Disclosure notice: This is a true account of a frontline investigation – written in collaboration with Semantics 21. This may contain accounts that some readers find upsetting.
This case study is based on a real experience shared by a law enforcement/investigation agency professional and written in collaboration with Semantics 21. It is presented in a first-person format to reflect the original voice and lived reality of the investigator, with all identifying information removed or adapted in accordance with UK GDPR and safeguarding standards.
Introduction
A multi-room house was raided following intelligence connecting the address to cybercrime and fraud. The property had been occupied by at least four different tenants over 18 months, often overlapping and with little official record-keeping. Six laptops, four external hard drives, three mobile phones and a tower PC were seized — all powered on at the time.
Some devices had been shared. Usernames and application logs suggested handovers between occupants. To make things worse, illicit material had been detected — but it wasn’t clear who it belonged to. There was no time for error: if we couldn’t separate activity accurately, we risked contaminating timelines and naming the wrong suspect.
With that many devices in one house, it could’ve taken days just to work out which belonged to who. S21 AutomateX gave us order. S21 LASERi-X helped us tell the story.
We launched S21 AutomateX immediately after seizure. The platform took control of imaging, carving, and artefact extraction in parallel across all 13 devices. Whether drives were mounted images or connected physically via write-blockers, it handled them without error, maintaining logs and file paths for disclosure compliance.
Using a tailored RVS profile, we ensured partition-level carving, cloud artefact detection, and full metadata capture. The output was sorted by device ID, so no filenames or timestamps were overwritten or mixed. While this ran, we moved straight into S21 LASERi-X, where carved media had already started populating by device and time range.
We used visual filters, content grouping and timeline sliders inside S21 LASERi-X to map device usage against occupancy periods. It became clear that some material was isolated to specific tenants — while others could be safely ruled out. App data, login sessions and recovery patterns gave us behavioural markers we could assign to individuals.
From Overlap to Clarity
What started as a forensic tangle became an organised chain of device timelines. With S21 AutomateX, everything was processed consistently and simultaneously. With S21 LASERi-X, we filtered and explored the story visually.
The result? Three innocent individuals were removed from suspicion entirely.
Timeline clusters revealed isolated periods of access. Key footage and file trails supported user attribution with confidence.
Chain-of-custody logs were exported with the disclosure package and the prosecution team included visual timelines from S21 LASERi-X in the file. What would have taken nearly a week of analyst time was complete in under 36 hours.
Thirteen devices. Four tenants. One clear view of the facts.
“The consistency was what made it work. Each drive processed the same way, each output folder clean. No guessing — just facts we could follow.”
What if we hadn’t acted?
What if we’d handled this manually, one device at a time? What if filenames had been overwritten, or timestamps muddled?
The result would’ve been chaos. No attribution. No audit trail. No way to say which suspect was responsible. Innocent names might have gone forward. Or worse — the case could’ve been thrown out.
Instead, we had automation, structure, confidence and an evidence set that did the talking for us.
S21 solutions mentioned
S21 AutomateX
The complete solution for rapid automation of victim identification, CSAM categorisation and media review
Share your experience, inspire others
Have a story of your own? Whether you’d like to be credited or remain anonymous, we’d love to hear from you. Your experience could help rescue a victim, safeguard a child, or take a dangerous offender off the streets. Please get in touch — your words could make a difference.
Request a demo or sales information pack
Please complete the form with valid company or agency information, including a company or agency-issued email address. We will need to confirm your credentials before issuing a free trial licence.