Skip to Content
Casework MethodThe Scope Triangle

The Scope Triangle

concept

Core idea

Three variables shape every investigation, time, data, and resources. They are interdependent: change one and the others must flex. Pretending otherwise is how cases run over.

Components

  • Time: how deep you can go. 24 hours buys the highest-value pivots and likely endpoints; a week buys multiple laundering paths, OSINT correlation, and robust validation.
  • Data: what is even possible. A single wallet address yields a partial picture; logs, communications, screenshots, domains, and transaction history yield a rich one.
  • Resources: tools, access, expertise, legal powers, team capacity. Some cases need subpoenas or RFIs, some need specialist crypto analysts, some need only open-source tooling.

When to use

When scoping a case and managing client expectations, to explain why more data demands more time or resources, and why less time means less scope unless resources increase.

Example

The law of the triangle: more data needs more time or more resources; less time means less scope, or more resources. If a client adds chains to trace but keeps the deadline fixed, either resources must rise or scope must shrink.

Intake Triage Checklist, Five Intake Red Flags, Case Tractability: When to Decline

Last updated on
Freezable vs Non-Freezable Crypto AssetsCase Tractability: When to Decline