// first 10 minutes
labor trafficking investigation — quick-start
labor trafficking — first 10 minutes. safety and consent before any evidence collection. print this, check boxes, then run the primary tools.
checklist
- confirm all potential victims are in a safe location before collecting any evidence — call the National Human Trafficking Hotline (1-888-373-7888) if immediate safety is uncertain.
- do not collect evidence that identifies victims without their explicit informed consent — victim cooperation is voluntary; evidence collection is not.
- preserve any recruiter contracts, job posting screenshots, or employment agency communications before the recruiting party can delete them.
- export wage ledgers, pay stubs, or payment records for the workers in question — note any deductions for housing, transport, or equipment that reduce net pay to zero.
- preserve any movement records: tickets, itineraries, border crossing documents, or transport receipts that document the victim's movement.
- photograph or preserve living and working conditions documentation if legally accessible — housing contracts, facility photos, sanitation logs.
- note the debt bondage structure if present: initial debt amount, deduction rate, and whether the debt is structured to never reach zero.
- identify the corporate entities involved: labor recruiter, employer of record, staffing agency, and end-client — trafficking often routes through layered corporate structures.
- contact law enforcement or the DHS Blue Campaign before public disclosure — trafficking operations can move victims rapidly when alerted.
- begin the primary tool path below — labor trafficking evidence correlator.
primary tools
- 01evidence manifest generatordrop evidence files · compute md5 sha1 sha256 · chain of custody manifest · case number · analyst · export pdf and csv · runs locally
- 02iOS WhatsApp artifact forensic extractordrop iOS WhatsApp ChatStorage.sqlite and Contacts.sqlite · parse all chats, messages, groups, and media references · reconstruct conversation timelines with delivery status · surface location shares, contact cards, and deleted message placeholders · runs locally
- 03android whatsapp database forensic analyzerdrop an Android WhatsApp msgstore.db · parse all messages, chats, groups, and media metadata · reconstruct conversation timelines · surface message delivery status, forwarding metadata, location shares, and contact cards · detect deleted message gaps · runs locally
- 04ios telegram artifact forensic extractordrop cache4.db or account db · parse chats messages channels · forwarding edits tombstones · disappearing timers · mid gap analysis · runs locally
- 05android telegram database forensic extractordrop Android Telegram database files · parse messages, chats, channels, and contacts · extract forwarding metadata, edit timestamps, and media references · surface disappearing message timer settings · detect deleted message ROWID gaps · reconstruct Telegram communication timeline · runs locally
- 06telegram desktop tdata artifact forensic extractordrop telegram desktop tdata folder · parse user.id / D877F783D5D3EF8C cache · surface account session + chat history · runs locally
- 07fragomen immigration export forensic analyzerdrop fragomen export · parse case + visa + user · runs locally
- 08workday payroll export forensic analyzerdrop workday payroll export · parse payment + earning + user · runs locally