Welcome back to Eye on the Case, our monthly brief on how investigators work, what makes cases succeed, and one sharp insight to keep you thinking.

Each edition: one core topic, one real case, one practical workflow.

This month: OSINT — and why the most useful clues aren’t always where you first look.

📂 Case Spotlight

Long before a cybercrime network gets dismantled, investigators usually start somewhere small.

A suspicious ad. A fake investment app. A domain, a phone number, a username that appears twice. Individually, none of it looks like much. But when the connections start forming, you can expose an entire operation.

Image: INTERPOL / Operation Serengeti 2.0 case breakdown

In 2025, INTERPOL coordinated Operation Serengeti 2.0 across Africa — resulting in 1,209 arrests, 88,000 identified victims, USD 97.4 million recovered, and 11,432 malicious infrastructures dismantled. The operation targeted ransomware, online scams, and business email compromise.

One of the clearest examples came from Zambia. Authorities dismantled a large-scale investment fraud scheme with 65,000 victims and an estimated USD 300 million in losses. The scam ran on cryptocurrency promises: victims were targeted through ad campaigns, nudged to download multiple apps, and pulled into a fake investment flow. Fifteen people were arrested. Domains, mobile numbers, and bank accounts were seized.

That last part matters most. The fraud wasn’t the ad — it was the system behind it. The campaign, the apps, the infrastructure, the people moving money. Investigators had to see all of it.

💡 The Lesson: OSINT isn’t just about finding suspicious content. It’s about connecting small clues into a bigger picture. Operation Serengeti 2.0 worked because investigators combined intelligence across countries — suspicious IPs, domains, command-and-control servers, financial evidence, online activity. Scattered clues became a case. That’s the real power: not collection, but connection.

👉 Read the official INTERPOL breakdown here

⚡ Tradecraft: The Operational Blindspot

Imagine a case connected to Taiwan lands on your desk. Your first instinct is familiar — X, Facebook, Instagram, LinkedIn. You search the company name, the alias, the phone number, the domain. A few results come back, but the case still feels thin.

So you stop and ask a better question: where would this conversation actually happen?

In Taiwan, that might mean PTT or Dcard, where local discussions surface before they reach wider audiences. It might mean tracking how a rumor moves through LINE communities, or how local media picks up and amplifies a claim. You’re not just searching keywords anymore — you’re mapping how information moves.

That’s the real shift. A strong OSINT workflow starts with context:

• What country is involved?

• What language do people use?

• Which search engines matter there?

• Which forums or apps do local communities trust?

• Where would people complain, organize, recruit, sell, or warn each other?

• And where would the story go next?

The same logic applies across APAC. In Japan, LINE and 5channel often carry more than the platforms you check daily. In South Korea, Naver and KakaoTalk hold local context that never reaches Western feeds. In China, no single platform is enough — Weibo, WeChat, Douyin, RedNote, Zhihu, Bilibili, and Tieba each show different pieces of how a topic appears, spreads, or disappears.

Don’t start with the platform you know best. Start with the region, the language, and the behavior around the case — because the most useful lead might be on the platform your subject actually uses, not the one you default to.

👉 Read the full article: Beyond Mainstream Platforms

⚙️ Falkor in Action

OSINT work usually starts with a single search — a keyword, a username, a phone number, a domain. But the work spreads fast: one tool for social media, another for forums, another for dark web sources, notes in a spreadsheet, locations in a map, reporting in a separate doc. That’s where context gets lost.

In Falkor, the workflow stays in one place:

Search across social networks, news, blogs, forums, Reddit, Telegram, and dark web sources. Filter results by platform, time, author, or relevance.

Use AI to summarize large result sets, detect narratives, translate content, and extract key entities. Save findings — posts, accounts, phones, domains, locations — directly into the case. Connect the dots through link analysis, timelines, entity profiles, and reports.

The case grows as the search develops. Less time managing tools, more time building the picture.

👉 Request a demo and see the full picture.

Each month, we’ll pick one core topic and break it down through a wild fact, an educational deep dive, and a practical workflow.

For our very first edition, we are looking at Digital Forensics and why looking at a single device extraction is never enough.

📂 Case Spotlight

Long before modern smartphones became evidence goldmines, digital forensics experts were already tracing criminals through forgotten metadata and deleted files. Remember floppy disks? The original “save” icon.

For more than 30 years, the “BTK Killer” evaded law enforcement while taunting police and the media with letters, packages, and cryptic messages. Dennis Rader believed he was smarter than investigators — and his ego ultimately became his downfall.

In 2005, Rader mailed a purple floppy disk to a Wichita TV station.

Police found metadata embedded in a deleted Microsoft Word document that was, unknown to Rader, still stored on the floppy disk. It was a church meeting agenda written and edited by Rader himself. The metadata contained the words “Christ Lutheran Church” and the document was marked as last modified by “Dennis”.

Although the metadata provided the first real lead in decades, it was not enough to arrest Rader. Investigators used additional evidence — including a vehicle linked to the case and a familial DNA match from a relative — to build enough probable cause for his arrest.

💡 The Lesson:
Digital forensics has been around for decades. Long before smartphones and cloud data, investigators were already recovering hidden evidence from disks, deleted files, and metadata.

But digital evidence alone rarely closes a case.

In the BTK investigation, the floppy disk metadata was only the beginning. Investigators combined it with old case evidence, field intelligence, surveillance, vehicle information, and DNA analysis.

That correlation is what solved the case.

The real power of forensics is not just extracting data — it’s connecting it to the bigger investigative picture.

👉 Continue reading the official historical case breakdown here

⚡Tradecraft

The Operational Blindspot: From Device Dumps to Investigation Engines

Sticking to our forensic theme:

Detective Ray finally gets the phone dump back.

Thousands of messages. Call logs. GPS points. Selfies.

The extraction worked perfectly.

But two hours later, he’s still stuck.

One screen has the forensic dump open.
Another is running Telegram searches.
And across the room, Diane is still tracing financial transactions line by line in a spreadsheet.

Now Detective Ray is trying to figure out whether a recovered contact matches an active target from another case.

This is where investigations slow down.
Not because of missing data.
Because the data lives in separate places.

A phone dump alone is just raw evidence.

The real breakthrough happens when forensic data connects with external intelligence sources, timelines, maps, and entity analysis—all in the same workflow.

That’s how isolated artifacts become actionable intelligence.

Just like peanut butter and jelly, some things just work better when they’re together.

We broke down this exact workflow in our latest guide.

👉 Read the full article: From Device Dump to Investigation Engine

⚙️ Falkor in Action

Inside the Lab: Introducing Falkor Forensic Studio

To fix this exact blindspot, we’re introducing a new capability within our platform: Forensic Studio.

Falkor is already your all-in-one investigation hub—where you launch OSINT queries, run deep analytics, and manage entire cases. Now, we are bringing digital forensics into that exact same ecosystem. No more hopping between fragmented software; you can now centralize your entire lifecycle in one place:

• All-in-One Forensic Management: Centralize device extractions, manage chat flows, location data, and call durations seamlessly alongside your active cases.

• Instant OSINT & Data Fusion: Automatically cross-reference extracted phone numbers, emails, or entities with external OSINT sources and legacy intelligence instantly.

• From Lists to Link Analysis: Turn a massive dump of fragmented evidence into interactive entity graphs and weekly activity heatmaps on a single canvas.

From evidence to intelligence. Break down silos and keep your entire investigation workflow in one place.