10,000 Faces, One Victim

Following the arrest of a suspect in possession of multiple storage devices, our team received over 1.2 million image and video files for review. The case was suspected to involve CSAM, but due to the volume and lack of file structure, it was impossible to know where to begin.

Devices included a mixture of encrypted USBs, poorly labelled SD cards and partially corrupted external drives. None of the media had consistent naming conventions and there were no easily identifiable folders for prioritisation.

A traditional forensic review would take months — with officers risking exposure to vast volumes of distressing content without any immediate leads.

It was buried in the middle of chaos, no names, no order. But once S21 VisionX grouped those faces, it was unmistakable. We had something. We knew exactly where to look next.

Our first action was to import the contents into S21 VisionX. Within minutes, the software began identifying CSAM material using the S21 Auto-Categorise, classifying content by severity. Files were automatically filtered by suspected age group, scene type and previously known vs unknown material.

We could now start to build a path to analyse the data in a logical manner.

Once the scan was complete, facial grouping proved invaluable. The system identified 137 distinct grouped facial sets, each representing recurring individuals across the dataset. One set stood out — a young child appearing in multiple folders and on different devices, despite variations in filename, lighting, and context.

The integrated S21 Global Alliance Database confirmed the subject had already been identified in seven prior cases. But three new videos, first generation, were flagged immediately. These became central to the investigation.

Using Flickerbook Review, we quickly scanned through high-risk footage to isolate key scenes without watching hours of content. AI Describe and the wellbeing features generated clear, court-ready summaries while limiting exposure to distressing material. Meanwhile, Visual Inspector highlighted identifying features in the footage, clothing, fixtures, branded objects etc., that placed the child in a specific, known environment.

Clear leads, confirmed matches and a full case picture — pulled together in record time.

We confirmed the identity of the victim and uncovered additional material showing abuse. Despite no filename matches, we linked media across four devices and pieced together a timeline of events for court. The cross-referencing with the S21 GAD had also revealed global connections to the case. Importantly, we achieved all of this in days, not months.

What if we’d waited for a full manual review? Or held off until we’d reviewed more obvious leads? What if we’d assumed it was just another disorganised dump of duplicate files?

The child’s face was buried in scattered folders across multiple devices, with no naming pattern, no hints, no reason to notice. Without facial grouping, those images would’ve slipped through, hidden in plain sight.

It doesn’t take much to miss a moment. A few extra clicks. A different review order. One less feature.

S21 VisionX didn’t just speed things up, it gave us the confidence to act early. No internet. No uploads. No delay. From the moment we ran the offline detection, we had structure. From the moment we grouped faces, we had a lead.

And when the S21 GAD flagged those videos as previously unseen, everything changed.

If we hadn’t acted, that victim might never have been identified, those files might’ve gone undiscovered and that timeline might’ve stayed incomplete.

Instead, we had answers — and we had them in days.