What is the overall investigator checklist for money, payments and digital assets?¶

Define the question, preserve exact identifiers, reconstruct value movement, attribute each access route cautiously and report only conclusions supported by the combined evidence.

Build the transaction and access record¶

Identify provider, accounts, instruments, merchants, assets and networks. Preserve references, amounts, currencies, fees, statuses, timestamp meaning, counterparties, addresses, hashes and token contracts. Capture volatile endpoints, sessions, authentication, communications, browser and cloud artefacts before intervention.

Keep the evidential propositions separate¶

Distinguish holder, account, instrument, endpoint, operator, authorisation, informed consent, owner and beneficiary. Test sharing, compromise, remote control and deception. Trace internal transfers, reversals, withdrawals, conversions, bridges and onward recipients proportionately.

Use precise provider requests, document evidence-changing actions and seek specialist support for complexity, live assets, recovery or legal risk. State fact, inference, uncertainty and limits explicitly.