What the analysis actually does
It builds a transaction graph from the victim's hashes. It clusters addresses likely controlled by one actor. It flags mixer patterns, bridge hops and the first deposit into a known exchange wallet. It outputs a signed exhibit pack: timestamps, tx lists, cluster notes. A human analyst accepts or rejects the pack before any filing.
What it does not do: guess seed phrases, "decrypt" a wallet, or promise a 24-hour cash return. Any vendor selling those claims is not running forensics.
