Remember, there are only 2 high gms out there to do the job:
1. Track down items
2. Find out exactly how they got there
3. Ban parties that are responsible for theft of items/accounts
4. Find out how much money went where, what things were sold for
5. Reimburse parties
Here's one real summary of mine:
Victim: 123456 - JohnDoe
Accused: 123456 - accused IP: xx.xxx.xxx.xxx at the time of the theft
Details: Accused logged onto victim's account, selling herself several items at a very low price, along with selling others his items. Then deleted characters off his account.
12345678 Pebble_Ring -> 123456 - purchasingparty for 15m
12345678 Pebble_Ring -> 123456 - purchasingparty for 15m
12345678 +7 Mink Coat (Garm) -> Accused broke when upgrading
12345678 +10 DBSS Mace -> 123456 - purchasingparty for 15m
12345678 +7 Muffler (Deviling) -> Accused broke when upgrading
12345678 +7 Buckler (khalitzberg) -> Accused broke when upgrading
12345678 +7 Shoes (Eddga) -> Accused broke when upgrading
123456789 +10 Battle Axe (DBSS) Accused then took victim's money (60m) and purchased a +10 DBSS Battle_Axe.
Then traded it for various items.
Trades: Victim's account - 123456 - JohnDoe to 123456 - JaneDoe
123456789 Clip (Spring Rabbit) - Which belonged to the victim
Now, I replaced the names for sake of privacy. But see where it says purchasing party bought stuff for 15m? I go back to the purchasing party and figure out how much they sold that item for, then subtract that from the amount they bought it for and take the profit back. If the purchasing party does not have enough money because they purchased something else, I have to go through the logs and find out what exactly they bought with that money and then take it from them. Make it as if the deal never happened at all. Now, you know it takes a while when I pull up item logs, I mean, you guys can
feel the lag when I pull up the item logs. I have to sit there and analyze exactly what happened, look up each and every item number to make sure I have the correct item and the exact amounts it went over to the purchasing party for etc. I also have to verify each and every IP.
It's kind of like CSI

I think my longest ticket, took 3-4 hours to do? It's really draining
