Evidence Handling, Reporting, and Case Documentation
This domain tests whether your work survives scrutiny: preservation, reproducibility, and clear reporting.
Evidence handling
- Capture raw data where possible: transaction hex, block headers, contract traces, and full node responses, not only screenshots.
- Record tool name and version, analyst, UTC time, source URL or node, and query parameters.
- Hash evidence files with SHA-256 and store them write-once; maintain a chain-of-custody log with every transfer and access.
- Preserve original screenshots with metadata; never edit the original.
Reporting
A defensible report contains scope and question, sources and methodology, transaction-flow findings with txids and block heights, attribution with a stated confidence level, limitations, and appendices. Distinguish fact, inference and opinion.
Worked example
You screenshot a block explorer page showing a 5 BTC transfer. Reasoning: the screenshot alone is weak. Record the txid, block height, timestamp, explorer URL and access time; export the raw transaction and hash it; note the explorer version; and cross-check the txid on a second source. If the explorer later changes, the hash and raw data still prove what you captured.
Traps
- Editing screenshots or cropping out timestamps.
- Omitting tool versions and query dates.
- Stating attribution as fact when it is a cluster-level inference.
- Failing to preserve the underlying blockchain data behind a graph.