Evidence before assumption. A wallet address alone does not establish identity, an IP address alone does not establish ownership, and a blockchain transaction alone does not necessarily establish beneficial control of an asset.
Each item entering a case is recorded with where it came from, who supplied or captured it, and when. A transaction is cited by hash and block, a document by page, a public page by address and retrieval time. Material whose origin cannot be stated is not used to support a finding.
A single source establishes that something was recorded, not that it occurred. A statement moves beyond an investigative lead only when a source of a different type, produced by a different party, supports it. Two copies of the same underlying record count as one source.
Every finding is written so that a reviewer with the same source material reaches the same result without needing the original analyst's explanation. Where a result depends on a tool, the tool, its parameters and the date it was run are recorded with the result.
Events are placed on a dated timeline before any explanation of them is written. Timestamps are converted to a single reference, the source of each time is retained, and periods where nothing can be observed are shown as gaps rather than closed by assumption.
Supplied and captured material is hashed on receipt and held unmodified. Analysis runs on working copies linked back to their originals, and access and export events are logged so the handling of any item can be reconstructed afterwards.
Nothing is reported without a grade. The six-level scale is applied to every statement, so the difference between an established fact and a plausible reading is visible on the page rather than carried in tone.
Where sources disagree, both readings are stated together with the material behind each. A conflict is closed only where a record decides it. It is never closed because one reading suits the instruction better than the other.
Every report carries a register of what could not be established and why — material never retained, access that would not be lawful, a chain segment with no public record. An unanswered question is reported as unanswered.
Established by primary records and independently reproducible.
Multiple independent sources agree and no source contradicts them.
Some corroboration exists but the chain of evidence is incomplete.
Recorded as an investigative lead, not yet tested against a second source.
Sources disagree; the conflict is documented rather than resolved by preference.
The available material cannot answer the question asked.