Welcome back to the second realistic OSINT challenge released by Kase Senarios called Betrayal. And guess what? It’s totally FREE! Rae and Espen have absolutely outdone themselves with this scenario. The quality and presentation has raised the bar yet again.
So what can we expect in this new scenario? It’s a twisted tale of love, deception, and murder, where you fill the shoes of P.I. Lucien Grey on a gripping journey, exposing the truth of who BETRAYED Connie Blackwood.
So lets get started.
But before I do I’d also like to say, I have omitted parts of the storyline and visual creativity as this is what makes this challenge so much fun. Where possible I don’t want to spoil the drama Kase Scenarios have worked so hard to create and I want to try and focus only on whats important for my learning journey. If you like what you see, definitely sign up to experience it in person at https://courses.kasescenarios.com/courses/betrayal
And incase you missed it.. it’s FREE!!
With that said, lets really get started.
The scene is set with with audio from medical examiner Deborah Johnson performing an autopsy on the now deceased Connie Renee Blackwood. This audio includes details describing the the deceased, the types of injuries sustained and a determination of the cause of death. All extremely useful in setting the scene and giving us some context to work with.. either now or later in the investigation.
Our story starts as we get called in by assistant district attorney, Ginny Brooks. In this scenario we play the role of Private Investigator Lucien Grey. Ginny wants our help to investigate Connies death and provides us with a number of documents, interrogation audio and potential witnesses,
I wont include all the files here, only captures of information found useful in solving the case.
We have received an audio recording of a interview with Victor Blackwood (Connies husband) by Detective Marsh at the Chatham County Police Department. This interview covers Victors relationship with Connie, timings and alibi’s from the night in question. All very useful information in our investigation. Victor also provides a copy of his business card as shown below.
In this section Ginny suggests we take a visit to the Blackwoods residence and examine the crime scene. There’s a few questions that need answering to tidy up a few loose ends.
The case report says that no alarms were triggered but it didn’t state if there is an alarm at the Blackwood residence. We’re provided a virtual link where we can explore the crime scene in 3D and as part of this we now know that the property is located at 12 Eagle Point Drive, Savannah, GA
[Question] I need to note down the brand name of the alarm system
So this is where we just need to take a look around inside the house, like we would in a real world investigation. Explore the house, inside and out and pay attention to your surroundings.
[Question] How many computers are there in the house?
For some reason forensics didn’t remove any devices from the house so we need to check for any any and add to our investigation report. This again is an observational test and relies on our feet (virtual) and eyes to explore the scene. have a look around and pay attention to some of the obvious spaces, such as studies, libraries, desks etc.
While searching the property, our colleague Simone Russo discovers a USB flash drive hidden under a table. Unfortunately when we try to access it, it’s encrypted with a password. We do find a weird sticky note on an office desk with the following quote that could provide us with some clues.
[Question] What is the password to the flash drive?
So i’ll be totally honest. This is one of the two times in this scenario my momentum slowed.
My initial process was to start by identifying where this quote came from and immediately we identify this as a quote from “The Adventure of the Speckled Band”. This was written by Sir Arthur Conan Doyle and is the eighth story of twelve in the collection The Adventures of Sherlock Holmes. This is great.. but I still have no idea what the password is.
Just like in real life brute forcing, there’s no shame in trying variations and combinations until we get it right.
I tried variations based on the titles of the book, the collection, main characters and also the author with no luck. Arghhh.
So taking a step back, we take another look at what we have. We have the quote and a drawing of a snake.
So focusing on the Speckled Band and searching google again, I get the following result.
One more thing we need to check and add to our investigation notes is how many feet the victim fell from the top of the staircase to the bottom. Ginny will need this for her court arguments.
[Question] Using the ruler, measure the stairs from top to the bottom.
Going back to our useful 3D virtual tour, we can utilise the Measurement Mode to measure distance, just like we would in real life.
Using the ruler, I need to measure the stairs from top to the bottom and in my case convert from metres to feet.
We have a new witness who needs to be interviewed in Garden City by the name of Antonia Barrera. Ms Barrera cleans houses in the area and on the night in question Ms Barrera had pulled to the side of the road to eat a snack before her next job.
It was about 11:15pm when Ms Barrera saw someone leaving the Blackwood house in a hurry in a vehicle. Thinking something wasn’t quite right she took a photo which she provided below.
The photo is a bit dark, but we need to figure out the make and model and see if that leads us to who was potentially driving it.
[Question] What is the make and model?
If we can find the make and model of the car, we can potentially use that to search DA record.
While some people will recognise this car by sight, I’m not one of them. There are a number of online tools which facilitate searching car by photo or partial photo, In this case I have used https://carnet.ai/
Here you can upload an image and hopefully obtain the make, model and generation of most cars. To focus on the specific vehicle I did crop it before uploading.
[Question] What sort of social media accounts(s) does Rhett Blackwood have?
Now that we know the make and model of the vehicle, lets see if we can find any connections to any persons of interest such as Rhett Blackwood, Victors brother.
I didn’t mention this earlier but we have a number of case notes which could be helpful identifying social media accounts. There’s a specific note (GA_PD_CaseNotes.jpg) from earlier inquiries that notes Rhett Blackwood being really into cars. There’s also a note at the bottom starting with FBID. It’s very possible this is a Facebook ID and worth a closer look.
The easiest way to check a Facebook profile with an ID is just to append it to a profile URL like this: https://facebook.com/profile.php?id=100090541127618
[Question] What is the post number of the car in question?
We actually want to see if there are any photos on Rhetts facebook page containing the car that Ms Barrera saw, and as we already observed in the previous answer, we just need to provide the post ID for our records.
If we open the post below, we can extract the post ID from the URL
The URL shows https://www.facebook.com/photo?fbid=173176402377063&set=a.173176835710353
[Question] What time [hh:mm] doe Ms Barrera take a photo of the car?
Now we know that Rhett owns this car and we have a credible witness who saw the car at the scene of the crime. Now we just need to know the exact time Ms Barrera took her photo.
This should be easily found if the image still contains meta data from when it was taken. Metadata is the story behind a photograph. It tells us how the image files were created, where, and when. It also describes the content of the photo, identifies the photographer, and shows you how the image was edited in post-processing.
There are many tools that can do this for you. From command line to web based. In this case I use a chrome extension called EXIFY which shows all metadata for images directly in my browser.
Interesting. It looks like Victor could have taken out a life insurance policy on Connie before she died
[Question] How much is Connies life insurance?
If we look through the file contents, we can see the following policy adjustment.
Further review of the documents contained on the USB drive show some photos that look to be taken by another Private Investigator.
[Question] Who do we see in this photograph?
We can compare this image of the female to the scene photos, and for the male, we can refer to images on Rhetts facebook page.
So why was a PI following Connie and Rhett?
The Youtube user who made these threats was @MuscleMan69. Are they a troll, or is there something more to it?
[Question]Who is behind this username?
Lets check out the users profile at https://www.youtube.com/@MuscleMan69 and see what we can identify.
The user doesn’t seem to have much activity, but they do have a link to a facebook group which could be of interest.
If we take a look at this group at https://www.facebook.com/groups/237143225575567 we can see that the page admin is a person of interest to us.
Now that we have Rhett Blackwoods social media accounts, we can try to find any for Connie and link the two.
So this was the second time in this scenario that I slowed and scratched my head for a bit.
[Question] What is Connies social media ?
The usual avenues would be to look though known accounts and document friends and family, friends of friends and so on. Id also review posts for visual indicators and look for likes or shares to identify any connections. In this case I came up with zilch. Nada. I tried searching directly for Connie, knowing her name, location and what she looked like. No luck.
So what should we do when we lose traction? Stop and reset. Take a break, especially if you start going down a rabbit hole and then review what we have and what we know.
Okay.. we’re back on track. Review all the documents we have.. or what we potentially have access to.
Remember when we interviewed Victor and he gave us his business card? If we review his business website at https://www.kaseportal.com/somersetblackwood there is very little to go on. However at the start of this scenario I did review a link on his site which provided forms for working with his law firm and these were hosted on Mega.nz. To be honest, at the time I thought little of it.. until now.
Take a look yourself and you’ll find what you are looking for.
Out of curiosity, I wonder what the last video was that Connie posted to TikTok?
[Question] What is the TikTok video ID of the last post made ?
Knowing Connies TikTok username, we can go to her profile at https://www.tiktok.com/@conniebwood
To identify when a video was shared, open the video in question and inspect the page source. Then search for ‘createdate’ and you should see something similar to: createTime”:”1683413794″ which is in a epoch format. We can then convert that using an online converter such as https://www.epochconverter.com/
As far as I know, there is no easy way to view TikTok video creation dates/times, but i’ll be keen to learn if there is.
uh oh.. Looks like Connie may have been having a relationship with Rhett Blackwood and all three were at the Blackwood home on the night of her murder. Not only that, we have the increase in her life insurance policy. There certainly seems like motive worth investigating.
Now that we have obtained new evidence it’s time to interview Victors brother Rhett and see what he has to say about all of this.
This was one of my favourite sections. Take the information we have obtained and wrote a note to Ginny (this will be reviewed in the real world) on the likelihood that Victor Blackwood could have killed Connie.
You’ll have to create your own report in PDF format and submit it for review on whether Victor could physically be with Connie at the time of death given he was sighted on cctv later that night. What we do know is the following: Connie died at 10:45pm and a video from the Lone Wolf Lounge confirms Victor Blackwood was there at 10:53pm. Based on the facts we have gathered throughout this scenario, we have to submit a report to Ginny validating if this is or isn’t possible.
No you can’t have mine 🙂
If you’ve made substantiated observations, you should get confirmation back from Ginny that they will be presented in court. Well done!
So what really happened and why? Well I’d love to tell you. You’d love to hear it, but wheres the fun in that. If you want to know, you’ll have to go and check it out yourself.
And did I mention it’s FREE!!
Until next time.