Download
macOS 14 or later, Apple silicon and Intel. Signed and notarized by ProfWorkBench, LLC. It reads a certificate and prints a report — it never writes to a disk, and it needs no special permissions.
Download overwrite-verify (98 KB)
Checksums
Check what you downloaded before you run it:
shasum -a 256 overwrite-verify.zip
5f4564aabd72b8a73bc076e02db7be57d0792df97e7af004010124ef0a3ee2da overwrite-verify.zip
And the binary inside the archive:
b43d668549dd9820daf1435e1b242db24c2b735c181257161a7fd5cbbf39eb07 overwrite-verify
Already have Overwrite Elite? The identical tool ships inside the app, at /Applications/Overwrite Elite.app/Contents/MacOS/overwrite-verify.
How to run it
unzip overwrite-verify.zip
./overwrite-verify Certificate.pdf
The certificate’s own last page lists the same steps, plus the exact commands for reproducing the manifest digest by hand if you would rather not run our tool at all.
Tying a certificate to the machine that issued it
Pass the fingerprint you hold for the issuing installation, obtained by some route other than the certificate itself:
./overwrite-verify Certificate.pdf --expect-fingerprint <fingerprint>
Without that step, a record re-signed by anyone using a key of their own still passes every other check. This is the step that matters most, and it is the one people skip.
What a passing check proves
- The signed data is intact — the manifest bytes on the document are byte-for-byte the bytes that were signed.
- The printed page matches the signed data — the text of the certificate page is character-for-character the text that was signed, so a genuine seal moved onto a different page fails rather than passes.
- The document does not contradict itself — the key fingerprint on the page is the one recorded inside the signed manifest.
And what it does not
- Not who issued it. The public key is read out of the same file, so anyone able to edit the document can replace the key and re-sign it. Only reconciling the fingerprint against a record of the issuing installation, obtained separately, establishes authorship.
- Not that any drive was sanitized. The tool reads a document. It has no access to the media and cannot confirm that a wipe happened, or that the record describes the drive it names.
- Not that what you see is what was signed. Text and ink are separate layers in a PDF: shapes drawn over the page can cover one value and display another without altering a character of the text underneath. Read the printed figures against the manifest with your own eyes.
The tool prints these limits on every run, whatever the verdict. A checker that only ever tells you “valid” is not worth much.
Questions about a specific record
If a certificate does not verify and you believe it should — or it verifies and you believe it should not — contact us and include the tool’s full output.