CAIN-42 CAIN StudioCAGA · Module 3 of 5 · 13 min
Tamper-evident (WORM) evidence packs
Evidence that can be edited after the fact is weak evidence. Write-once-read-many (WORM) export keeps records append-only; Merkle roots bind them so any bit-level change invalidates inclusion proofs; Ed25519 signatures bind them to a key.
A useful evidence pack contains the records, the Merkle root, the public key fingerprint, a manifest of files with hashes, and a standalone verifier.
Be precise in wording: CAIN's export is designed for tamper evidence. Whether a court admits it is decided by the court, not the software.
Key points
- Append-only + Merkle root + signature.
- Pack = records, root, key fingerprint, manifest, verifier.
- Tamper-evident ≠ automatically court-admitted.
In the CAIN-42 codebase
cain/worm_export.py— WORM export with Merkle bindingkeystone/bundle.py— auditor bundle
Practice check
Practice 1 · true or false
“Software can guarantee a court will admit its evidence.”
Practice 2 · choose one