Visual evidence for courts

Judges and juries remember the flow chart long after they have forgotten the transaction table. That makes figures the most persuasive part of a crypto case, and the part most likely to be attacked: a chart that shows more certainty than the report, or that cannot be traced back to the data, can damage the credibility of everything else the expert says. This lesson covers how to turn analytical visuals into exhibits a court can follow, check and rely on.

The design craft is in the IDFE-BA lesson Visualizing flows and graphs: choosing between Sankey diagrams, flow graphs, timelines and cluster maps, conserving value, layered layouts, solid arrows for observed transfers and dashed arrows for inferences, and accessibility targets. Everything there applies. What follows is the layer the courtroom adds.

Who is looking, and on what

A court figure has several audiences at once. The judge or panel needs to understand it quickly and may return to it while deliberating. Lay decision-makers, where a system uses them, have no background in blockchains. The opposing expert will check every number. Each of them may meet the figure in a different medium:

• printed bundles, often photocopied in grayscale and sometimes reduced to fit a page;
• projection in a courtroom, viewed from several meters away under poor lighting;
• shared screens in hearings held partly or wholly by video link;
• electronic case files opened on whatever device the reader has.

Design for the worst of these. A figure that only works in color, on a large monitor, with a mouse to zoom, will fail in at least one of them. Practical tests: print it in grayscale at the size it will appear in the bundle; view it projected from the back of a room; check that every label is readable without zooming.

A figure is an exhibit

In court, a figure is part of the evidence, or at least a summary of it that the court relies on. It needs the same provenance as any other item:

• a unique identifier and version (Figure 4, version 2) that matches the report;
• the data cut-off and the source data it was generated from;
• the appendix rows that support every edge, amount and date;
• the author and the tool used to produce it.

Whether a chart counts as evidence in its own right or only as an aid to understanding the underlying evidence varies between systems; either way, the safe practice is to treat it as an exhibit. Generate figures from data, not by drawing them, and keep the input file under hash so the opposing expert can regenerate the figure and get the same picture. A short manifest kept in the evidence package does this:

{
  "figure_id": "FIG-04",
  "version": 2,
  "title": "Movement of the stolen 41.6 BTC, 14 to 16 March 2026",
  "source_file": "fig04_edges_v2.csv",
  "source_sha256": "9c1e…a07b",
  "appendix_rows": "A14-A31, B3-B9",
  "data_cutoff": {"bitcoin_block": 941350, "ethereum_block": 24812000},
  "generated_with": {"tool": "open-source graph layout library", "version": "12.1"},
  "supersedes": "FIG-04 v1, report v1.0",
  "author": "Examiner 2"
}

The manifest links the figure to its input file by hash, to the appendix rows that support it, to the data cut-off and to the version it replaces. If a figure changes between the report and the hearing, the manifest records why, and the version shown in court must be the one disclosed. A figure that appears for the first time at the hearing, or that differs from the disclosed version, is an easy target and may be excluded.

Flow charts a lay reader can follow

A court flow chart should make one claim. If the report has four findings, it may need four figures, or one overview with three detail figures, each tied to a finding number.

• Put the legend first, at the top: "solid line: transfer recorded on the blockchain; dashed line: expert's inference, with its grade". The reader needs the key before the picture.
• Use plain names: "deposit address at Exchange K", not "cluster 88412"; "peel chain, 9 transfers", not nine boxes.
• Run time left to right and label each edge with amount and date; keep full txids in the appendix.
• Show where tracing stopped, and why: "custodial service, records requested" or "not traced further".
• Account for all the value: if 41.6 BTC entered, the figure shows where all 41.6 BTC went, including fees, unmoved balances and untraced amounts.

Timelines and maps

Timelines in court often matter more than paths, because they connect on-chain events to the testimony of witnesses. Show block times in UTC and, where events must be compared with witness accounts, also in the local time the witnesses lived through, with the offset stated. Distinguish on-chain events (a transaction confirmed) from off-chain events (the victim's report, a freeze request, an arrest) by shape or lane, not only by color. Keep gaps visible: a pause of three weeks before a deposit is evidence, and a compressed axis that hides it misleads.

Maps carry a special risk. IP geolocation from service-provider records is approximate, and addresses may belong to VPNs, hosting providers or mobile networks. Show such locations as a region or a radius with the source and date, never as a pin on a street. A provider's registered office, its servers and its customers may be in three different countries; a map of "where the money went" must say which of these it shows.

Showing uncertainty

Uncertainty that is clear in the report often disappears in the figure. Carry it across explicitly:

• Grade every inferred edge with the same terms the report uses, such as "strong support" or "very likely", and nothing stronger.
• Show ranges where methods disagree. If FIFO allocates 2.0 BTC of the stolen funds to Exchange K and haircut allocates 0.7 BTC (see the lesson Tracing methods and their consequences), show both, or show the range, rather than the more helpful number alone.
• Show candidates for matches. A bridge release chosen from three candidates is drawn with its alternatives or annotated "1 of 3 candidates in the window".
• Round in the figure, exact in the appendix: "about 2.95 BTC" in the picture, eight decimals in the table.
• Date every fiat value. Courts often think in money, not coins, so figures may show fiat equivalents. State the price source and whether values are at the time of each transfer, at the date of the theft or at the date of the report; the three can differ by multiples in a volatile market, and a figure that silently uses today's price can overstate or understate the loss.

Avoiding misleading visuals: a pre-hearing check

Before a figure goes into the bundle, run it past a reviewer who did not make it:

Animated presentations deserve caution. Building a flow chart step by step can help a court follow it, but animation that makes funds "race" through addresses implies speed and certainty the data may not support, and it cannot be put in a printed bundle. Prepare a static version of every animated sequence, disclose both, and make sure the final frame is identical to the static figure. Accessibility rules from the IDFE-BA lesson apply in full: contrast, no meaning carried by color alone, and alt text or a caption that gives the takeaway for any reader who cannot see the figure.

Exam focus: designing for the worst medium (grayscale print, projection, video link); treating a figure as an exhibit with identifier, version, data cut-off, source file hash and appendix rows; generating figures from data and keeping a figure manifest; why a figure must match the disclosed version; legend first, plain names, one claim per figure, stopping points and full value accounting; UTC plus stated local time on timelines and separating on-chain from off-chain events; IP geolocation shown as a region with source, never a street pin; grading inferred edges, showing method ranges and match candidates; the pre-hearing check, including neutral wording and the fairness test; static versions of animated sequences.