In the forensic certificate architecture, digital forensic tools that conduct search are required to produce forensic certificates. The forensic certificates can be verified independently of the original search tools.

For reasons of efficiency, verification is conducted by a combination of a theorem prover (such as Coq), external assumption verifiers (e.g., for decompression), and a composition prover. The architecture is displayed below, and explained more fully in "Certificates for Verifiable Forensics".

• Certificates for Verifiable Forensics, by Radha Jagadeesan, CM Lubinski, Corin Pitcher, James Riely, and Charles Winebrinner. In Computer Security Foundations Symposium (CSF), 2014.