EVIDENT

Method

How an Evident investigation works.

A consistent seven-stage framework, applied proportionately to the matter in front of us. The method is the same whether the question comes from an individual or a legal team.

Investigation framework

How an Evident investigation works

Seven stages, applied consistently and proportionately. Each stage has a defined output, so you always know what has been established and what has not.

  1. 01

    Define

    Establish the investigative question and scope.

  2. 02

    Discover

    Identify relevant wallets, assets, transactions and entities.

  3. 03

    Reconstruct

    Follow the movement of digital assets.

  4. 04

    Attribute

    Assess connections between wallets, entities and services.

  5. 05

    Corroborate

    Test findings against independent evidence.

  6. 06

    Evidence

    Distinguish verified facts, supported inference and unknowns.

  7. 07

    Action

    Translate the findings into clear next steps.

  8. Each stage produces a recorded output, so findings can be traced back to the evidence that supports them.

Evidence discipline

Fact, inference, unknown.

Every finding is placed in one of three categories, and the category is stated in writing. Verified fact is independently reproducible. Supported inference is reasoned and graded. Unknown is recorded rather than quietly omitted.

This is what makes our findings defensible under scrutiny, and what stops an investigation from overstating its own conclusions.

Investigation report

CASE EVD-0001

Illustrative example

Executive findings

Assets moved from a self-hosted wallet through four intermediary addresses before reaching an exchange deposit address. Movement is consistent with deliberate layering.

Asset flowWallet analysisEntity attribution

Transaction timeline

  • 12 MarOutbound transfer, self-hosted wallet
  • 14 MarSplit across four addresses
  • 19 MarBridge to secondary chain
  • 02 AprDeposit to exchange service

Evidence register

Confidence

  • EV-01Transaction hash set (14)Verified
  • EV-02Address cluster, common controlProbable
  • EV-03Exchange deposit attributionSupported
  • EV-04Beneficial ownership of clusterUnknown

Investigator findings distinguish verified facts, supported inference and unknowns. Prepared as defensible investigative intelligence designed for professional and legal use.

Scope and proportionality

We tell you when an investigation isn't worth it.

Not every matter justifies a full investigation. Where the available starting points are too thin, or the likely cost outweighs what can realistically be established, we say so at the outset rather than after the invoice.

Specialist technology

We use professional blockchain analysis tooling to accelerate reconstruction across chains and services.

Human judgement

Tools surface data. Deciding which movement matters, and what it means, is investigative work.

Clear reporting

Findings are written to be read by a client and scrutinised by a professional adviser.

Discuss a case

Have a case that needs investigating?

Tell us briefly what you're dealing with. We'll arrange an initial confidential discussion to understand the issue and determine whether Evident can help.

Start a Case Assessment Discuss a CaseHow We Investigate

Prefer to write to us directly? Send an enquiry.

Until we confirm a secure channel, please don't share private keys, seed phrases, passwords or detailed evidence. Tell us about the issue in general terms first, and we will arrange a secure route for anything sensitive.