Disclosure notice: This is a true account of a frontline investigation – written in collaboration with Semantics 21. This may contain accounts that some readers find upsetting.
This case study is based on a real experience shared by a law enforcement/investigation agency professional and written in collaboration with Semantics 21. It is presented in a first-person format to reflect the original voice and lived reality of the investigator, with all identifying information removed or adapted in accordance with UK GDPR and safeguarding standards.
Introduction
The suspect was composed and cooperative. They admitted to visiting adult websites, but claimed they never downloaded anything illegal and certainly never shared it. Their devices told the same story at first glance: no suspicious apps, no saved media, no active accounts.
Using MSAB, we recovered around 150 low-quality video fragments and thumbnails from browser caches and deleted folders. Most looked like compressed adult material and none had intact metadata. There was no EXIF data, no folder structure and no standout filenames.
It looked clean. We were one step from closing the case.
It felt like a dead end. No content, no history — until the S21 GAD started pulling threads we didn’t even know were there.
We ran the fragmented media through S21 LASERi-X, with the S21 Global Alliance Database (GAD) enabled. Most files were too degraded to match but six triggered partial hits. At first glance, it wasn’t much. But then we opened the associated investigator notes.
These weren’t just known files. They’d been seen before in another force’s case. In that case, the files had been uploaded to a specific forum using a public username that matched one we’d just recovered from the suspect’s deleted Telegram cache.
That file — and five others — were tagged in the S21 GAD with metadata from past investigations. One was linked to an IP address traced to a domestic broadband account and another had previously appeared on a CSAM distribution list in a separate investigation, six months earlier. Both pointed to the same uploader identity.
Without the S21 GAD, these fragments would’ve passed as low-risk adult content. There were no timestamps, no logs and the filenames had been changed. But the match data, tag history and case linkages stored within the database reconstructed a chain of activity no local artefacts could show.
From Wiped to Witnessed
This was the difference between a “clean” device and a confirmed distributor.
The forensic artefacts on the device — the cached handles, deleted Telegram logs and isolated video fragments — all pointed to someone careful. Someone who wiped files, changed names and stripped metadata. But they hadn’t outlived the database.
S21 GAD provided what the device couldn’t — A history, a fingerprint and a link to distribution, not just possession.
The case was reclassified within hours, we secured access to cloud backups, the full Telegram cache was restored and the suspect was charged not only for viewing material, but for actively uploading it, on multiple occasions.
“He thought we had nothing. To be fair, so did we. The S21 GAD didn’t just show the files — it told us where they’d been. That’s how we proved distribution.”
What if we hadn’t acted?
We were close to dropping the case. With no files, no live accounts and no conclusive traces, there was little to support suspicion — let alone prosecution.
This case proves how wrong that assumption can be.
Without the S21 GAD, the files would’ve looked benign, the handle connection would’ve been missed and a serial uploader could’ve walked, unchallenged.
The S21 GAD didn’t just show a match — it showed us where it had been and who had left it there.
S21 solutions mentioned
S21 Global Alliance Database
Over 3 BILLION records contributed by global law enforcement, including notes, descriptions and classifications — all designed to reduce manual review and minimise CSAM exposure for investigators.
Share your experience, inspire others
Have a story of your own? Whether you’d like to be credited or remain anonymous, we’d love to hear from you. Your experience could help rescue a victim, safeguard a child, or take a dangerous offender off the streets. Please get in touch — your words could make a difference.
Request a demo or sales information pack
Please complete the form with valid company or agency information, including a company or agency-issued email address. We will need to confirm your credentials before issuing a free trial licence.