What this checks
- Each sealed record's signature verifies with the phone's public key in the package.
- Each photo and drawn signature is byte-for-byte the file its record names.
- An independent timestamp, where present, covers the exact record and is signed by the certificate inside it.
- The job hash covers every record, so a record that was added or removed shows up.
What it cannot show
You can run the same checks with standard tools; the package's README.txt lists the commands.