skills/c4-fake-trading-app-investigator/assets/investigation-report-template.md

# Investigation report: [case reference]

> Draft for supervisory and legal review

## Document control

[Version, author/role, checkpoint time/timezone, classification, reviewers]

## Executive summary

[Allegation, scope, verified loss, leading assessment, confidence, major limitations, readiness status]

## Authority, scope, and questions

[Authority basis, jurisdiction, inclusions/exclusions, questions examined]

## Method

[Evidence handling, tools/sources, dates, chain/network scope, legal verification date]

## Evidence and provenance

[Evidence register summary; originals and derived artifacts; integrity checks; exceptions]

## Chronology

[Evidence-cited event timeline]

## Scheme reconstruction

[Contact, onboarding, representations, reliance, deposits, displayed activity, withdrawal obstruction, further demands]

## Financial analysis

[Fiat and crypto ledgers, reconciled totals, valuation basis, refunds/recoveries, discrepancies]

## Digital infrastructure and application findings

[Domains, DNS/IP, app/package, accounts, artifacts, observed dates, attribution limitations]

## Blockchain findings

[Validated networks/transactions, wallet activity, fund-flow scope, service-label candidates, off-chain gaps]

## Entities and attribution assessment

[Claimed identities versus verified links; evidence for/against control; confidence and alternatives]

## Hypotheses and findings

[For each: finding ID, type, statement, evidence IDs, confidence/rationale, contrary evidence]

## Candidate legal mapping

[Element matrix with official URLs and verification date. Candidate — verify with IO/legal reviewer.]

## Actions completed and recommended

[Action, purpose, status, dependency, owner, due date, proportionality/authority note]

## Contradictions, limitations, and open questions

[Unresolved conflicts, unavailable sources, methodological limits, further work]

## Conclusion and readiness

[Answer scoped questions without overstating; state readiness classification and rationale]

## Exhibit index

[Exhibit/evidence ID, description, source, original/derived, hash, storage reference, sensitivity]