locally on multiple media.

Types of Evidence that Always Require FEDIS™

1. Web Pages, Social Media Profiles, and Online Content Certification

Web pages can be modified or deleted at any time. A simple PDF printout or screenshot does not have sufficient probative value because it is easily challengeable.

The legally authenticated copy accompanied by FEDIS™ guarantees:

• Forensic acquisition of original HTML code
• High-resolution rendered screenshots
• Complete HTTP metadata (IP, timestamp, SSL certificates)
• Cryptographic hashes of the entire package
• Qualified Electronic Signature and Qualified Electronic Timestamp

Service available at:
🔗 Web Content Certification with Legal Value

2. WhatsApp Chat Certification (Remote Acquisition)

Isolated screenshots of WhatsApp chats provide limited technical context and are inherently more difficult to verify independently than a structured forensic acquisition. They can be easily manipulated with editing software or apps that simulate fake conversations.

The forensic certification with complete extraction of WhatsApp databases and attached FEDIS™ substantially strengthens the technical basis available for addressing integrity and authenticity challenges because:

• Extracts data directly from WhatsApp’s SQLite database
• Includes complete metadata (timestamp, message ID, delivery/read status)
• Certifies the hash of the original database
• Provides detailed technical report with Qualified Electronic Signature

FEDIS™ adds a structured, signed, timestamped, and cryptographically verifiable technical layer to the acquired evidence.

FEDIS™ as Professional Standard for Digital Evidence Deposition

The Forensic Evidence Declaration & Integrity Statement is not a technical luxury or optional feature: it is a professional protection tool for modern legal practice. It allows:

• ✅ Build a stronger technical foundation for addressing authenticity and integrity challenges through objective technical verifiability
• ✅ Strengthen probative value of deposition with alignment to leading international standards
• ✅ Demonstrate professional diligence in using documented forensic methodologies
• ✅ Offer the court independently verifiable evidence, without need to trust the expert
• ✅ Can streamline technical verification by providing independently reproducible integrity data from the outset, potentially reducing the need for supplementary technical clarification
• ✅ Protect client from additional costs arising from late challenges

In a context where almost every litigation involves a digital element, knowing how to request and correctly use FEDIS™ represents a real strategic advantage for law firms.

How to Obtain Certification with FEDIS™

All our forensic certifications include the Forensic Evidence Declaration & Integrity Statement as standard technical documentation, available for:

• ✅ Web pages, social profiles, marketplaces and online platforms
• ✅ WhatsApp, Telegram, Signal and other messaging applications
• ✅ Emails, PEC attachments and technical documentation
• ✅ Digital files, screenshots, audio/video recordings
• ✅ Blockchain transactions, smart contracts, NFTs
• ✅ Online reviews, comments, defamatory posts

For information or to request forensic intervention with FEDIS™, you can contact us:

Conclusion: FEDIS™ is the Future of Digital Evidence

Effective electronic filing depends on the solidity of digital evidence. The Forensic Evidence Declaration & Integrity Statement enables:

• 🛡️ Overcome challenges before they become procedural problems
• 📁 Protect the case file with robust technical documentation
• ⚖️ Give the judge a verifiable and objective tool
• 💼 Demonstrate professionalism and alignment with leading international standards
• ⏱️ Can streamline technical verification by providing independently reproducible integrity data from the outset, potentially reducing the need for supplementary technical clarification

In 2026, depositing digital evidence without FEDIS™ is like going to court without preparing the defense brief: technically possible, but strategically disadvantageous.

FEDIS™ sets a strong professional benchmark for digital evidence that must withstand adversarial examination and independent technica

---

FEDIS issued through the EVIDE platform

For FEDIS documents generated through EVIDE, the cryptographic references are the SHA-256 fingerprints of the intake record and of the referenced EAR version. This workflow does not add a SHA-512 fingerprint.

The SHA-512 fingerprints and the acquisition and preservation procedures described elsewhere on this page concern other forensic certification workflows and should not be read as features of EVIDE-generated FEDIS documents. In EVIDE, acquisition means the receipt of the intake by the platform; the documented chain of custody concerns the intake record and the EAR, and the source artifact is not retained after certification.

EVIDE generates the FEDIS document; the certifier signs it with a qualified electronic signature, and it receives a qualified electronic time stamp. The base EVIDE deposit carries a UTC timestamp generated by the EVIDE server, which is not a qualified time stamp: the qualified time stamp applies to the FEDIS document and to the moment it is applied, and does not retroactively qualify the intake timestamp.

Explore EVIDE’s service levels →

---