Disclosure notice: This is a true account of a frontline investigation – written in collaboration with Semantics 21. This may contain accounts that some readers find upsetting.
This case study is based on a real experience shared by a law enforcement/investigation agency professional and written in collaboration with Semantics 21. It is presented in a first-person format to reflect the original voice and lived reality of the investigator, with all identifying information removed or adapted in accordance with UK GDPR and safeguarding standards.
Introduction
By early spring, our backlog had topped 80 devices — everything from seized phones and tablets to full forensic images of desktops and servers. We had one dedicated media reviewer and three general examiners rotating across CSAM, fraud and domestic abuse cases. Most cases required comprehensive review of key artefacts, media files and file system content.
The bottleneck wasn’t just the number of devices — it was the manual prep time per item. Mounting images, selecting artefacts, carving, saving exports, checking hashes, renaming folders… repeat. It wasn’t sustainable and every case delayed felt like a missed opportunity for justice or safeguarding.
I didn’t expect to get to my Monday review cases before Wednesday, but there they were — ready, carved, filtered and waiting in S21 LASERi-X.
We selected a batch of 15 stalled cases to trial across a long weekend. Evidence types included Cellebrite UFDRs, E01 images from X-Ways, and NTFS drives from live captures.
We launched S21 AutomateX and matched each input to one of three prebuilt RVS profiles — CSAM, fraud/documents and full system review. With everything assigned, the batch was set to run.
While S21 AutomateX handled imaging, carving, and content structuring, staff focused on report writing and CPS prep. Each processed item was automatically indexed, hashed and routed into S21 LASERi-X
From Queue to Clear
– By 9am Monday, every device in the batch was ready for review — structured, filtered and timestamp-aligned. The media reviewer started work two days ahead of schedule. Examiners were no longer stuck in prep mode — they were building cases.
The process was then rolled out as a weekly practice: standard profiles, rotating device pools and no scripting. The impact was immediate:
– 15 devices processed over one weekend with zero overtime
– 4–5 days backlog cleared across the lab
– Repetitive manual labour replaced with high-value tasks
– Automation trust embedded across the team
No delays. No dropped cases. Just progress, every week.
“AutomateX didn’t just help us clear the backlog, it showed us what a sustainable workflow actually looks like.”
What if we hadn’t acted?
What if we’d waited until midweek to begin carving? What if the reviewer had been handed another stack of unstructured exports?
The same backlog would still be there, staff would still be spending hours mounting and filtering instead of reviewing and victim-facing cases would be delayed by days, sometimes weeks.
Instead, we automated the work no one needed to do by hand and we made sure the evidence that mattered got seen when it mattered most.
Because of S21 AutomateX, we didn’t just reduce the queue — we changed the pace of the job
S21 solutions mentioned
S21 AutomateX
The complete solution for rapid automation of victim identification, CSAM categorisation and media review
Share your experience, inspire others
Have a story of your own? Whether you’d like to be credited or remain anonymous, we’d love to hear from you. Your experience could help rescue a victim, safeguard a child, or take a dangerous offender off the streets. Please get in touch — your words could make a difference.
Request a demo or sales information pack
Please complete the form with valid company or agency information, including a company or agency-issued email address. We will need to confirm your credentials before issuing a free trial licence.