Blockchain forensics splits across two parties:
A blockchain analytics provider builds the dataset: making attributions about addresses and grouping addresses that share an owner. That work runs continuously, independently of any particular case.
The investigator works on top of it. Following the funds, deciding which branch to take where they mix with other funds, following them onto other blockchains, finding the point where the trail meets a regulated business and documenting the result along the way.
Our new article covers all six steps that make blockchain forensics work: