Cryptocurrency investigation is much like other forms of financial crime investigation. Find transactions, find accounts and tie accounts to a real person. Cryptocurrency investigations are made somewhat easier since transactions are often public on a blockchain ledger. An investigator can analyze the public blockchain to investigate all transactions from a given account (wallet address). These investigations are similar to requesting transaction information from a bank. The major difference is that you don't need to request transaction information, since it is already public. However, it may be more of a challenge to tie an account to a specific user since there is no organization controlling who makes an account.
Thank you to all of our Patrons for sponsoring DFIR Science.
Especially The Ranting Geek. Thank you so much!
Before you start with cryptocurrency investigations take a moment to understand the basics of blockchain. Each system will have its own specific features, but the underlying function of most ledger systems is the same. Most investigations focus on blockchain transactions. We introduce some basic concepts that will help when getting into more advanced cryptocurrency investigations.
00:00 Blockchain basic concepts
00:23 Blockchain transaction example
02:22 Blockchain validation
03:08 Real-world distributed ledger example
05:00 What can be saved in the blockchain?
06:08 How does cryptocurrency relate to blockchain?
07:06 Blockchain parts summary
07:31 Blockchain investigation tips
== Recommended Books ==
#DFIR #forensics #blockchain #cryptocurrency
010001000100011001010011011000110110100101100101011011100110001101100101
Help make DFIR tutorials
010100110111010101100010011100110110001101110010011010010110001001100101
This work is licensed under a Creative Commons Attribution-NonCommercial-ShareAlike 4.0 International License. Please link back to the original video. If you want to use this video for commercial purposes, please contact us first. We would love to see what you are doing and will probably allow its use.