How a finding is built
The five kinds of statement Forensia makes, what each one is allowed to mean, and how every one points back to its evidence.
#Plain languageIn plain terms
A forensic tool says many kinds of thing. "This address holds 3 ETH" is a fact read from the chain. "This looks like a pattern used in laundering" is an opinion about a shape. Mixing the two is how reports go wrong.
Every statement Forensia makes is a finding, and every finding carries a label saying what kind of statement it is. A reader should never have to guess whether they are looking at a fact, a third party's claim, or a hunch.
#How it worksHow it works
Each finding has a class, a confidence, a list of the evidence records it rests on, and where relevant the name and version of the method that produced it.
#Technical detailThe exact rules
| Class | Shown as | What it means |
|---|---|---|
observed | Observed fact | Read from the retrieved records. Not a safety assessment. |
attribution | Sourced attribution | A claim made by a named source. Not an independently verified identity. |
lead | Analytical lead | A pattern worth reviewing. Not proof of wrongdoing. |
hypothesis | Hypothesis | An explanation to test. Not an established fact. |
limitation | Coverage limit | Something this lookup could not establish. |
| Confidence | Used for |
|---|---|
observed | Statements read directly from a record. |
high, medium, low | Graded claims and patterns. |
unassessed | Limits, and anything not graded. |
A finding produced by a rule carries a methodology block: an identifier, a name, a version and the parameters used. If the rule is changed, the version changes, so two results can be compared knowing which rule produced each. Some carry a match score out of 10,000. The report prints it as a percentage with the words "This is not an empirical probability".
Linking a finding to activity
A finding may point at specific activity rows. A link is kept only when the row appears exactly once, is not conflicting, and shares at least one captured evidence record with the finding. If only some links survive, the finding says how many, for example "Activity links cover 3 of 5 supporting rows". A missing row is never replaced with a similar-looking one.
Order on the page
The Analysis view opens with a fact sheet about what you searched, then lists its findings in numbered sections that open and close. The order of the sections follows the subject: a contract leads with what stands behind it, a wallet with who it dealt with, a transaction with what its records show. A list match or a registry name for the subject sits on the fact sheet, under "Who says so". Named or listed counterparties, look-alike addresses and token label reviews sit under "Who it dealt with". Sanctions non-matches, the screening-unavailable notice and the statements that threat or ownership attribution was not assessed sit under "Lists checked", each labelled "List check". Every other finding that is not a limitation sits under "What the records show", and the remaining limitations under "Where the proof ends". Overview shows the first three under "What we found", attributions first. Each finding is one line until you open it. Once open, attributions and limitations show their full text. Their qualifiers are the point, so that text is never shortened. A section or a finding holding a list match starts open.
#LimitsWhat it does not tell you
- A class describes the kind of statement, not how serious it is. A limitation can matter more than a lead.
- High confidence in an attribution means the source is clear. It does not mean the source is right.
- New look-alike comparisons require captured source references for each member. Older saved findings can lack those links and are not silently reverified.
- The absence of a finding is not a finding. No threat label is not a clean bill of health.