Evidence Preservation Procedure

workflow

Core idea

Preserve first, analyse second. Eight steps that run between case intake and any analytical work, producing an evidence inventory and, where policy requires it, an open chain of custody. The crypto-specific step is step 4: the identifiers get recorded exactly as observed, in full, alongside the network and the explorer used. Budget 20 to 45 minutes for the initial pass, then keep it running.

Components

Prepare for collection. Review the case file and identify what needs preserving. Record case number, investigator, date and time, objectives, and the initial evidence sources.
Identify evidence sources. Wallet addresses, transaction hashes, explorer records, exchange communications, emails, text messages, chat logs, social media content, financial records, device artifacts, and anything supplied by victims or reporting parties. Document where each item came from.
Preserve original evidence. Keep it in original form wherever practical. Record date obtained, time obtained, source, method of acquisition, and the responsible investigator. Do not modify or overwrite original digital files.
Document cryptocurrency evidence. Record exactly as observed: wallet addresses, transaction hashes, blockchain network, asset, token standard where applicable, block height, transaction timestamp, and the explorer used during review.
Create the evidence inventory. Per item: an evidence reference number, a concise description, the source, the date obtained, and the storage location. Note anything relevant to authenticity or completeness.
Maintain chain of custody. Where policy or legal process requires it, open the custody log and record every transfer, access, or movement, who was responsible, and the reason.
Verify preservation. Confirm the evidence is complete as far as currently available, that missing evidence has been documented, that sources are recorded, that preservation activities are logged, and that working copies are clearly distinguished from originals.
Transition to analysis. Update investigation notes, confirm the inventory is accurate, then move to wallet and blockchain review.

When to use

Immediately after intake, before detailed analysis, and again whenever new evidence arrives mid-case. It is the procedural counterpart to the preservation checklist: this is the sequence, that is the quality gate.

Avoid when

The recurring failures are all avoidable: not documenting where evidence came from, relying on a screenshot when the original record is still available, recording an incomplete address or hash, deferring preservation until after extensive analysis, and omitting the preservation attempts that failed or the evidence that was unavailable. Record the gaps, not just the holdings. Obtain legal authority before requesting non-public records, and handle PII per policy.

Example

A victim sends a WhatsApp export and three screenshots. The export is saved unaltered as the original with its acquisition method logged, rather than being summarised into notes. The two deposit addresses visible in the screenshots are transcribed in full, checked against the export, and recorded with the network and the explorer used to confirm them. The screenshots get evidence reference numbers and descriptive captions. One screenshot is illegible: that is recorded as a gap rather than quietly dropped.

Evidence Preservation Checklist · Five Evidence Preservation Principles · Chain of Custody by Evidence Type · Custody Log: The Six Questions · What to Collect: On-Chain & Off-Chain Evidence · The Analysis Standard: Four-Block Write-Up · Case Opening Procedure · Time-Decay of Crypto Evidence · Admissibility: The Three Gates