EVIDENCE-FIRST POLICY / V1
A boundary between what the chain shows and what an investigator believes.
Forensia is an investigative aid, not an oracle, identity broker, sanctions engine, or finding of criminality. Every result should remain reproducible, source-linked, and open to contradiction.
ANALYTICAL LANGUAGE
Five evidence classes
Directly returned by a named source and preserved with a SHA-256 digest.
An identity claim backed by a citable public or authorized source.
A reproducible signal worth pursuing; it is not yet a conclusion.
An analyst proposition that must list supporting and contradicting evidence.
A boundary that changes how a reasonable reader should interpret the result.
CURRENT COVERAGE
What live mode does
- Reads the reviewed keyed provider for each enabled EVM network, falling back to keyless public endpoints when that provider refuses or rate-limits; every captured response records the host that answered.
- Where the provider offers a transfer index, retrieves the newest inbound and outbound transfers plus the earliest inbound native transfer, instead of only the most recent blocks.
- Reads Bitcoin mainnet address, UTXO, transaction, and spent-output evidence from a configurable Mempool/Esplora-compatible source.
- Captures block, balance, nonce, bytecode, storage, receipt, log, input, output, fee, and node-supported execution-trace responses.
- Hashes each raw response and derives a case-level manifest digest.
- Scans disclosed bounded windows and preserves exact snapshots in a browser-session investigation trail.
- Separates canonical approval grants and revocations, and links only matching later receipt-log outflows as same-transaction sequence leads.
- Screens the subject and its counterparties against the official OFAC SDN List and ScamSniffer's open phishing database, showing each match with its list, snapshot date and source, and showing nothing at all when a snapshot is stale.
- Labels counterparties that appear in a curated registry of publicly documented contracts, citing the protocol's own documentation.
- Flags counterparty addresses that share the first and last four hex characters, the signature of address-poisoning.
- Follows the two largest outbound native transfers exactly one hop, as a low-confidence continuation lead.
- Decodes a bridge's own deposit or message event against its verified ABI, so the identifier that appears on both networks can be checked instead of matching amounts and timing.
- Reports value split across many destinations in one window, repeated similar amounts, and long dormancy followed by a rapid outflow, each as a lead with its innocent explanations stated.
- Votes on which Bitcoin output is change using four independent heuristics, listing every vote, and records the structural traits of the wallet software that built a transaction.
- Describes a transaction in plain language from decoded rows only: who called what, what the sender parted with and received, and whether execution succeeded.
- Exports evidence-linked JSON and a deterministic Markdown report.
NON-CLAIMS
What live mode cannot prove
- A complete lifetime history from a bounded standard RPC or paginated indexer response.
- Internal calls when the selected node does not expose a trace method; the interface declares that stop instead of silently approximating it.
- Beneficial ownership, real-world identity, intent, or criminality.
- Protocol semantics from a selector or event shape alone.
- Causation, compromise, or malicious intent merely because an approval precedes a transfer.
- Safety merely because no threat label is present, or because an address is absent from a sanctions or phishing list: neither list is exhaustive.
- That the two ends of a followed transfer share an owner; value reaching an exchange, bridge or service is pooled with unrelated funds.
- Which address in a look-alike pair is the impostor, or that any payment was actually misdirected.
- That a bridge deposit was delivered, claimed, or reached the same party on the destination network.
- That value split across many destinations is illicit, related, or controlled by one party; payouts, airdrops and treasury operations share that shape.
- Who owns a Bitcoin change output, or which wallet software produced a transaction: traits narrow the candidates and nothing more.
PRIVACY SYSTEMS
Privacy is an evidence boundary, not a puzzle to hand-wave away
For Monero, shielded Zcash, mixers, and other privacy-preserving systems, the tool must report observable entry/exit evidence, anonymity-set context, timing or amount hypotheses, and uncertainty separately. A probabilistic match is never displayed as identity proof.
RESPONSIBLE USE
Human review remains mandatory
Investigators should corroborate material claims with independent records, preserve original source timestamps, document contradictory evidence, minimize personal data, follow applicable law and platform terms, and avoid publishing sensitive attribution without editorial or legal review. The software should never be used to harass, doxx, extort, or bypass access controls.