S21 Discovery

Understand complex CSAM evidence before critical leads are missed

S21 Discovery helps investigators explore, filter and prioritise complex CSAM evidence datasets - surfacing relevance faster while keeping professional judgement in control.
Overview

Built for CSAM investigations where missed evidence matters

CSAM investigations now involve huge volumes of images, videos and extracted device data. Reviewing everything manually is slow, exhausting and risks missing evidence and victim-identification leads.

S21 Discovery helps investigators explore, filter and prioritise CSAM evidence quickly - surfacing relevant material and potential victim indicators earlier so teams can focus attention where it matters most.

Designed by investigators and built for operational environments, Discovery complements existing forensic extraction tools while supporting faster CSAM triage, victim-identification workflows and safer evidence review.
See how it works in 5 minutes

Join a former law enforcement officer for a practical walkthrough of the tool and features designed to support real-world investigations

Fully Offline & Secure

Protect sensitive evidence and eliminate the risks of cloud-based AI learning from your victims’ images and videos — and potentially exploiting them further. S21 Discovery runs completely offline, ensuring no data ever leaves your environment and removing all exposure to third-party access or breaches.

Built for Everyone — from Frontline Officers to Lab Experts

S21 Discovery is easy to use for simple frontline users and powerful enough for advanced lab analysts. Whether you’re on the front line or in the lab, it provides the right tools to get the job done.

No Servers or Specialist Hardware

Deploy instantly without complex infrastructure. S21 Discovery runs efficiently on standard workstations or existing networked machines — no dedicated servers or high-end hardware required.

We’re creating an open community of collaboration with other industry experts​

S21 VisionX fully supports evidential data exchange with leading digital forensic tools, ensuring seamless integration with your existing workflow. Compatible platforms include X-Ways Forensics, Cellebrite, Magnet Forensics (AXIOM, IEF, Witness), GrayShift, Griffeye, Belkasoft X, Oxygen Forensics, OpenText EnCase, MSAB XRY and XAMN, Exterro, GetData, and many others. With S21 VisionX, you can review, categorise and identify victims efficiently — and easily export results back to your tool of choice for further analysis or reporting.
The Solution

CSAM investigation capabilities that prioritise victims and evidence

S21 Discovery is built for CSAM investigations where victim identification, triage and evidence prioritisation must happen earlier. It helps investigators surface high-risk material, identify potential victim indicators and manage large evidence datasets with greater confidence.

AI-assisted CSAM review support

Match known CSAM indicators and help investigators prioritise assessment of high-risk material earlier in review.

Victim identification triage support

Surface potential victim indicators earlier in triage, helping investigators focus review where victim identification opportunities may exist.

CSAM intelligence-driven search

Search and filter CSAM evidence datasets quickly to surface relevant material, patterns and leads.

NCMEC CyberTip triage support

Prioritise CyberTip-related material earlier, helping investigators focus review on high-risk leads and potential victim identification routes.

Rapid CSAM case understanding

Move from extracted CSAM data to investigative insight faster, with clearer routes for triage, prioritisation and review.

Designed for secure CSAM investigations

Operate offline in restricted or air-gapped investigative environments, keeping sensitive CSAM review under investigator control.

"The scale of the Global Alliance Database gives investigators immediate operational value during high-volume investigations."

D/Insp Milligan
Merseyside Police, UK
SURFACE VICTIM-IDENTIFICATION LEADS EARLIER

Support early victim identification

Victim identification is one of the most urgent and demanding tasks in CSAM investigations - and triage is where critical opportunities can be surfaced earlier.

The S21 Find Victims capability helps investigators conduct victim-identification searches using limited starting information. Investigators provide small pieces of contextual information - and Discovery helps surface files that may contain relevant victim indicators.

By helping investigators surface and prioritise possible victim-related material earlier, Discovery supports more focused safeguarding review, evidence assessment and victim-identification triage.
Automated CSAM categorisation

Automated CSAM categorisation for faster investigative triage

Manually reviewing large volumes of harmful imagery and video is time-consuming, exhausting and psychologically demanding.

Discovery’s CSAM Auto Categoriser processes large volumes of images and videos, organising material into structured review categories including CSAM, indicative content, legally held material and adult pornography.

This structured categorisation helps investigators prioritise review, reduce manual workload and limit unnecessary exposure to harmful material.

Essential tools for CSAM evidence review

Powerful capabilities that help investigators review CSAM evidence faster, surface victim-identification leads and build stronger case understanding.

Scan and structure CSAM cases

Set up a new investigation quickly and begin analysing devices or media without complex configuration. S21 Discovery helps investigators ingest extracted datasets, organise them into structured cases and begin reviewing CSAM-related material sooner.

Early signals within the dataset help investigators understand what they are dealing with before a full manual review begins.

Rapid CSAM indicator matching

Discovery helps investigators match known and high-risk CSAM indicators early in the review process, supporting faster triage and more focused assessment.

Instead of waiting until a full manual review is complete, investigators can surface priority material sooner and direct attention to files most likely to require urgent review.

Automated CSAM categorisation

Discovery organises large volumes of images and videos into structured CSAM review categories, helping investigators understand the dataset faster and prioritise material for assessment.

This supports faster review, reduces unnecessary manual workload and helps limit repeated exposure to harmful material.

Flag files and generate reports

Investigators can flag important files, record review decisions and generate structured outputs that support onward assessment, reporting and case preparation.

Discovery helps teams keep CSAM review activity organised, explainable and ready for transfer into existing investigative workflows.

Bring clarity to complex CSAM investigations

See how S21 Discovery helps investigative teams review CSAM evidence faster, surface victim-identification leads earlier and work more effectively alongside existing forensic workflows.

Bring victim-focused clarity to complex CSAM investigations
BUILT TO SUPPORT REAL CSAM INVESTIGATIVE WORKFLOWS.

Built for complex CSAM evidence review

A practical toolkit for CSAM investigations, helping teams explore, prioritise and manage complex evidence with speed, structure and confidence.

CSAM evidence exploration

Investigators can navigate large CSAM evidence datasets quickly, revealing patterns, connections and relevant material without endless manual browsing.

  • Explore large image, video and device datasets

  • Surface patterns and connections earlier

  • Reduce reliance on exhaustive manual browsing

Hypothesis-led investigation

Discovery supports hypothesis-led investigation by helping teams test lines of enquiry, filter evidence around investigative questions and follow emerging patterns across complex CSAM datasets.

  • Test lines of enquiry against extracted material

  • Filter evidence around investigative questions

  • Follow emerging patterns across complex datasets

Rapid CSAM prioritisation

Discovery helps investigators prioritise CSAM-related material quickly, focusing review on files and indicators most likely to require urgent assessment.

  • Prioritise high-risk material earlier

  • Focus review on files requiring urgent assessment

  • Support faster triage without replacing investigator judgement

Intelligence-driven searching

Search across large CSAM evidence datasets using intelligence-led filters that help investigators surface relevant material, victim-identification indicators and investigative connections.

  • Search by investigative concepts and structured filters

  • Surface relevant material and potential victim indicators

  • Identify connections that support focused review

Scalable CSAM review

Discovery is built to support large and complex CSAM evidence datasets, helping investigators keep review structured as volume, file types and investigative complexity increase.

  • Handle large volumes of images, videos and device data

  • Keep review structured as datasets grow

  • Support complex investigations without forcing workflow replacement

Designed for secure environments

  • Discovery is designed for secure investigative environments where sensitive CSAM evidence must remain under investigator control.

    • Operate in secure, restricted or air-gapped environments

    • Support sensitive CSAM review without cloud dependency

    • Work alongside existing forensic extraction tools

  • Global victim identification intelligence at unprecedented scale.

    The S21 Global Alliance Database contains over 3.5 billion law-enforcement-contributed intelligence records from trusted partners worldwide, helping investigators support victim-identification workflows, uncover cross-case links and surface critical investigative intelligence at global scale.

    Used in investigations where delays and missed connections have consequences.

    Designed for investigations where visibility, prioritisation and review speed directly affect operational decision-making.

    Operational impact across real investigations

    See how investigative teams are using S21 VisionX to analyse evidence, identify connections and progress complex cases.

    When it counts most, your tools need to surface what matters first

    See how S21 Discovery helps investigators prioritise high-risk material, surface victim-identification leads and move complex CSAM investigations forward faster.