Process
A straight path through careful steps.
Cases keep research, artifacts, authorizations, jobs, and recovery actions together — so operators always know what was permitted and when.
-
01
Create or open a case
Give the investigation a clear title. Avoid putting seeds, passwords, or private keys in the name. Share the case only with people who need read or write access.
-
02
Inspect and encrypt the backup
Upload a supported wallet backup under intake policy. Review the inspection panel: format ID, integrity, feasibility, and whether fund recovery is claimed or inspection-only.
-
03
Record owner authorization
Authorize a specific artifact for a limited window with a documentation reference and an ownership confirmation. Revocation cancels dependent queued work.
-
04
Choose Option B or verification
Option B — if you hold the password, calculate and export keys directly from the authorized artifact. Verification job — queue bounded candidates for a sealed match when you need Option A tooling.
-
05
Discover before you move
Scan gap windows and accounts for funded or previously used addresses. Confirm network and token selection. Watch-xpub discoveries stop at addresses.
-
06
Sweep or fee-bump when gated
Send native or token value to a destination you control, or replace a stuck transaction. Confirm broadcast results on an explorer before treating funds as final.
-
07
Report and retain evidence
Download the sanitized case report for stakeholders who should not see secrets. Keep signed audit checkpoints off-host. Adjust artifact retention or delete encrypted material when finished.
Roles along the path
- Owner — workspace policy, providers, backup plan, feature visibility.
- Admin — users, roles, broad case administration.
- Operator — day-to-day intake, research, and recovery on permitted cases.
- Auditor — read-only review of cases and audit events; mutations blocked.
Research alongside recovery
Operators can research public addresses and transactions at any time the research UI is available. Live mode still respects provider approval. Recovery actions never borrow a research session’s public lookup as proof of ownership.
Workspace