labor trafficking investigation — methodology
labor trafficking cases leave a document record. recruitment happened through apps — whatsapp, telegram, job-board platforms. written recruitment and debt terms often survive in chat and payroll exports. wage withholding has a payroll shape. payment went through western union, hawala, or wire services. most of those records still exist on the survivor's device, in their account history, or in partial platform traces from services that have since gone dark. the examiner's job is to extract what the survivor's own account exports provide — not the broker's records unless obtained through legal process — then correlate broker identifiers where counsel directs. this page serves investigators, NGO advocates, and counsel. it does not assume prosecution — asylum, NGO records, and civil cases follow the same preservation path. every finding is an indicator, not a statutory conclusion. files never leave the device. no upload, no account. start with evidence manifest and ios whatsapp on consented exports.
what this page is not
- not access to records the survivor does not hold — tools analyze lawful exports and account history the survivor (or counsel) can provide.
- not a trafficking score — no browser tool concludes TVPRA or any statute; indicators go to qualified review.
- not an active enforcement playbook — do not run on a device a recruiter still monitors; physical safety first.
- not immigration legal advice — NGO or immigration counsel before law enforcement when status protection matters.
operational security
before running any of these tools: use a device the broker or recruiter does not monitor. if the survivor is still under recruiter pressure, postpone forensic work until they are in a physically safe environment — account exports can be rebuilt later; physical safety cannot. do not run on a shared device the recruiter handled. these tools run entirely in the browser. no file leaves the device. no upload. no account. for immediate human help: Polaris Project National Human Trafficking Hotline — 1-888-373-7888 — text 233733 (BeFree). if immigration-status protection is needed before law enforcement contact, an NGO advocate is the correct first call. forensic documentation follows safety planning — not the other way around.
trusted organizations
- Polaris Project / National Human Trafficking Hotline — 1-888-373-7888 · text 233733 (BeFree) · survivor-informed referral · does not require immigration status disclosure to the hotline.
- DHS Blue Campaign — federal awareness and investigator training — not a survivor hotline; no direct case management.
- International Organization for Migration (IOM) — cross-border assistance — survivors should understand how information may be shared with governments before engaging.
- Human Trafficking Institute — prosecutor and attorney training · selective direct legal support for survivors.
- CAST LA — survivor-led services and legal referral — california-based with national referral network.
the first 10 minutes
- confirm the survivor is in a physically safe environment — postpone device work if a recruiter still monitors the phone.
- confirm consent scope: whose account exports, which devices, and who receives outputs (NGO, counsel, or the survivor).
- hash every export with evidence-manifest-generator before analysis or email.
- preserve whatsapp/telegram exports the survivor still holds — thread metadata survives platform takedowns.
- pull payroll and immigration exports only when the survivor or counsel has lawful access.
- document payment confirmation numbers and wire references from the survivor's own records.
- correlate aliases with osint-normalizer + multi-source-entity-resolver — indicators only, not a trafficking score.
- immediate danger or immigration-status questions → Polaris hotline 1-888-373-7888 before deep forensics.
the path
safety → hash exports → recruitment chat metadata → payroll / immigration exports → burner and sim artifacts → entity resolution. i-9 forgery detector · sub-minimum-wage payroll-shape detector · multi-victim correlation kit are on the atlas BUILD backlog — this path uses tools on disk today.
1. evidence manifest generator
sha-256 inventory of chat exports, payroll csv, immigration packets, and payment records.why first: NGO and counsel handoffs cross jurisdictions — hash before anyone forwards a zip.
2. ios whatsapp artifact forensic extractor
chatstorage.sqlite and related plists from ios backup — recruitment thread ordering and contact clusters.why second: recruitment often starts in whatsapp before payroll records exist.
3. android whatsapp database forensic analyzer
msgstore.db from android when the survivor device is not ios-only.why third: parallel evidence plane — do not assume ios parity.
4. ios telegram artifact forensic extractor
telegram artifacts from ios backup when recruitment moved off whatsapp.why fourth: brokers often pivot channels when accounts are reported.
5. android telegram database forensic extractor
android telegram databases for the same recruitment window.why fifth: cross-platform recruitment leaves split exports.
6. telegram desktop tdata artifact forensic extractor
desktop tdata folder when recruitment happened on a shared or work computer.why sixth: desktop sessions preserve account ids when mobile apps were wiped.
7. fragomen immigration export forensic analyzer
immigration case export rows when counsel holds a fragomen-shaped packet — visa timeline and user audit fields.why seventh: H-2B/TPS-shaped cases often have immigration exports separate from chat.
8. workday payroll export forensic analyzer
payroll export rows — withholding shape, pay run anomalies, ghost-line indicators.why eighth: debt-bondage and wage theft show up as payroll shape before narrative statements.
9. case report generator
bundle hashed exports and finding summaries for counsel, NGO records, or agency referral packets.why last: one readable timeline for advocates who were not in the export pull.
common false leads
- treating this as employer-side payroll fraud without recruitment-channel context — ghost employees and wage theft patterns overlap but the narrative differs.
- assuming BEC wire fraud tooling replaces survivor-held payment confirmations — treasury exports are employer-side; survivors often hold western union receipts in photos or email.
- running device tools before the survivor is safe — opsec failure can escalate coercion.
- presenting correlator output as a trafficking determination — every row is an indicator for qualified review.
what we can tell you, what we can't
we can tell you:
- sha-256 manifest for multi-export NGO packets
- whatsapp/telegram thread metadata and contact clustering from consented backups
- payroll withholding and adjustment anomalies in workday-shaped exports
- immigration export timeline rows in fragomen-shaped packets when counsel provides them
we can't tell you:
- whether a situation meets TVPRA or any trafficking statute — that is legal conclusion, not tool output
- broker-side records the survivor does not possess without legal process
- upload survivor data to fatcousin servers — processing is browser-local only
- guarantee prosecution, asylum grant, or civil recovery outcomes
handing it off
- NGO advocate: hashed exports + indicator summaries — no unhashed email of chat databases.
- immigration / civil counsel: timeline pdf + payroll and immigration finding exports with explicit indicator language.
- law enforcement (when survivor consents): manifest + original exports on encrypted media — chain-of-custody beyond this page's scope.
case type: labor trafficking investigation · related: global mobility audit · compare case types →