ILLUSTRATIVE · FICTIONAL CASE · SYNTHETIC DATA · INVESTIGATIVE LEAD, NOT PROOF OF INVOLVEMENT
Evidenx
Reasoning Layer · Mobile Device Forensics — Human Trafficking (demo)
Hypothesis Card
Evidenx™ does not score. This card presents an investigative lead correlating mobile-device evidence with independent, external sources in an active human-trafficking investigation. It is not a determination that any named individual engaged in trafficking; the individual referenced is presumed innocent. Weighing the evidence is for investigators and prosecutors, never this system.
Step 1 of 8
Scope & signal reduction
What the task force file contained
A hotline tip led to a welfare check and the recovery of one individual. A phone seized from a person of interest under warrant is one of six evidence streams examined; mobile-device extraction is a single input among several independent sources, never the sole basis for a lead. Nothing is discarded; this layer organises and correlates, it does not conclude.
6
evidence streams examined
evidence streams examined
→
3
independent sources corroborate the device lead
independent sources corroborate the device lead
→
4
explanations tested
explanations tested
Hotline intake
2026-06
initial report
Mobile device forensics
Cellebrite UFED
message & media recovery
Carrier records
subpoena returned
cell-site location
Financial records
subpoena returned
transaction history
Ad-platform preservation
request fulfilled
listing archive
Victim interview
forensic interview
trauma-informed
Step 2 of 8
The finding
An investigative lead, not a determination of involvement
Cellebrite UFED extraction of a phone seized from a person of interest, referred to here as Individual A, recovered deleted messaging-app conversations referencing a meeting at a specific motel on the date the recovered individual was located there. Extraction output is one input among six evidence streams and is not treated as sufficient on its own. Independently obtained carrier cell-site records, a financial-transaction record, and a preserved ad-platform listing, addressed on the next page, are what elevate this from a single device artifact to a corroborated investigative lead. It is not a determination that Individual A engaged in trafficking.
recovered viaCellebrite UFED extraction (mobile device)deleted-message recovery
evidence inmobile device forensics case file
A device artifact is a lead, not proof, and is not treated as proof on its own here, see the independent corroboration on the next page. Individual A is presumed innocent. Whether this evidence supports further action is for investigators and prosecutors to decide, never this system.
Step 3 of 8
Corroborating context
Independent sources, not the device itself
Carrier cell-site records
spatial
Cell-site location records obtained directly from the carrier, not extracted from the phone, place the device in the vicinity of the motel during the window described in the recovered messages. Independent of, and consistent with, the device extraction.
Financial transaction record
provenance
A payment-app subpoena returned a transaction matching the amount referenced in the recovered messages, drawn from the payment provider's own records rather than the phone. A second, independent line of corroboration.
Preserved ad-platform listing
identity
A listing preserved directly from the platform under a preservation request uses phrasing that matches the recovered messages, with an image whose metadata is consistent with, but not proof of, the same handset. Obtained from the platform, not the device.
Cellebrite output is one input among several. It is the convergence of the carrier's, the payment provider's, and the platform's own independently-held records, not the device extraction alone, that elevates this from an artifact to a corroborated lead.
Step 4 of 8
Timeline
Tip, recovery, and corroboration
2026-06-02 Hotline tip received naming a motel and describing a possible trafficking situationincident
2026-06-03 Welfare check conducted; one individual recoveredincident
2026-06-03 Recovered individual connected with victim services; voluntary forensic interview scheduledcase
2026-06-05 Warrant issued for a phone linked to a person of interestcase
2026-06-06 Phone seized pursuant to warrantevidence
2026-06-10 Cellebrite UFED extraction completed; deleted messages recoveredforensics
2026-06-14 Carrier CSLI subpoena returned (independent corroboration)forensics
2026-06-20 Financial-institution subpoena returned (independent corroboration)forensics
2026-06-25 Ad-platform preservation request fulfilled (independent corroboration)forensics
2026-07 Investigative lead compiled for prosecutorial reviewcase
Step 5 of 8
Alternative explanations considered
Innocent explanations, tested against the evidence
Legitimate, unrelated arrangement
The recovered messages reference a meeting and a payment but do not, on their own, establish purpose. A legitimate explanation (a room booking, an unrelated transaction) is not excluded by message content alone.
Device not used by Individual A at the relevant time
The phone was seized from Individual A, but who held and operated it during the specific messaging window is not yet established. Device-usage and biometric-unlock analysis, addressed on the next page, is pending.
Ad-platform listing unrelated or misattributed
The preserved listing's phrasing and image metadata correlate with the recovered messages, but the listing could be a copied or templated post unconnected to this incident. Platform account logs, not yet returned, would speak to this directly.
Coincidental financial transaction
The transaction amount matches the messages, but a matching amount alone does not establish that the payment relates to this incident. Not yet excluded absent further transaction context.
Competing, innocent explanations are held side by side with the lead and tested against what the evidence does and does not distinguish, the same alternative-hypotheses / expected-but-absent machinery used in the DFIR layer. Surfacing these explanations is a feature, not an omission.
Step 6 of 8
Expected but not yet collected
Absence and limits, recorded honestly
Platform account logs
not_collected
Login history and account-holder details behind the preserved listing have been requested from the platform but not yet returned. Needed to address the misattribution alternative.
Device-attribution analysis
not_collected
Biometric-unlock and usage-pattern analysis tying the phone specifically to Individual A, rather than another user of the same device, is pending forensic review.
Extended CSLI history
not_collected
The carrier request covered a narrow window around the recovery date; a broader historical request has not been made and would require additional legal process.
Follow-up interview with the recovered individual
not_collected
A second, trauma-informed interview has not yet been conducted; timing is paced by victim services, not by this investigation. Its absence carries no weight for or against any explanation.
absent (searched, not found / no longer available) is evidentiary; not_collected (never gathered, not yet lawfully obtainable, or paced by victim welfare) is a collection-scope fact and is never weighed against a person. In a human-trafficking investigation this distinction is not a nicety, it is fundamental, both to due process for Individual A and to the pace of recovery for the individual involved.
Step 7 of 8
Understanding
Bounded & factual: a lead, not a verdict, no score
Deleted messages recovered via Cellebrite UFED extraction from a phone linked to Individual A have been corroborated by three independently-sourced records, carrier cell-site data, a financial-institution transaction, and a preserved ad-platform listing, none of which were extracted from the device itself. Four alternative explanations remain open, including whether Individual A was the phone's user during the relevant window and whether the platform listing is connected to this incident at all. Platform logs, device-attribution analysis, and a fuller CSLI history have not yet been obtained. This is an investigative lead built from multiple independent sources, not a determination of trafficking or involvement, and carries no score. Individual A is presumed innocent.
3 independent corroborating sourcesalternative explanations: 4 openevidence gaps: 4 not collected
Step 8 of 8
Conclusion
The call is the investigators' and prosecutors'. Evidenx™ stops at understanding
Evidenx™ has taken the task force file and its evidence to data, to information, to understanding, the structured, corroborated, bounded picture on the preceding pages. It stops here. The conclusion is the investigators' and prosecutors' to make.
data → information → understanding → their conclusion
Evidenx™ has not decided, and does not decide: whether trafficking occurred, whether Individual A was involved, or any charging decision. There is no score, rank, or confidence value in this card.
For investigators and prosecutors to determine:
- Whether the corroborated lead, together with the outstanding device-attribution analysis, supports further action.
- Which alternative explanations survive scrutiny.
- Whether platform logs and an extended CSLI history are needed before proceeding.
- The investigative next step, coordination with victim services, and any referral for a charging decision.
The investigator determination
Left intentionally blank. This is the investigators' and prosecutors' conclusion to record. Evidenx™ provides the evidence, not the verdict.