All notes
Intake / 2025-11-12
The first 48 hours after an incident
The trail does not cool evenly. Payments, logs and correspondence keep different clocks.
In the first two days it is more important to keep the source than to argue about labels. A statement, a hash, a venue email, a device log — anything that can be shown by origin.
In parallel we record what not to do: do not forward a seed, do not grant remote access, do not threaten the operator without counsel.
If the trail is still warm, a chargeback, hold or compliance window may still be open. That is not a promise of recovery. It is the moment when action still has a price.