From Six to Seven: Crypto as the Next Pillar of Digital Investigations

Digital investigations rarely follow a single trail. A username found through open-source research might lead to a phone. A phone might reveal an account, an image, a location — or a cryptocurrency wallet. The strongest findings often come from connecting evidence sources, not examining them in isolation.

That is the principle behind Chad Gish’s six pillars of digital forensics, discussed in his Magnet Forensics article “Connecting OSINT and physical device forensics with Magnet Axiom” (28 October 2026).

The original six pillars

Gish identifies six complementary sources of digital evidence. Each can support an investigation independently, but the real value lies in the connections between them.

Gish’s discussion is especially useful because it treats OSINT as part of the evidence workflow. Publicly available information may identify an account or alias; a lawfully acquired device may then corroborate that lead — or send the investigation in a different direction.

Our proposal: a seventh pillar

At Cyber Squad Labs, we believe cryptocurrency and blockchain evidence warrants consideration as a distinct, complementary seventh pillar. This is our proposed extension of Gish’s framework, not a pillar attributed to him or endorsed by Magnet Forensics.

Public blockchains can record transaction histories that investigators can analyse independently of a seized device or conventional financial statement. Those records may help establish timing, transaction paths, fund movements and links between addresses. Yet blockchain transparency does not automatically establish who controls a wallet.

Where the seventh pillar connects

• Physical devices: Wallet applications, transaction identifiers and recovery-related artefacts can connect device activity to blockchain records.
• OSINT: Public posts, usernames, domain records and published wallet addresses can generate leads that need independent corroboration.
• Cloud data: Lawfully obtained exchange or service-provider records may help link an account to a transaction or user.
• Video, location and timelines: Transaction timestamps may be compared with other events, while accounting for clock differences and the limits of blockchain timing.

A practical investigative example

Imagine an investigator identifies a pseudonymous online account promoting a fraudulent investment. Public posts reveal a payment address. On-chain analysis shows how funds moved through a sequence of wallets. Later, a lawfully examined phone contains records referencing one of those transactions.

None of these facts alone necessarily proves ownership or wrongdoing. Together, properly preserved and corroborated, they may help investigators form and test a more defensible hypothesis.

Beyond the tools: connecting the evidence

The point is not to add blockchain analysis to every case. It is to recognise when a financial trail exists and to know how to connect it responsibly with the other evidence sources. Investigators must document their methods, distinguish observation from inference, and avoid overstating wallet attribution.

That connected approach also shapes the practical CTF experiences we are developing at Cyber Squad Labs: realistic scenarios where participants move between device artefacts, OSINT leads and on-chain evidence to build an investigation.

Credit and further reading: Chad Gish (2026), Connecting OSINT and physical device forensics with Magnet Axiom, Magnet Forensics, 28 October 2026. Read the original article ↗. The original six-pillar model is credited to Gish; the proposed seventh pillar and interpretation here are Cyber Squad Labs’ own.