Introduction
Following the arrest of a radicalised individual on a separate charge, digital forensics teams received three encrypted USB drives. Once decrypted, they appeared to contain a mix of images, memes, political rants and hobbyist videos.
Nothing immediately incriminating stood out. The file structures were messy and thousands of images were stored without metadata. However, an agent from the intelligence service flagged one meme that closely resembled a previously seen propaganda format.
Concerned that potential attack planning materials might be hidden in plain sight, our team was asked to perform a rapid deep-dive review using S21 VisionX — under strict time pressure.
S21 VisionX didn’t treat it like a collection of memes, it treated it like a blueprint and that made all the difference.
We loaded over 520,000 images and clips into S21 VisionX. The visual inspector began clustering visuals by category — maps, weapons, faces and diagrams — giving us immediate structure.
Using offline OCR, we extracted terms like “deliver at 4am” and “vulnerable access” from handwritten notes hidden in memes and screenshots. QR decoding uncovered crypto wallets tied to known international contacts.
Flickerbook review helped us process short, low-quality propaganda clips in sequence, with connections drawn between scenes and past threat cases. Gradually, a full operational plan came into focus.
It was all hidden in a folder named ‘Ticking’. Subfolders were labelled ‘friends’, ‘plans’ and ‘legacy’.
