Crypto leads and local files

Two kinds of evidence need extra care: cryptocurrency identifiers, which are easy to mistype and easy to over-interpret, and files, which you may not be allowed to upload anywhere. This tutorial uses the Donation address due diligence and Viral photo provenance examples (File → Templates…).

1. Check a crypto identifier

Open the Pivots tab and paste bc1qw508d6qejxtdg4y5r3zarvary0c5xw7kv8f3t4. OBSCURIQ recognizes Bitcoin address (checksum valid) and explains: a valid checksum does not show that the address was ever used or who controls it. Change one character and the value is no longer recognized as a Bitcoin address — a typo caught before it reaches your report.

For 0x followed by 40 hexadecimal characters OBSCURIQ recognizes an Ethereum address (format checked); for 0x followed by 64 characters a 0x hash (Ethereum transaction or block). Plain 64-character hex strings may be a SHA-256 file hash or a Bitcoin transaction id; the desk says so.

2. Open an explorer

Under Blockchain explorers you find Look up on mempool.space and Look up on Blockstream Explorer for Bitcoin, Look up on Etherscan and Look up on Blockscout for Ethereum. They open only when you click and send the identifier to that explorer. The opened link is recorded in the research log.

For an Ethereum transaction hash, the lookup Decode Ethereum transaction runs the usefulweb.site Transaction Decoder: method, parameters, token transfers and events of an Ethereum mainnet transaction.

Explorer labels and address activity show that funds moved, not who is behind an address. Never paste private keys, recovery phrases or passwords — OBSCURIQ never needs them.

3. Record the lead

Record in the case → Add as indicator opens the entry dialog with the type already set to Bitcoin address or Ethereum address. Add where you found it in Context and set Needs follow-up.

4. Hash and inspect a file

Open the Files tab (key 5) and choose files, or drop them anywhere on the desk. For each file OBSCURIQ shows, computed in your browser:

• Size and Recognized image format (PNG, GIF or JPEG),
• Image dimensions, and for JPEG the Camera make, Camera model, EXIF capture date, EXIF orientation and whether a GPS tag exists — coordinates are never shown,
• SHA-256, SHA-1 and SHA-512.

Files are not uploaded and not stored in the workspace.

5. Compare with a published hash

Paste a hash into Compare with a known hash. Match: the file has exactly this hash. means the bytes are identical; No match means they differ — even a re-saved photo gets a different hash. SHA-1, SHA-256 and SHA-512 are accepted.

6. Record the file

Record in the log adds a File entry with the SHA-256 as its value and size, format, dimensions and selected metadata as context. That is how a file becomes part of the case without leaving your device.

7. Optional server checks

More checks on usefulweb.site (uploads the file) offers two extra checks for files up to 8 MB: All metadata (EXIF Inspector — all EXIF, XMP and IPTC tags including GPS coordinates) and MD5 and CRC32 (Hash & HMAC Calculator). Both upload the file to the tool API, which processes and does not store it. Skip them for confidential material.

Next: Timeline, report and sharing.