Illustrative scenario. This is an educational example, not a report of a client outcome.
The scenario
An application imitated a wallet service and displayed a balance that could not be independently confirmed.
The records to examine
The app listing, download source, screenshots, public addresses and transaction hashes would be recorded without requesting any recovery phrase.
The questions to resolve
The review would compare what the app displayed with public blockchain records and identify which app or account claims remain unsupported.
What this example demonstrates
A documented chronology helps separate known events from assumptions. The availability of evidence, third-party cooperation and practical constraints determine what further review can establish.