One Button. Many Cases

By early spring, our backlog had topped 80 devices — everything from seized phones and tablets to full forensic images of desktops and servers. We had one dedicated media reviewer and three general examiners rotating across CSAM, fraud and domestic abuse cases. Most cases required comprehensive review of key artefacts, media files and file system content.

The bottleneck wasn’t just the number of devices — it was the manual prep time per item. Mounting images, selecting artefacts, carving, saving exports, checking hashes, renaming folders… repeat. It wasn’t sustainable and every case delayed felt like a missed opportunity for justice or safeguarding.

I didn’t expect to get to my Monday review cases before Wednesday, but there they were — ready, carved, filtered and waiting in S21 VisionX.

We selected a batch of 15 stalled cases to trial across a long weekend. Evidence types included Cellebrite UFDRs, E01 images from X-Ways, and NTFS drives from live captures.

We launched S21 AutomateX and matched each input to one of three prebuilt RVS profiles — CSAM, fraud/documents and full system review. With everything assigned, the batch was set to run.

While S21 AutomateX handled imaging, carving, and content structuring, staff focused on report writing and CPS prep. Each processed item was automatically indexed, hashed and routed into S21 VisionX

– By 9am Monday, every device in the batch was ready for review — structured, filtered and timestamp-aligned. The media reviewer started work two days ahead of schedule. Examiners were no longer stuck in prep mode — they were building cases.

The process was then rolled out as a weekly practice: standard profiles, rotating device pools and no scripting. The impact was immediate:

– 15 devices processed over one weekend with zero overtime

– 4–5 days backlog cleared across the lab

– Repetitive manual labour replaced with high-value tasks

– Automation trust embedded across the team

No delays. No dropped cases. Just progress, every week.

What if we’d waited until midweek to begin carving? What if the reviewer had been handed another stack of unstructured exports?

The same backlog would still be there, staff would still be spending hours mounting and filtering instead of reviewing and victim-facing cases would be delayed by days, sometimes weeks.

Instead, we automated the work no one needed to do by hand and we made sure the evidence that mattered got seen when it mattered most.

Because of S21 AutomateX, we didn’t just reduce the queue — we changed the pace of the job