Record details without abbreviating them
Preserve the network name, asset, amount, full addresses, transaction identifier, date and time with the known time zone. FBI/IC3 also highlights these details in cryptocurrency fraud reporting guidance. Here they serve as a guide for preparing technical materials.
Add explorer links, but also copy the main values as text. A screenshot with a shortened address illustrates the interface but may not uniquely identify a record. Explicitly state if the network or another detail is unknown.
Preserve the platform’s original history
If the transaction used an exchange or other service, preserve the available history export, order record and deposit and withdrawal details. Record the selected period, filters and file retrieval date. Keep the original separate from any table you annotate.
Do not automatically equate an order identifier, internal transaction number and public transaction hash. Copy each detail with its source. The examination will check whether the records describe one event or different stages.
Preserve the communication context
From correspondence available to you, preserve the sequence of relevant messages, dates, the other party’s displayed details and payment details provided. For websites and pages, retain the full URL, access date and images of significant screens.
If you annotate a screenshot, also preserve the original without additions. Do not present your own caption as part of the correspondence or interface. Separately explain each material’s origin and what you believe it supports.
Prepare a brief chronology
For each event, give the time as originally recorded, a description and a link to the file or record. Examples include receiving payment details, creating an order, making a transfer, a credit notification or a demand for extra payment. Do not replace an unknown time with an invented precise timestamp.
Separate observed facts from assumptions. A transfer record and the other party’s explanation of who owns the address come from different sources. Labelling them this way helps identify which links still need checking.
Prepare a package without access credentials
Group files by incident or transaction and briefly describe the question, relevant amounts and period, and missing data. Filenames should help locate a source rather than replace its contents.
Do not provide seed phrases, private keys, passwords, API keys or verification codes for a technical examination. If your service shows signs of unauthorised access, address account security through its verified official channels, separately from sending materials to a specialist.
Treat recovery promises cautiously
FBI/IC3 specifically warns about follow-on schemes promising victims cryptocurrency recovery. Claims of guaranteed results or demands for another transfer to unlock funds should be questioned and checked independently.
A technical examination can check transactions and the consistency of submitted information. Its scope and possible result are assessed from the materials. Preserved details and documents support this assessment but do not themselves ensure asset recovery.
Sources and notes
Public materials for checking technical statements. A specific transaction is assessed using its data and the documents provided.
Start with the task
Describe the situation, materials available and question to be answered.