Analyzing cryptocurrency payment flows has become a key forensic method in law enforcement and is nowadays used to investigate a wide spectrum of criminal activities. However, despite its widespread adoption, the evidential value of obtained findings in court is still largely unclear. In this paper, we focus on the key ingredients of modern cryptocurrency analytics techniques, which are clustering heuristics and attribution tags. We identify internationally accepted standards and rules for substantiating suspicions and providing evidence in court and project them onto current cryptocurrency forensics practices. By providing an empirical analysis of CoinJoin transactions, we illustrate possible sources of misinterpretation in algorithmic clustering heuristics. Eventually, we derive a set of legal key requirements and translate them into a technical data sharing framework that fosters compliance with existing legal and technical standards in the realm of cryptocurrency forensics. Integrating the proposed framework in modern cryptocurrency analytics tools could allow more efficient and effective investigations, while safeguarding the evidential value of the analysis and the fundamental rights of affected persons.

中文翻译：

---

保护法医加密货币调查的证据价值

分析加密货币支付流已成为执法中的一种关键取证方法，如今被用于调查广泛的犯罪活动。然而，尽管它被广泛采用，但在法庭上获得的调查结果的证据价值仍然在很大程度上不清楚。在本文中，我们关注现代加密货币分析技术的关键要素，即聚类启发式和归因标签。我们确定国际公认的标准和规则，用于证实怀疑并在法庭上提供证据，并将它们投射到当前的加密货币取证实践中。通过提供 CoinJoin 交易的实证分析，我们说明了算法聚类启发式中可能的误解来源。最终，我们推导出一组法律关键要求，并将其转化为技术数据共享框架，以促进遵守加密货币取证领域的现有法律和技术标准。将提议的框架集成到现代加密货币分析工具中可以实现更高效和有效的调查，同时保护分析的证据价值和受影响人员的基本权利。