Direct answer: a useful case file is not the one with the most screenshots. Each item should answer who acted, when, through which channel, which address received which asset, how much moved, and what original record supports it.
1. Build a case index
- reporting person and contact details;
- first contact date, channel, and counterparty account;
- affected wallet, network, asset, amount, transaction hash, and time;
- relevant website, application, contract, receiving address, and support account;
- containment, platform notice, and official-reporting steps already taken.
2. Build a transaction table
Use one row per loss transaction. Record network, hash, sender, recipient, token contract, raw quantity, display quantity, block time, execution status, and explorer URL. On EVM networks, the to field may be an externally owned account or a contract executing code, so a screen label alone is not enough.
3. Preserve original communications and device evidence
Keep original chat exports, full email headers, website and application URLs, installation sources, login alerts, device-security warnings, and support tickets. Avoid relying only on cropped screenshots. Create a read-only working copy and record the export time. FBI/IC3 guidance recommends retaining originals for possible direct request by an investigating agency.
4. Apply evidence labels
- Fact: directly supported by chain data, an original file, or an official platform record;
- Association: a lead derived from labels, shared counterparties, time-and-amount overlap, or reused infrastructure;
- Inference: a professional explanation of scam type, control, or transfer purpose;
- Unknown: a question the current material cannot answer.
FATF states that a single red flag must be read in context and is not, by itself, an attribution or suspicion finding.
5. Record evidence gaps
Typical gaps include a missing full hash, an unexplained local timezone, an uncertain asset or network, screenshot-only chats, no wallet-control proof, a single-source label, or cross-chain amounts not adjusted for fees and swaps. Convert each gap into a collection task; do not fill it with speculation.
Related cases
The Case Library shows why asset, amount, time, and counterparty anchors matter in dispersal, consolidation, and cross-chain cases.
Review and data scope
Data cutoff: 2 August 2026. Reviewed by the Crypto Forensics Lab Editorial Team for field completeness, source traceability, and separation of fact from inference. Local authorities may impose different evidentiary-form requirements.