Obsidian Case-Management Workflow

Core idea

Use Obsidian, a local-first, linked-markdown knowledge base whose notes never leave your machine, as an investigation case-management system where addresses, entities, and evidence link visually in Graph View. A consistent case-folder structure, wikilinks, confidence tags, and an evidence metadata template keep the case organised and confidence explicit.

Components

• Case folder structure (e.g. CASE-2025-001):
  • Overview.md: scope, hypothesis, status
  • Addresses/: one note per wallet
  • Entities/: one note per suspect
  • Evidence/: screenshots, tx hashes
  • Timeline.md: chronological events
• Linking: use wikilinks to connect address notes to entity notes; in Graph View, clusters of linked notes reveal the investigation structure.
• Confidence tags: tag notes #confirmed vs #probable to track confidence throughout.
• Evidence metadata template (front-matter fields): address, chain, entity, confidence, first_seen, exchange_link, tags.

When to use

When managing an investigation’s notes and evidence locally and needing to visualise how addresses, entities, and evidence connect while tracking confidence.

Example

Creating an address note “0xabc…123” with metadata (chain: ethereum, confidence: probable, exchange_link: Binance, tags: [suspect, layering]), wikilinking it to an “Unknown Actor A” entity note, tagging it #probable, then viewing the cluster in Obsidian’s Graph View.

Related

Crypto Address Attribution Process, Attribution Confidence Levels, The OSINT Lifecycle