Kase Scenarios – Betrayal

Welcome back to the second realistic OSINT challenge released by Kase Senarios called Betrayal. And guess what? It’s totally FREE! Rae and Espen have absolutely outdone themselves with this scenario. The quality and presentation has raised the bar yet again.

So what can we expect in this new scenario? It’s a twisted tale of love, deception, and murder, where you fill the shoes of P.I. Lucien Grey on a gripping journey, exposing the truth of who BETRAYED Connie Blackwood.

So lets get started.

But before I do I’d also like to say, I have omitted parts of the storyline and visual creativity as this is what makes this challenge so much fun. Where possible I don’t want to spoil the drama Kase Scenarios have worked so hard to create and I want to try and focus only on whats important for my learning journey. If you like what you see, definitely sign up to experience it in person at https://courses.kasescenarios.com/courses/betrayal

And incase you missed it.. it’s FREE!!

With that said, lets really get started.

Connies Story

The scene is set with with audio from medical examiner Deborah Johnson performing an autopsy on the now deceased Connie Renee Blackwood. This audio includes details describing the the deceased, the types of injuries sustained and a determination of the cause of death. All extremely useful in setting the scene and giving us some context to work with.. either now or later in the investigation.

The 411

Our story starts as we get called in by assistant district attorney, Ginny Brooks. In this scenario we play the role of Private Investigator Lucien Grey. Ginny wants our help to investigate Connies death and provides us with a number of documents, interrogation audio and potential witnesses,

I wont include all the files here, only captures of information found useful in solving the case.

Detective Marsh Interview: Victor Blackwood

We have received an audio recording of a interview with Victor Blackwood (Connies husband) by Detective Marsh at the Chatham County Police Department. This interview covers Victors relationship with Connie, timings and alibi’s from the night in question. All very useful information in our investigation. Victor also provides a copy of his business card as shown below.

Working The House

In this section Ginny suggests we take a visit to the Blackwoods residence and examine the crime scene. There’s a few questions that need answering to tidy up a few loose ends.

The case report says that no alarms were triggered but it didn’t state if there is an alarm at the Blackwood residence. We’re provided a virtual link where we can explore the crime scene in 3D and as part of this we now know that the property is located at 12 Eagle Point Drive, Savannah, GA

Scene Of The Crime

[Question] I need to note down the brand name of the alarm system

So this is where we just need to take a look around inside the house, like we would in a real world investigation. Explore the house, inside and out and pay attention to your surroundings.

[Question] How many computers are there in the house?

For some reason forensics didn’t remove any devices from the house so we need to check for any any and add to our investigation report. This again is an observational test and relies on our feet (virtual) and eyes to explore the scene. have a look around and pay attention to some of the obvious spaces, such as studies, libraries, desks etc.

While searching the property, our colleague Simone Russo discovers a USB flash drive hidden under a table. Unfortunately when we try to access it, it’s encrypted with a password. We do find a weird sticky note on an office desk with the following quote that could provide us with some clues.

[Question] What is the password to the flash drive?

So i’ll be totally honest. This is one of the two times in this scenario my momentum slowed.

My initial process was to start by identifying where this quote came from and immediately we identify this as a quote from “The Adventure of the Speckled Band”. This was written by Sir Arthur Conan Doyle and is the eighth story of twelve in the collection The Adventures of Sherlock Holmes. This is great.. but I still have no idea what the password is.

Just like in real life brute forcing, there’s no shame in trying variations and combinations until we get it right.

I tried variations based on the titles of the book, the collection, main characters and also the author with no luck. Arghhh.

So taking a step back, we take another look at what we have. We have the quote and a drawing of a snake.

So focusing on the Speckled Band and searching google again, I get the following result.

One more thing we need to check and add to our investigation notes is how many feet the victim fell from the top of the staircase to the bottom. Ginny will need this for her court arguments.

[Question] Using the ruler, measure the stairs from top to the bottom.

Going back to our useful 3D virtual tour, we can utilise the Measurement Mode to measure distance, just like we would in real life.

Using the ruler, I need to measure the stairs from top to the bottom and in my case convert from metres to feet.

First Witness Account – Ms Barrera

We have a new witness who needs to be interviewed in Garden City by the name of Antonia Barrera. Ms Barrera cleans houses in the area and on the night in question Ms Barrera had pulled to the side of the road to eat a snack before her next job.

It was about 11:15pm when Ms Barrera saw someone leaving the Blackwood house in a hurry in a vehicle. Thinking something wasn’t quite right she took a photo which she provided below.

The photo is a bit dark, but we need to figure out the make and model and see if that leads us to who was potentially driving it.

[Question] What is the make and model?

If we can find the make and model of the car, we can potentially use that to search DA record.

While some people will recognise this car by sight, I’m not one of them. There are a number of online tools which facilitate searching car by photo or partial photo, In this case I have used https://carnet.ai/

Here you can upload an image and hopefully obtain  the make, model and generation of most cars. To focus on the specific vehicle I did crop it before uploading.

[Question] What sort of social media accounts(s) does Rhett Blackwood have?

Now that we know the make and model of the vehicle, lets see if we can find any connections to any persons of interest such as Rhett Blackwood, Victors brother.

I didn’t mention this earlier but we have a number of case notes which could be helpful identifying social media accounts. There’s a specific note (GA_PD_CaseNotes.jpg) from earlier inquiries that notes Rhett Blackwood being really into cars. There’s also a note at the bottom starting with FBID. It’s very possible this is a Facebook ID and worth a closer look.

The easiest way to check a Facebook profile with an ID is just to append it to a profile URL like this: https://facebook.com/profile.php?id=100090541127618

[Question] What is the post number of the car in question?

We actually want to see if there are any photos on Rhetts facebook page containing the car that Ms Barrera saw, and as we already observed in the previous answer, we just need to provide the post ID for our records.

If we open the post below, we can extract the post ID from the URL

The URL shows https://www.facebook.com/photo?fbid=173176402377063&set=a.173176835710353

[Question] What time [hh:mm] doe Ms Barrera take a photo of the car?

Now we know that Rhett owns this car and we have a credible witness who saw the car at the scene of the crime. Now we just need to know the exact time Ms Barrera took her photo.

This should be easily found if the image still contains meta data from when it was taken. Metadata is the story behind a photograph. It tells us how the image files were created, where, and when. It also describes the content of the photo, identifies the photographer, and shows you how the image was edited in post-processing.

There are many tools that can do this for you. From command line to web based. In this case I use a chrome extension called EXIFY which shows all metadata for images directly in my browser.

Interesting. It looks like Victor could have taken out a life insurance policy on Connie before she died

[Question] How much is Connies life insurance?

If we look through the file contents, we can see the following policy adjustment.

Further review of the documents contained on the USB drive show some photos that look to be taken by another Private Investigator.

So why was a PI following Connie and Rhett?

[Question]Who is behind this username?

Lets check out the users profile at https://www.youtube.com/@MuscleMan69 and see what we can identify.

The user doesn’t seem to have much activity, but they do have a link to a facebook group which could be of interest.