An investigation that holds together.
Cases, stages, evidence, findings, messages and reports in one structure — so an investigation can be handed to a colleague, reviewed by a supervisor, or read by a court without being reassembled from someone's memory.
What is investigation case management?
Case management holds an investigation together: nine defined states from intake to closure, the evidence attached at each, investigator notes, and the report generated from them. Every state change is logged and attributable, which is what allows a finding to be defended later rather than merely asserted.
Nine states, in order, with nothing hidden between them.
| Stage | Owner | What it means |
|---|---|---|
| Submitted | Customer | Case created from intake. Nothing has been assessed yet. |
| Under review | Triage | An investigator is reading the submission. |
| Triage complete | Triage | A judgement exists on whether blockchain analysis can help. |
| Awaiting approval | Customer | Scope and pricing are with the customer. No work proceeds without approval. |
| Investigation active | Investigator | Tracing, clustering, entity and exposure analysis under way. |
| Evidence analysis | Investigator | Findings are being tested against the evidence collected. |
| Report preparation | Investigator | The report is being written and reviewed. |
| Report complete | Customer | The report is available in the evidence vault. |
| Closed | Both | The engagement has ended. Records are retained per policy. |
What a case holds.
Case record
Identifier, status, assigned investigator, dates, chains, assets and estimated value.
Fund flow
The graph built for this case, with the addresses and hops it covers.
Timeline
Every stage change, every action, every actor, timestamped.
Evidence
Uploads and generated artefacts, versioned, with integrity metadata.
Findings
Separated into fact, analytical interpretation and unverified information.
Messages
Case-scoped correspondence with attachments, retained with the case.
The habit that makes a report survive scrutiny.
Findings in a ChainwatchCrypto case are typed. A reader always knows which category they are reading.
Directly observable on a public ledger, with a transaction reference anybody can verify independently.
An inference drawn from observed data by a stated method, with the method named and its confidence recorded.
Supplied by a party or a third source and not independently confirmed. Retained because it is useful, labelled because it is not established.
The single most common failure in investigative reporting is a plausible inference quoted downstream as an established fact. Typing every finding at the point it is written is the only durable defence against that.