Introduction
In the run-up to an ISO 17025 audit, our digital investigations unit was facing one recurring problem: consistency. Despite using the same forensic platform, team members handled evidence differently — with varied carving methods, naming conventions and artefact selections.
This made peer review painful, slowed investigations and risked audit failure. We needed repeatability, clear documentation and a way to ensure that any analyst could review or repeat another’s work — without reinventing the process each time. Server infrastructure wasn’t an option and internal development was off the table.
That’s when we deployed S21 AutomateX.
Before, everyone did things slightly differently and it caused friction. Now? Same button. Same outcome. Every time.
We built a reusable RVS workflow profile with everything our cases typically required: image carving, hash lookups, document indexing and link file detection. With S21 AutomateX, that profile became a button, usable by anyone on the team, regardless of experience.
Evidence types didn’t matter. Physical drives, Cellebrite UFDRs, forensic images — all went into S21 AutomateX, which processed them using the same consistent template.
Each step was logged, each folder followed naming rules and once the automation completed, the results appeared in S21 VisionX ready for visual review, with nothing lost or altered along the way
