// case type
labor trafficking investigation
post-coercion documentation — recruitment chat metadata, payroll withholding shape, immigration exports, payment trails. survivor-consent framing · indicators not statutory conclusions · runs locally.
// start here
entry point: evidence manifest generator. work the primary tools top-down — all local, no upload.
start here · primary tools
ordered. work top-down. the first tool is the suggested entry point for this case type.
- evidence manifest generatordrop evidence files · compute md5 sha1 sha256 · chain of custody manifest · case number · analyst · export pdf and csv · runs locally
- iOS WhatsApp artifact forensic extractordrop iOS WhatsApp ChatStorage.sqlite and Contacts.sqlite · parse all chats, messages, groups, and media references · reconstruct conversation timelines with delivery status · surface location shares, contact cards, and deleted message placeholders · runs locally
- android whatsapp database forensic analyzerdrop an Android WhatsApp msgstore.db · parse all messages, chats, groups, and media metadata · reconstruct conversation timelines · surface message delivery status, forwarding metadata, location shares, and contact cards · detect deleted message gaps · runs locally
- ios telegram artifact forensic extractordrop cache4.db or account db · parse chats messages channels · forwarding edits tombstones · disappearing timers · mid gap analysis · runs locally
- android telegram database forensic extractordrop Android Telegram database files · parse messages, chats, channels, and contacts · extract forwarding metadata, edit timestamps, and media references · surface disappearing message timer settings · detect deleted message ROWID gaps · reconstruct Telegram communication timeline · runs locally
- telegram desktop tdata artifact forensic extractordrop telegram desktop tdata folder · parse user.id / D877F783D5D3EF8C cache · surface account session + chat history · runs locally
- fragomen immigration export forensic analyzerdrop fragomen export · parse case + visa + user · runs locally
- workday payroll export forensic analyzerdrop workday payroll export · parse payment + earning + user · runs locally
also useful · secondary tools
supporting and follow-up tools. surface as the investigation widens.
- payroll unauthorized adjustment detectordrop payroll export · detect unauthorized pay adjustments · runs locally
- cross hcm payroll headcount correlatordrop hcm + payroll exports · correlate headcount to pay run · runs locally
- ios burner app artifact detectordrop iOS backup Manifest.db, ApplicationState.db, knowledgeC.db, or app listings · detect installed and previously deleted burner phone number and anonymous communication apps · surface usage timestamps and residual artifacts from deleted apps · identify ephemeral identity patterns · runs locally
- android burner app artifact forensic detectordrop Android packages.xml, logcat, usage stats database, or filesystem listing · detect installed and previously deleted burner phone number and anonymous communication apps · surface usage timestamps and residual artifacts from deleted apps · identify patterns of ephemeral identity use · runs locally
- prepaid sim activation artifact forensic detectordetect evidence of prepaid SIM activation, refill activity, and temporary/burner subscriber behavior · runs locally
- osint normalizerpaste osint dump · extract emails phones ips crypto handles · disposable tor private heuristics · e.164 · five tabs · per-category csv · runs locally
- multi-source entity resolverdrop forensic csvs · resolve names emails usernames ips across sources · probabilistic entity profiles · runs locally
- fatcousin multi tool super timeline correlatordrop any fatcousin findings csv/json · unified timestamp-sorted timeline · runs locally
- fatcousin cross export ioc hash correlatordrop hash/ioc csv from any fatcousin tool · shared indicator intersection report · runs locally
- case report generatorfill in case number · examiner · dates · findings · drop evidence files for auto hash · generates structured forensic report PDF · runs locally
proof & methodology
synthetic reference investigations and investigation playbooks for this case type — fixture-locked goldens, local binders, evidence order, and tool paths.
investigation guide: labor trafficking investigation — methodology →
side-by-side: compare case types →
run as a case-kit pipeline
no curated stack for this case type yet. tracked in the forensics rollout — pipelines roll out one case type at a time.