# Forensic Reveals

| Status  | Entrypoint                                                                          |
| ------- | ----------------------------------------------------------------------------------- |
| Concept | [zAccount](https://docs.pantherprotocol.io/docs/panther-core/panther-core/zaccount) |

### TL;DR

* Each transaction results in an encrypted “message to data escrow”
* The message is secured with an "ephemeral key", i.e. a unique key is created for every transaction
* Only with the alignment of the stakeholders who hold cryptographic keys can the message be unpacked and the data revealed

### Introduction

The Forensic Data Escrow (FDE) mechanism supports one-off/ad-hoc inquiries. This is in contrast to the data a Zone Manager may extract for ongoing/routine compliance procedures that are part of every transaction — the latter are supported by different mechanisms implemented in the protocol.

> The routine Protocols are wip.

The FDE retains an encrypted record containing private data of a particular transaction in a [Shielded Pool](https://docs.pantherprotocol.io/docs/panther-core/panther-core/shielded-pool). This mechanism does not require any spending keys, i.e., it can be used to deanonymize data but not to spend funds.

The Protocol prepares, verifies, and publishes a transaction record for every transaction. Decrypted FDE records provide transaction data such as:

* Which zAccounts received funds
* Which Zones the funds originate from and and were spent in
* Whether the UTXO/s created by the investigated transaction have already been spent
* Which transaction(s) initially created the queried UTXOs

### Stakeholders

The FDE Operator’s key must be used to access FDE records. Either the Network FDE Assistant or the Zone FDE Assistant must comply to use this key.

#### Network FDE assistant

The Network FDE assistant (or the Zone FDE Assistant) role controls the FDE record key. This key is required to decrypt the FDE record; for a transaction in a specified Zone on a specified network and share this key with the FDE Operator.

#### FDE Operator

FDE Operator adds a layer of control over the Zone FDE Assistant’s key. The FDE Operator must comply and use their key to allow the Network FDE Assistant to decrypt a particular transaction on the designated network for the designated Zone.

The FDE Operator can’t open an FDE record with their Key alone (as they don’t control the FDE record key). Either the Network FDE Assistant or the Zone FDE Assistant should participate in the decryption process (providing the FDE record key).

On the other hand, neither the Network FDE Assistant nor the Zone FDE Assistant can decrypt any FDR without the FDE Operator (as they don't control the FDE Operator’s key).


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://docs.pantherprotocol.io/docs/panther-core/compliance/forensic-reveals.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.