Multi-Tenant Mix-Up

A multi-room house was raided following intelligence connecting the address to cybercrime and fraud. The property had been occupied by at least four different tenants over 18 months, often overlapping and with little official record-keeping. Six laptops, four external hard drives, three mobile phones and a tower PC were seized — all powered on at the time.

Some devices had been shared. Usernames and application logs suggested handovers between occupants. To make things worse, illicit material had been detected — but it wasn’t clear who it belonged to. There was no time for error: if we couldn’t separate activity accurately, we risked contaminating timelines and naming the wrong suspect.

With that many devices in one house, it could’ve taken days just to work out which belonged to who. S21 AutomateX gave us order. S21 VisionX helped us tell the story.

We launched S21 AutomateX immediately after seizure. The platform took control of imaging, carving, and artefact extraction in parallel across all 13 devices. Whether drives were mounted images or connected physically via write-blockers, it handled them without error, maintaining logs and file paths for disclosure compliance.

Using a tailored RVS profile, we ensured partition-level carving, cloud artefact detection, and full metadata capture. The output was sorted by device ID, so no filenames or timestamps were overwritten or mixed. While this ran, we moved straight into S21 VisionX, where carved media had already started populating by device and time range.

We used visual filters, content grouping and timeline sliders inside S21 VisionX to map device usage against occupancy periods. It became clear that some material was isolated to specific tenants — while others could be safely ruled out. App data, login sessions and recovery patterns gave us behavioural markers we could assign to individuals.

What started as a forensic tangle became an organised chain of device timelines. With S21 AutomateX, everything was processed consistently and simultaneously. With S21 VisionX, we filtered and explored the story visually.

The result? Three innocent individuals were removed from suspicion entirely.

Timeline clusters revealed isolated periods of access. Key footage and file trails supported user attribution with confidence.

Chain-of-custody logs were exported with the disclosure package and the prosecution team included visual timelines from S21 VisionX in the file. What would have taken nearly a week of analyst time was complete in under 36 hours.

Thirteen devices. Four tenants. One clear view of the facts.

What if we’d handled this manually, one device at a time? What if filenames had been overwritten, or timestamps muddled?

The result would’ve been chaos. No attribution. No audit trail. No way to say which suspect was responsible. Innocent names might have gone forward. Or worse — the case could’ve been thrown out.

Instead, we had automation, structure, confidence and an evidence set that did the talking for us.