Documentation
How blockchains record activity, how funds are followed, and exactly how Forensia analyses an address or transaction. Every technique page starts in plain language and gets more technical as you read down.
Start here
- 1How to read a transaction
What each field means, which ones matter first, and the order to read them in.
5 min read - 2Following funds, one hop at a time
A method for tracing that stays honest about what each step establishes.
5 min read - 3Captured, bounded, declined
The three grades of support behind a Forensia statement, how each view marks them, and how to read a result with them.
3 min read
Concepts
How blockchains record activity and what evidence means. Start here if the vocabulary is new.
Foundations2
The vocabulary. What an address, a wallet and a ledger actually are.
Reading the chain2
How to read one transaction and the events it leaves behind.
Following value2
Tracing funds across hops, and the places a trail goes quiet.
Evidence and limits2
What a record can establish, and where on-chain proof stops.
Techniques
Exactly how Forensia analyses an address or transaction. One page per technique. Each starts in plain language and ends with the precise rules and limits.
How a lookup works9
From pasting an identifier to a sealed, checkable result.
- Reading a Free result
Start with the activity, open the details you need, and keep the limits in view.
2 min→ - Recognising what you pasted
How Forensia tells a Bitcoin address from an Ethereum one, and an address from a transaction, before it contacts any source.
2 min→ - Finding the right network
The same Ethereum-style address exists on every compatible network. This is how Forensia picks which one to show.
3 min→ - Sources, fallback and cool-downs
Which servers answer a lookup, what happens when one refuses, and how failing sources are rested.
3 min→ - Budgets and bounded lookups
Every lookup has a fixed allowance of requests, time and data. Here are the numbers and what happens when one runs out.
3 min→ - How activity is collected
Where the rows in the Activity view come from, and why they are a sample.
3 min→ - Evidence records and fingerprints
How every answer from a source is recorded and fingerprinted, and how the whole set is sealed with one digest.
3 min→ - The local evidence vault
Where raw responses are kept, how they are encrypted on your device, and what "verified" means when you check them.
2 min→ - Re-checking a result against saved responses
How Forensia re-derives what it showed you from the saved bytes, and what happens when the two disagree.
2 min→
Contract analysis7
What an address is, what code it runs, and who can change it.
- Wallet or contract
How Forensia decides whether an address is a wallet, a contract, or a wallet that has delegated its behaviour to code.
2 min→ - Verified source metadata
Where a contract's name comes from, what "verified" means, and what it does not vouch for.
3 min→ - Proxies and implementations
How Forensia finds the code an upgradeable contract actually runs, and how sure it is.
2 min→ - Counting functions in bytecode
A rough estimate of how many functions an unverified contract exposes, and why it is only a lead.
2 min→ - Who created a contract
How contract creation is read from a transaction, including contracts created by other contracts.
2 min→ - Ownership, upgrade and role events
How Forensia builds a timeline of control changes on a contract, and how much history it actually covers.
2 min→ - Code at the time of a transaction
How Forensia records what code a contract held when a transaction ran, and why the timing matters.
3 min→
Transaction analysis7
Whether a transaction succeeded, what ran inside it, and what it changed.
- Did the transaction succeed
How success or failure is established from a receipt, and the five grades of certainty a record can carry.
3 min→ - Reading token transfers
How token movements are decoded from a transaction's event logs, and why an event is not the same as a balance change.
2 min→ - What ran inside a transaction
How a transaction's internal calls are rebuilt into an ordered list, and how to read the values on them.
3 min→ - Why a call failed
Telling apart a call that hit its own error from one that was undone because something above it failed.
2 min→ - What a transaction changed
How the before-and-after state of the accounts a transaction touched is captured, and how tightly it is pinned down.
2 min→ - Approvals and permissions
How Forensia reads token approvals, spots an approval followed by a transfer, and avoids claiming the approval was used.
3 min→ - Recognising a wrap or unwrap
The one protocol action Forensia names outright, and why it refuses to name anything it cannot match exactly.
2 min→
Tracing value8
Following ETH and tokens onward, across bridges, and the patterns worth a second look.
- Following ETH onward
How Forensia finds what a recipient did next with native currency, one bounded step at a time.
3 min→ - Following a token onward
How Forensia finds later transfers of the same token by the same recipient, and why it refuses partial answers.
2 min→ - Linking records you already have
How Forensia builds a short trail out of the records in one result, without making a single new request.
2 min→ - What counts as later
The rules Forensia uses to decide one record came after another, and what it refuses when the order is unclear.
2 min→ - Fan-out and rapid forwarding
Two shapes in a wallet's activity that Forensia flags for review, with the exact thresholds, and why neither is an accusation.
2 min→ - Spotting a bridge crossing
Read a bridge's source-side message fields without assuming delivery on another network.
2 min→ - Matching an Across bridge transfer
How Forensia finds the other half of an Across deposit between Ethereum and Base, and how strict the match is.
4 min→ - Saved traces and recovery
How multi-step traces are stored in your browser so an interruption never loses work or quietly retries.
3 min→
Bitcoin analysis8
Reading coins, change, shared transactions and spend chains.
- Reading a Bitcoin address or transaction
What Forensia fetches for Bitcoin, how balances and fees are worked out, and how much history one lookup covers.
3 min→ - Which output is the change
How Forensia guesses which output of a payment went back to the sender, why it needs agreement between rules, and when it stays silent.
2 min→ - Structural traits of a transaction
The construction details Forensia reads off a Bitcoin transaction, stated exactly as the checks are implemented.
2 min→ - CoinJoin and equal-output shapes
How Forensia recognises transactions built by several people together, and what it refuses to conclude from them.
2 min→ - Peel chains
A pattern where one large coin is spent again and again with a small amount shaved off each time, and how Forensia detects it.
2 min→ - Following Bitcoin spends
The two ways Forensia follows Bitcoin forward and backward: an automatic largest-branch path and a manual step-by-step check.
3 min→ - Which input paid which output
Why that question has no single answer in Bitcoin, and the three accounting assumptions Forensia shows side by side.
3 min→ - Why addresses are not grouped
The most common Bitcoin tracing technique is one Forensia deliberately does not apply. Here is what it is and why.
2 min→
Screening and labels7
Published lists, contract names and the tricks that make an address look like something it is not.
- How a finding is built
The five kinds of statement Forensia makes, what each one is allowed to mean, and how every one points back to its evidence.
3 min→ - Sanctions list screening
How addresses are checked against the U.S. Treasury sanctions list, how fresh the list is kept, and what a non-match does and does not mean.
2 min→ - Reported phishing addresses
How Forensia flags addresses that a security project has reported as phishing-related, and why it is labelled as their report.
2 min→ - The public contract registry
Where the contract names in a result come from, how narrow the list is on purpose, and how matching works.
2 min→ - Look-alike addresses
Compare similar address text and inspect where it appeared, without assuming an attack occurred.
2 min→ - Token names you cannot trust
Why a token's name and symbol prove nothing, how Forensia flags misleading ones, and how NFTs are identified instead.
2 min→ - Privacy pool contracts
How Forensia recognises a mixing contract, by name and by behaviour, and why it never links a deposit to a withdrawal.
2 min→
Graph, comparison and reports3
Reading the map, comparing snapshots, and keeping a record.
- The connection graph
What a node and an edge mean on the graph, how grouping and layouts work, and how paths and routes are found.
3 min→ - Comparing captures and building timelines
How two saved results are compared record by record, how timelines are ordered, and what happens when sources disagree.
4 min→ - Saving a result and exporting a report
Where saved investigations live, what is checked when one is opened or imported, and what the Markdown report contains.
4 min→
Reference
How Forensia itself works: its method and what each network covers.