  We reverse-engineer, test and analyse hardware and firmware of the commercial
quantum-optical random number generator Quantis from ID Quantique. We show that
> 99% of its output data originates in physically random processes: random
timing of photon absorption in a semiconductor material, and random growth of
avalanche owing to impact ionisation. Under a strong assumption that these
processes correspond to a measurement of an initially pure state of the
components, our analysis implies the unpredictability of the generated
randomness. We have also found minor non-random contributions from
imperfections in detector electronics and an internal processing algorithm,
specific to this particular device. Our work shows that the design quality of a
commercial quantum-optical randomness source can be verified without
cooperation of the manufacturer and without access to the engineering
documentation.
