crypto investigation process