A forensic affidavit for crypto has to do two things: show probable cause, and prove a verifiable chain of custody that links addresses and accounts to alleged illicit proceeds. Below we give you a checklist, the technical evidence to record, annotated public excerpts, and authentication steps. We anchor it in SWGDE guidance and Federal Rule of Evidence 902, and we write it as Recovera Forensics.
TL;DR:
- List complete wallet and account identifiers, place the key transfer near the narrative’s start, and tie every factual claim to an exhibit and lawful collection method.
- Record addresses, transaction IDs, block heights, time zones, hash algorithms, tool versions, acquisition steps, and transfers in sequence so another examiner can reproduce the analysis.
- Treat address clusters and repeated deposits as control indicators, not proof of identity; match exchange assigned addresses, timestamps, amounts, and account records.
- Use a warrant affidavit to establish probable cause, but prepare a separate Rule 902(13) or 902(14) certification, hash comparison, and advance notice for trial admission.
- When a device is powered and unlocked, capture volatile data first and keep it unlocked; log each action, witnesses, timestamps, and hashes.
Table of Contents
- 1. What to include in a forensic affidavit for cryptocurrency
- 2. Technical evidence to state in the affidavit
- 3. Turning blockchain analysis into a narrative of control and attribution
- 4. Annotated examples from public affidavits
- 5. Building Attachment A and transaction exhibits
- 6. Authenticating electronic evidence under Rule 902(13) and 902(14)
- 7. Live acquisition and the order of volatility
- 8. How we prepare court-ready affidavits and exhibits
- 9. How we can help with affidavit preparation
- FAQ
- Sources
1. What to include in a forensic affidavit for cryptocurrency
Magistrates read these affidavits for one thing: a clear path from the facts to the property or place to be seized. The checklist below follows that path. Public DOJ affidavits use the same skeleton: affiant introduction and qualifications, background on virtual currency, a transaction-by-transaction factual narrative, and attachments listing the accounts or addresses to be seized.
- Affiant identity and expertise. State training, certifications and years of experience in a few plain sentences. Name the specific work that matters here, such as blockchain tracing or digital device acquisition. If an expert will later testify, our guide on how to vet crypto expert testimony explains what courts expect.
- Property to be seized. List accounts, exchange user IDs and wallet addresses exactly as they appear on the platform or chain. Redact personal identifiers where the court’s rules require it, but never truncate an address you are asking to seize.
- A chronological narrative. Walk through transactions in order, with dates, amounts, asset type and the addresses on each side. Each paragraph should answer one question: what moved, from where, to where, and why it matters to the offense.
- An exhibit list. Say what each exhibit contains: a blockchain export, exchange records, screenshots, account metadata. Tie every exhibit to a specific paragraph of the narrative.
- Lawful collection statements. Note whether data came from a warrant, a subpoena, a records request or consent. A magistrate wants to see that nothing in the chain was obtained improperly.
One discipline ties all five together: every factual sentence should be traceable to an exhibit, and every exhibit should be referenced at least once. Affidavits that bury the key transfer in a paragraph of background lose readers quickly. Put the transfer that connects the subject to the funds near the top of the narrative, then fill in the supporting detail beneath it.
Keep the tone factual. Describe what the records show, not what the affiant feels about the suspect. If you are unsure whether a detail belongs, ask whether a skeptical reviewer would miss it if it were gone. If the answer is yes, keep it.
2. Technical evidence to state in the affidavit
An affidavit becomes persuasive when another examiner could reproduce your work from it alone. SWGDE’s model procedures say the same thing: examinations should run on forensic duplicates where possible, hash values should be computed to verify them, and procedures should be documented in enough detail for another competent examiner to repeat them.
Record and report the following:
- Identifiers in full. Complete addresses, transaction IDs (TXIDs) and block heights. Never abbreviate an address in the body, even if a table later uses shortened labels.
- Precise timestamps with time zones. Blockchain explorers often show UTC, exchanges may show local time, and a mismatch can look like an error in cross-examination. State the zone every time.
- Hash values with the algorithm named. Compute and record cryptographic hashes for forensic images and exported files, say which algorithm you used (for example, SHA-256), and note where the hash appears in the exhibit.
- Tools and exact versions. List imaging software, blockchain explorers and tracing tools by name and version number, along with the date each was run.
- Acquisition method and operator. Say whether you took a live RAM capture, a disk image or an API export. Record device identifiers, the operator’s name and the acquisition time.
- The transaction chain, step by step. Show the inputs, each intermediary address or cluster, and the final exchange deposit address, in order.
Our guide to crypto chain of custody covers how these records fit into a custody log.
Why the care? Cryptocurrency evidence is fragile. SWGDE’s acquisition guidance stresses that it is time-sensitive, and that examiners should compute NIST-approved hashes and document each acquisition step to preserve integrity.
Why it matters: SWGDE’s guidance says cryptocurrency evidence is fragile and time-sensitive, so an undocumented step can cost you the exhibit. Write down what you did while you are doing it.
3. Turning blockchain analysis into a narrative of control and attribution
Courts do not need the whole graph. They need a short, careful explanation of why an address belongs to a person or account. Attribution of control is the central question in many crypto cases, and the affidavit has to answer it in plain language.
Phrases courts tend to find persuasive describe observable patterns:
- Cluster. Addresses that move funds together, for example by being spent as inputs in the same transaction, are described as a cluster the affiant believes is controlled by one entity.
- Consolidated deposits. Several addresses sending to one destination within a short window supports a control inference.
- Exchange deposit pattern. Repeated transfers to the same deposit address, matched to an account’s own login or deposit records, tie on-chain behavior to a named account.
Exchange records do the heavy lifting here. A deposit address assigned to an account, plus a timestamp and amount that line up with an on-chain transfer, connects the blockchain to a person. Describe that evidence directly: what the exchange produced, under what process, and which fields you matched. Our primer on blockchain forensics explains how tracing becomes a documented narrative.
Be honest about third-party tools. If results come from a commercial tracing service, present the output, state the methodology in a sentence or two, and avoid claiming the tool proves identity. Legal analysts of crypto fraud disputes, such as the Cryptoverse Legal Consultancy overview of global cryptocurrency fraud, likewise stress that the legal framing matters as much as the trace.
Practical phrasing tips:
- Use probable-cause qualifiers: “there is probable cause to believe,” “the pattern is consistent with.”
- Link each fact to a statutory element, such as proceeds traceability for money laundering.
- Say what you did not determine. A short limitation sentence builds credibility.
4. Annotated examples from public affidavits
Real affidavits show how this works. We summarize and quote short pieces here; read the originals for full context.
Affiant introduction. In the redacted DOJ affidavit in the Paxful matter, the agent opens with a statement of employment, training and the investigative focus, then moves to a background section on virtual currency. The structure matters: credentials come first, so the reader knows why to trust the technical explanation that follows.
Transaction timeline. In the agent affidavit filed in the Silk Road litigation, the narrative combines on-chain analysis, recovered wallet files and exchange or account records to trace and attribute large Bitcoin transfers, linking seized artifacts to the suspect. The paragraphs read as a sequence: this wallet, then this transfer, then this deposit.
The affiant traces the transfers in order and ties the seized digital artifacts to the subject through the recovered wallet records and account records.
This is our paraphrase of the structure, not a quotation.
Attachment A. The Paxful affidavit’s attachments list the exchange user IDs and subject accounts to be seized. Annotation: each entry is a precise identifier, which lets the order be executed without guesswork.
How the excerpts map to the checklist:
- Credentials come first, which meets the affiant item.
- The ordered transfer narrative meets the chronology item.
- Itemized accounts in the attachments meet the property item.
- References to recovered files and exchange records meet the exhibit and lawful-collection items.
Use them as models for structure, not as text to copy. Every case needs its own facts.
5. Building Attachment A and transaction exhibits
An exhibit helps only if a reader can search it, cite it and check it. Assemble transaction exhibits this way:
- Start with an ordered transaction list. Number each transfer and give date and time with zone, TXID, sending and receiving addresses, and amount.
- Add a visual graph and a CSV export. Include the graph as a PNG for readability and a CSV with clear column headers for anyone who wants to sort or verify.
- Label and paginate everything. Use consistent exhibit labels and page numbers so the affidavit can cite the relevant exhibit and page.
- Embed hash values and acquisition logs. Put the hash for each exported file and the acquisition log inside or directly behind the exhibit it supports.
- Pair exchange records with the on-chain data. Place certified printouts beside the blockchain evidence they match, with a short note on which fields correspond.
Our guide to digital evidence preservation covers the preservation side of this work.
6. Authenticating electronic evidence under Rule 902(13) and 902(14)
Rule 902(13) and 902(14) allow electronic evidence to authenticate itself through a certification, without a live custodian at trial. Under 902(13), certified records generated by an electronic process qualify; 902(14) covers certified data copied from an electronic device. Both borrow their procedural notice requirements from Rule 902(11) and rely on hash values and a qualified person’s certification.
- Hash comparison. The certifier states that the copy’s hash matches the original’s, which shows the copy is identical.
- Qualified person. The certification comes from someone with knowledge of the process, and it should describe that process.
- Notice. Give the opposing party written notice and make the certification available before you offer it. File early so objections surface before trial.
- Affidavit versus certification. A warrant affidavit supports probable cause at the investigative stage. A 902 certification supports admissibility at trial. Use the affidavit to get the evidence and the certification to get it admitted. Our guide on admitting blockchain evidence in court walks through the steps.
Key point: Rule 902(13) and 902(14) authorize self-authentication through certification, with hash values as the typical technical proof.
7. Live acquisition and the order of volatility
Sometimes you cannot wait for a lab. If a device is on and unlocked, keys and session data may vanish when power is lost. SWGDE’s tech notes on cryptocurrency tell examiners to identify wallets, seed phrases, hardware wallets and app data, and to keep an unlocked mobile device unlocked so triage can happen.
Capture the most volatile items first: running processes, network connections, RAM, encryption keys and open wallet sessions. Follow agency policy when handling seed phrases or hardware wallets, as the updated SWGDE notes emphasize. Log every action with a timestamp, name any witnesses, and compute hashes as you go.
8. How we prepare court-ready affidavits and exhibits
Our focus is reproducible technical exhibits plus a narrative that ties each fact to a legal element. We prepare technical reports so counsel is not left to translate raw blockchain data. Each deliverable is written so another examiner could repeat our steps. If you are counsel or a victim who needs a court-ready forensic report, reach us through our contact page.
— cristian
9. How we can help with affidavit preparation
If you need the technical work behind an affidavit, we can take it on. Our crypto scam investigation and evidence preservation services turn a loss into documentation a court can use.
- Forensic acquisition and preservation of digital evidence
- Blockchain tracing with a documented methodology
- Technical reports for counsel
- Technical reports counsel can attach to filings
Our deliverables map directly to the checklist above. Request a case intake, or use our 24–72 hour investigator checklist to organize what you have before we talk.
FAQ
What must a crypto forensic affidavit prove?
It must show probable cause and a clear link between the evidence and the property to be seized. It should also document how the evidence was collected and preserved. Public DOJ affidavits follow this pattern, as in the redacted Paxful affidavit.
Do I need Rule 902 certifications if I have an affidavit?
Usually yes, if you plan to offer the evidence at trial. An affidavit supports a warrant or motion, while a 902(13) or 902(14) certification lets electronic records authenticate themselves at trial, subject to notice.
Why do hash values matter in crypto evidence?
A hash shows that a copy matches the original. SWGDE’s procedures call for computing hash values to verify forensic duplicates, and certifications rely on them as proof of integrity.
Should I use live acquisition for crypto devices?
When a device is on and unlocked, often yes. Volatile keys and session data can disappear on shutdown, and SWGDE guidance supports triage on unlocked devices with full documentation.
How should I present evidence that spans several exchanges?
Structure it so another authority can follow it without you. Practitioners note that many crypto scams span multiple exchanges and jurisdictions, so evidence should be prepared for inter-agency parsing. An ordered transaction list and clear labels do most of the work.
Sources
- Case No. 24-mj-08113-ADM Filed Under Seal
- Self-Authentication of Electronic Evidence: New Rules 902(13)-(14) Gregory P. Joseph
