Disclosure notice: This is a true account of a frontline investigation – written in collaboration with Semantics 21. This may contain accounts that some readers find upsetting.
This case study is based on a real experience shared by a law enforcement/investigation agency professional and written in collaboration with Semantics 21. It is presented in a first-person format to reflect the original voice and lived reality of the investigator, with all identifying information removed or adapted in accordance with UK GDPR and safeguarding standards.
Introduction
On a Friday morning, our fraud unit executed a warrant against a suspect running a bogus invoice scheme targeting vulnerable pensioners. We seized a laptop and two external drives — one of which had clearly been recently wiped.
The CPS flagged it as high priority due to ongoing risk to victims. They wanted digital evidence in hand by Monday morning.
We had two days. The drives were wiped. Normally we’d still be exporting — instead, we were preparing statements. That’s a first.
We launched S21 AutomateX as soon as the devices were in hand. The system automatically handled the full imaging and processing workflow using its integration with X-Ways Forensics, before routing all results into S21 LASERi-X for structured review.
Using a preconfigured fraud RVS profile, the system recovered deleted files, extracted documents and spreadsheets, performed OCR on embedded image text, detected cloud sync artefacts and generated full hash logs for evidential integrity.
Everything was processed offline and ran unattended overnight.
By 9am on Saturday, the results were ready: over 2,300 recovered documents and 170 carved screenshots, fully indexed and categorised inside S21 LASERi-X. As we reviewed the output, critical evidence emerged — internal chats referencing payments, screenshots of cryptocurrency wallet addresses, and timestamp data showing the full creation and deletion timeline.
From Wiped to Witnessed
S21 AutomateX handled the case end to end: imaging, recovery, categorisation, and output structuring — all without scripting, servers, or added headcount. Within 12 hours, we had a complete, searchable evidence set in S21 LASERi-X, ready for interview and prosecution prep.
What would normally require two or more forensic analysts over a week was done automatically — freeing us to focus on legal casework and safeguarding actions.
The bundle was handed to CPS on Sunday. By Monday, the suspect had been charged — and the digital artefacts became the core of the case.
The team used the resulting package to define a new fraud preset for future S21 AutomateX cases. Safeguarding measures were triggered immediately, and the victim list stopped growing.
No backlog. No delay. Just evidence when it mattered most.
“S21 AutomateX didn’t just save us time — it gave us the chance to charge, not just investigate.”
What if we hadn’t acted?
What if we’d queued the job for the standard forensic pipeline? What if we’d waited for manual review or a scripting workaround?
We’d have missed the deadline, the case might’ve stalled at report stage and a dangerous fraudster could’ve walked on ‘insufficient digital evidence.’
Instead, we had structure, timeline, recovery and courtroom-ready visuals before the end of the weekend.
Because we had the right tools, a forensic delay never became a barrier to justice.
S21 solutions mentioned
S21 AutomateX
The complete solution for rapid automation of victim identification, CSAM categorisation and media review
Share your experience, inspire others
Have a story of your own? Whether you’d like to be credited or remain anonymous, we’d love to hear from you. Your experience could help rescue a victim, safeguard a child, or take a dangerous offender off the streets. Please get in touch — your words could make a difference.
Request a demo or sales information pack
Please complete the form with valid company or agency information, including a company or agency-issued email address. We will need to confirm your credentials before issuing a free trial licence.