Introduction
The seizure included three corporate laptops, two encrypted USB drives and a full desktop disk image — all connected to suspected coordinated financial fraud. We were looking at cryptocurrency laundering, credential theft and internal comms linked to money mules. We had no illusions about speed.
Traditionally, this would’ve taken four days just to prepare for review — assuming nothing failed. With disclosure deadlines looming, we couldn’t afford delay, duplication, or error.
Normally we’d still be imaging drives. Instead, we were already inside the media — before the second coffee.
We launched S21 AutomateX, dropped in the UFDRs, encrypted images and disk captures, and applied our prebuilt RVS profiles for financial crime. In minutes, the system spun up all six evidence sources in parallel — carving deleted files, identifying synced folders, recovering login data and hashing everything for disclosure.
Each output was named by device ID and partition — no manual oversight, no scripting, no export mix-ups.
Because everything flowed automatically into S21 VisionX, we didn’t just get folders of data, we got a searchable, visual review environment. Media was already filtered by category. OCR results were indexed. Flickerbook review, facial grouping and visual inspector tools were instantly usable.
We were reviewing screenshots and flagged artefacts before lunch.
