Capture primary identifiers
Record the complete transaction hash, blockchain network, sending and receiving addresses, token contract where relevant, amount and block time.
Keep source files intact
Retain original exports, emails and screenshots. Work from copies and record when each item was collected and by whom.
Add context separately
Distinguish facts visible on-chain from descriptions provided by a person or service. Do not label an address owner without reliable supporting evidence.
Use a consistent case structure
Group evidence by event and date, use descriptive filenames and keep notes linked to the source item they explain.
Record provenance for every item
For each screenshot, export or email, note where it came from, who collected it and when. Preserve the original file name and avoid editing the original. If you add arrows, highlights or translations, create a separate working copy and keep the untouched source beside it. This makes it easier for another reviewer to understand what was observed and what was added later.
Use timestamps consistently
Services may display local time while blockchain explorers usually use UTC. Record the displayed time, its time zone and the corresponding UTC value when possible. Avoid replacing an original timestamp with an estimate. A clear conversion note helps align account logs, emails, device alerts and on-chain events without implying false precision.
Create an evidence index
Assign a simple reference to every item and maintain a list containing its description, date, source and file location. Link each statement in the incident timeline to the evidence that supports it. Mark unanswered questions explicitly. A small, well-indexed collection is more useful than a large folder of repeated screenshots with no context.