Five Investigation Goal Types

framework

Core idea

Clear goals stop investigators drowning in effectively infinite data and keep analysis relevant rather than merely interesting. Goals also drive defensibility: if you cannot explain why you looked somewhere, findings are easy to challenge. Every case fits one (or more) of five goal types, each with a typical output and its own failure mode.

Components

Attribution: link on-chain/digital artefacts to real-world actors via OSINT, reused usernames, infrastructure overlaps, KYC choke points. Output: attribution profile. Watch out: attribution is probabilistic, do not overpromise; fall back to intelligence-level findings.
Fund Tracing: follow assets from point A through mixers, CEXs, DEXs, bridges toward a cash-out or resting place. Output: fund-flow diagram with timelines, value per hop, labelled endpoints. Watch out: activity is effectively endless, without scoped endpoints, tracing never completes.
Intelligence: understand patterns, actors, ecosystems, methods (not prosecute). Output: threat profile, ecosystem map, behavioural analysis. Good fit when attribution is impossible but a decision is still needed.
Evidentiary: produce legally defensible outputs for subpoenas, RFIs, litigation. Output: an evidence pack (raw artefacts, hashes, custody log, reproducibility steps) plus a narrative report. Key discipline: everything must be replicable by an opposing expert using only public tools.
Operational / Risk: support internal decisions to freeze, block, remediate, escalate. Output: risk assessment or recommendation memo, prioritised and time-bound. Watch out: operational work often converts to evidentiary later, preserve to that standard from the start.

When to use

When defining the objective at intake, classify the case into one of these types so methodology, priorities, and output expectations are set correctly.

Avoid when

Do not promise attribution certainty; attribution is probabilistic, and if it is not achievable, intelligence-level findings often still support the client’s decision.

Example

A client who “wants to know who did this” may only reach an intelligence-grade behavioural profile plus KYC choke points, not a named individual, which still enables a decision.

Six Core Investigation Questions, Translate Stakeholder Wants into Investigable Questions, Five Investigation Output Types