Investigative Procedures Flashcards

An investigator identifies that stolen funds landed in a deposit address at a U.S.-based exchange. What is the best first legal step to keep the account records from being deleted while formal process is prepared?

Answer: Send a preservation request under 18 U.S.C. § 2703(f)

A 2703(f) preservation letter obligates the provider to preserve existing records for 90 days, renewable, pending legal process.

During a search warrant, agents find a sheet of paper with 24 English words written on it. How should this item be treated?

Answer: As a potential BIP-39 seed phrase giving full control of the wallet

A 12- or 24-word mnemonic can regenerate a wallet's private keys, so it must be secured and documented as high-value evidence.

Why should investigators record transaction timestamps in UTC when documenting blockchain activity?

Answer: Block timestamps are recorded in UTC, avoiding time-zone conversion errors in reports

Using UTC aligns report times with on-chain data and exchange logs, preventing discrepancies across jurisdictions.

A suspect's funds were converted to USDT on Ethereum and sit in a self-hosted wallet. Which action may allow investigators to freeze them quickly?

Answer: Request that Tether blacklist the address through law enforcement channels

Centralized stablecoin issuers like Tether and Circle can freeze tokens at specific addresses upon law enforcement request.

Which practice best preserves chain of custody when seizing cryptocurrency from a suspect's wallet?

Answer: Transfer funds to a government-controlled wallet, documenting TXIDs, witnesses, and times

Moving assets to an agency-controlled wallet with full documentation prevents dissipation and creates a verifiable custody record.

An exchange responds that it requires a different type of legal process to disclose stored transaction content and account details. Under the Stored Communications Act, which process generally compels basic subscriber information?

Answer: A subpoena

Basic subscriber records such as name, address, and payment method can generally be obtained with a subpoena under 18 U.S.C. § 2703(c)(2).

When reporting a blockchain tracing finding, what should an investigator include so another analyst can independently verify it?

Answer: Transaction hashes, addresses, block heights, and the heuristics applied

Reproducible reports cite exact on-chain identifiers and the methodology used so findings can be validated.