Specimen evidence package

1. Instructions and scope

1.1 I was instructed on [date] by [instructing firm] on behalf of their client (“the Claimant”) to establish, so far as the public ledger permits, the movement of digital assets transferred by the Claimant on [date] and to identify the services at which those assets came to rest.

1.2 My instructions were limited to on-chain analysis. I was not instructed to identify any individual, to contact any third party, or to advise on the merits of any claim.

1.3 This report addresses: (a) the path taken by the assets; (b) the points at which the assets were commingled with assets of unknown origin; (c) the attribution of terminal deposit addresses to identifiable services; and (d) the limitations of the foregoing.

2. Summary of findings

2.1 On [date], 412,000 USDT (TRC-20) was transferred from an address controlled by the Claimant to an address I refer to as R1.

2.2 The assets moved through six intermediate addresses over approximately 31 hours before arriving at two deposit addresses, T1 and T2.

2.3 T1 and T2 are attributed to two centralised exchanges, identified at paragraphs 6.3 and 6.4 below. The basis of each attribution, and my confidence in it, is stated.

2.4 At one point in the chain (paragraph 5.7) the Claimant’s assets were commingled with assets of unknown origin. From that point the connection between the Claimant’s funds and the terminal deposits is a matter of proportion and inference rather than direct correspondence. Balances before, during and after that event are set out at Schedule C so that the position can be assessed.

2.5 Approximately 6% of the traced value was converted through a decentralised swap service to a different asset and is addressed separately at paragraph 5.9.

3. Method

3.1 Analysis was conducted using named analytics platform, version, licence and, independently, by direct query of public ledger data via [node / explorer], in order that platform-derived conclusions could be checked against primary source data.

3.2 All ledger data was captured between [date] and [date]. Capture times are recorded in Schedule A. Blockchain data is append-only and the transactions described are final and immutable; however, attribution data held by third-party platforms is subject to revision, and the attributions at section 6 reflect the position on the query dates stated.

3.3 Where I have relied on address clustering, I identify the heuristic relied upon and treat the resulting conclusion as an inference. Where I have relied on attribution supplied by a commercial platform, I say so and do not present it as my own independent determination.

3.4 I have distinguished throughout between observation (what the ledger records) and inference (what I conclude from it). Findings are labelled accordingly.

4. Source data and integrity

4.1 Primary data exports are listed at Schedule A with, for each: source, query parameters, capture timestamp (UTC), file name, and SHA-256 hash.

4.2 Original exports are retained unmodified. Working analysis is maintained separately. Both are available for inspection.

4.3 Materials received from the Claimant are listed at Schedule B with date of receipt and method of transfer.

5. Findings

Format illustrated; a real report would run to the full chain.

6. Attribution

6.1 Attribution identifies the service that controls a deposit address. It does not identify any individual. Identification of an account holder is a matter for the service, and typically requires an order of the court.

6.2 Deposit addresses were attributed on [date] using [platform]. Where possible I sought a second, independent indicator; these are stated below.

6.3 T1 (TX5v…3hK9) — attributed by [platform] to [Exchange A]. Query date [date]. Secondary indicator: the address appears in [Exchange A]’s published deposit address documentation / exhibits a deposit-consolidation pattern consistent with that service. Confidence: high.

6.4 T2 (TC8n…1jR4) — attributed by [platform] to [Exchange B]. Query date [date]. No independent secondary indicator was available. Confidence: moderate. This attribution rests on a single commercial source and should be treated accordingly.

6.5 I make no finding as to which corporate entity within either exchange’s group holds the relevant records, or as to the appropriate respondent to any application. Those are matters for the instructing solicitor.

7. Timing data for record identification

7.1 Deposits to T1 and T2 are set out at Schedule D with block timestamps in UTC and block heights.

7.2 A service’s internal crediting time may differ from block timestamp. Where a search of the service’s records is to be requested, I would suggest a window of not less than ±2 hours around the times stated.

8. Limitations

8.1 This report addresses the public ledger only. It does not establish who controls any address.

8.2 The commingling described at 5.7 limits what can be asserted about the terminal deposits as a matter of identifiable property.

8.3 Attributions reflect third-party data as at the query dates stated and are subject to revision.

8.4 Address clustering relies on heuristics that are strong but not conclusive. Where relied upon, the heuristic is identified.

8.5 The position described is as at the capture dates. Assets may since have moved.

8.6 I have not been provided with, and have not sought, any material from any party other than the Claimant.

9. Declaration

9.1 I have set out in this report all matters within my knowledge which I consider relevant to the conclusions expressed, including matters which do not support those conclusions.

9.2 I have distinguished between fact and inference and have stated the basis of each inference.

9.3 Interest in the outcome: my fee for this matter is contingent upon funds being recovered by the Claimant, at [X]% of sums received. I have disclosed this so that the reader may take it into account when weighing my conclusions.

9.4 I am aware that this report may be relied upon in proceedings and may be disclosed to other parties.