evidence protocol v2026.a

forensic evidence acquisition guide.

before our analysts can decode your de43 bitstream, you must provide the correct raw data. this guide will walk you through the exact extraction protocol.

instruction 01

avoid mobile apps.

modern banking apps use "friendly labels" — simplified, marketing-approved names for merchants. these labels actively redact the raw iso-8583 data that our forensic engine requires.

for example, your app might show "microsoft" while the actual field 43 bitstream reads msbill.info*msft. the app's sanitized version is useless for forensic tracing. you need the raw string.

use your bank's official desktop website or request an official pdf statement via email. these contain the unmasked descriptor strings.
instruction 02

locate field 43.

open your official pdf bank statement. look for the transaction listing table. the column labeled "description" (or sometimes "transaction details") contains the raw de43 bitstream.

this is where you will find strings like msbill.info, amzn mktp us, or chase recurring pymt. these are the exact bitstream artifacts our engine requires.

example extraction

// locate this row in your pdf statement:

date: 01/15/2026 | description: msbill.info*msft 800... | amount: $9.99

// ↑ the "description" field is your de43 bitstream.

// send us this exact string. do not paraphrase.

if your statement shows only a "friendly name" (e.g. "microsoft"), call your bank's support line and request the "raw merchant descriptor" for that transaction. they are legally required to provide it.
mandatory security protocol

redact before sending.

before transmitting any statement data to our forensic intake, you must digitally redact the following personally identifiable information (pii):

full account number — mask all but the last 4 digits (e.g. ****1234)
home address — black out any street addresses, postal codes, or city names
sort code / routing number — redact completely before submission
we operate on a zero-knowledge architecture. we do not need, store, or process your account numbers. we only require the transaction descriptor string, date, and amount.

ready to submit your evidence.

once you have located your raw de43 descriptor and redacted all pii, use the secure channel below to transmit your data to our forensic intake.

open secure transmission channel

zero-knowledge compliant. iso 27001 standards. no bank credentials required.