A simpler investigation interface, built around one search

Most blockchain tools open with a wall of tables. You paste an address and get balances, token lists, internal transactions and event logs all at once, with no indication of which part answers your question or how much of the history was actually checked.

The Forensia workspace starts from a single search field and a short written summary. The summary says what was searched, on which network, what the retrieved records show and what is still unknown. Everything more detailed is one click away and stays out of the way until you ask for it.

Nothing here needs a wallet connection or a sign-in. The workspace is read-only: it asks public data sources about an identifier and shows you what came back.

#Plain languageOne field, then a case file with five sections

Think of a paper case file. The cover sheet tells you what the file is about and what it does not cover. Behind it are the exhibits: the list of events, a diagram of who dealt with whom, the analyst notes, and at the back the raw documents everything else was drawn from.

The workspace follows that order. Overview is the cover sheet. Activity is the list of records, one at a time. Connections is the diagram. Analysis collects every finding with its evidence. Sources lists captured responses, references and unavailable checks.

You can stop at Overview and still have the main point. The other four views exist for when you need to check it.

#How it worksSearching and reading a result in the workspace

1. Paste an address or a transaction into the search field, or type a name such as USDC to pick from publicly documented contracts. You can reach the field from anywhere with the / key or Cmd/Ctrl+K.
2. Read the label next to the field before you submit. It states what the text is: EVM address, EVM transaction, Bitcoin address, Bitcoin transaction, or Incomplete with a count of the hex characters entered so far. A mixed-case address whose capitals do not match its checksum gets a warning.
3. Leave the network on Auto to have the supported EVM networks checked, or pin one from the network menu. Bitcoin identifiers always use Bitcoin.
4. Read Overview. The heading says what was found. For an address without a transfer index, a line titled How far back this looked states the block window that was scanned. A box titled What this does not tell us states the scope of the result.
5. Open Activity to read record by record, newest dated records first. Choosing a row opens that record with its amount, its execution status, the full addresses and its supporting source records.
6. Open Connections only if you want the picture. Line weight there is the number of retrieved records, never value.
7. Open Analysis for every finding, and Sources for each captured response and the list of what could not be checked.

A few details make the reading easier. If you paste a block of text that contains several identifiers, they are listed and each one runs only when you choose it. If you paste an explorer link, only the identifier is used and the link is not opened. A contract call that carried no native coin is labeled as a call with nothing attached, not as an empty incoming payment. If you look up the same subject twice in one session and the two captures retrieved different transactions, Overview says so and offers the other capture; the two are compared, never merged.

On narrow screens the layout stacks. At 760 pixels and below, amounts move under the description in activity rows, controls keep a 44 pixel touch height, search text stays at 16 pixels or more so the browser does not zoom on focus, and the graph and wide tables scroll inside their own labeled containers.

#Technical detailHow a search is classified, resolved and captured

Classifying the identifier

Classification is by shape only, and it happens before anything is sent. The server applies the same rules again and rejects anything else. The request body is limited to 4,096 bytes and carries one identifier.

Resolving the network

An EVM address does not encode its network. If you pinned a network, the lookup goes straight there. Otherwise seven configured networks are probed in parallel: Ethereum (chain 1), Base (8453), Arbitrum One (42161), Optimism (10), Polygon PoS (137), BNB Smart Chain (56) and Avalanche C-Chain (43114).

For an address, each probe is one JSON-RPC batch of eth_getBalance, eth_getTransactionCount and eth_getCode at the latest block. For a transaction hash it is a single eth_getTransactionByHash. Each probe has a 7 second timeout and a 256 KiB response limit. The address probes are then scored and the highest score wins.

Code that is an EIP-7702 delegation designation (0xef0100 followed by a 20-byte address) counts as zero code size for scoring, so a delegated wallet is ranked by its nonce or balance. A transaction probe scores 1 when the network returns the hash. If no probe scores above zero, the lookup stops with a message instead of picking a network. Every probe is kept as its own source record, shown under names such as Ethereum network check.

Bitcoin lookups use an Esplora-style API, mempool.space by default: address/{address} for the funded and spent counters and address/{address}/txs for the first page of transactions, which is at most 50 mempool and 25 confirmed records.

What a capture is

Every upstream response is recorded as a capture: the exact request, a SHA-256 of the request, the host that answered, the HTTP status, the media type and the byte counts, alongside a SHA-256 of the raw response.

{
  "schema": "chainproof.source-capture.v1",
  "transport": "json-rpc",
  "endpointHost": "<host that answered>",
  "operation": "eth_getTransactionReceipt",
  "request": "<exact request body>",
  "requestDigest": "<sha256 of request>",
  "requestBytes": 0,
  "responseBytes": 0,
  "httpStatus": 200,
  "mediaType": "application/json",
  "preservation": "sha256-manifest"
}

A JSON-RPC source record gets the ID rpc:{method}:{first 8 characters of the request digest}:{first 12 of the response digest}. The evidence digest, shown on Overview as the case file and manifest value, is the SHA-256 of a JSON list of all source records sorted by ID, each reduced to its ID, method, response digest, retrieval time, status, detail and capture. The manifest version is chainproof.evidence-manifest.v2. Changing any response, or adding or dropping one, changes the digest.

A standard lookup may make at most 128 upstream requests; the public free profile allows 48. When the budget is reached the lookup stops with an explicit budget error. If a primary RPC endpoint answers 401, 403, 429, a 5xx status or a provider refusal (JSON-RPC error -32600 or -32601), a configured fallback is tried, and the capture records which host actually answered.

How views map to the address bar

Captures are held in the memory of the browser tab only, keyed by evidence digest: up to 12 captures and 24 scroll positions. Back and Forward restore a capture only when the digest, the identifier and the network all match. Copy lookup link deliberately leaves the snapshot out, so opening that link runs a new query.

#LimitsWhat the interface does not establish

• It shows the records one lookup retrieved. It is not a lifetime history, and an empty result is a gap in what was retrieved, not proof of inactivity.
• Automatic network resolution covers the seven configured networks and reads latest state only. An address with a zero balance and only historical inbound or token activity may not be selected. The same 20-byte address on two networks is not assumed to share an owner.
• The evidence digest fingerprints what the sources returned. It does not show that a source was correct.
• A session capture is gone when the tab closes or reloads unless you use Save result. A copied lookup link is a future live query, not a frozen capture.
• A function name shown for a call, such as transfer or approve, names the function that was called. It does not show what the call did.
• The graph is bounded. Its lines count records and are not a money total; amounts in different assets are never summed.
• Nothing in any view identifies an owner, scores risk, or says whether a wallet is safe.