Preserve transaction exports, exchange records, email correspondence, device logs, and chronological notes describing the incident as soon as possible after discovery.
Avoid altering wallet software, factory-resetting devices, or deleting applications before evidence is captured. Screenshots should include visible timestamps and metadata where possible.
Organize evidence by date and source to support timeline reconstruction and ownership verification during confidential assessment.
Evidence quality directly affects recovery feasibility analysis; EnteleCLOS does not guarantee outcomes regardless of evidence completeness.