Case Studies

Investigations, Reconstructed

Six realistic, anonymized cases showing full methodology end-to-end — background, evidence, tools, analysis, and outcome.

Difficulty

Topic

Showing 6 of 6 case studies

Intermediate

The Departing Engineer: Tracing IP Theft Through USB Artifacts and Shellbags

A senior engineer resigned and joined a direct competitor within a week. Windows shell artifacts and USB registry entries reconstructed exactly what he took on his way out.

Disk ForensicsWindows ArtifactsCorporate Investigation

Read the case

Intermediate

Last Known Location: Reconstructing a Missing Person's Final Hours via CDR

A 34-year-old man was reported missing after failing to return from a business trip. Cell tower handover analysis across two carriers narrowed the search area from a 40 km radius to a single 2 km corridor.

CDR/IPDRCell Tower MappingMissing Person

Read the case

Advanced

The Shell Network: Unmasking a Financial Fraud Ring Through OSINT Link Analysis

A pattern of near-identical 'investment opportunity' pitches across social media led investigators to a network of 14 fake profiles, three shell domains, and a single reused image asset that broke the case open.

OSINTFinancial FraudLink Analysis

Read the case

Advanced

Patient Zero: Reconstructing a Ransomware Incident From a Single Memory Capture

By the time IT called in forensic support, the ransomware note was already on screen and the encryption service had exited. A single RAM capture from the still-running server reconstructed the entire attack chain.

Memory ForensicsRansomwareIncident Response

Read the case

Intermediate

Recovered, Not Deleted: WhatsApp Evidence in a Harassment Investigation

The complainant said the harassing messages had been deleted by the sender before she could screenshot them. A physical extraction and SQLite WAL analysis recovered them anyway.

Mobile ForensicsWhatsAppHarassment Case

Read the case

Advanced

Off the Clock: Catching Insider Data Exfiltration in IPDR and Proxy Logs

A departing employee's laptop showed nothing unusual. The proof was in the CGNAT-translated IPDR records showing a personal cloud-storage upload that lined up, second for second, with proxy logs from a device that was never issued to him.

IPDRInsider ThreatNetwork Forensics

Read the case