0%

Kase Scenarios – Betrayal

July 13, 2023 - Betrayal
Back

Welcome back to the second realistic OSINT challenge released by Kase Senarios called Betrayal. And guess what? It’s totally FREE! Rae and Espen have absolutely outdone themselves with this scenario. The quality and presentation has raised the bar yet again.

So what can we expect in this new scenario? It’s a twisted tale of love, deception, and murder, where you fill the shoes of P.I. Lucien Grey on a gripping journey, exposing the truth of who BETRAYED Connie Blackwood.

 

So lets get started.

But before I do I’d also like to say, I have omitted parts of the storyline and visual creativity as this is what makes this challenge so much fun. Where possible I don’t want to spoil the drama Kase Scenarios have worked so hard to create and I want to try and focus only on whats important for my learning journey. If you like what you see, definitely sign up to experience it in person at https://courses.kasescenarios.com/courses/betrayal

And incase you missed it.. it’s FREE!!

 

With that said, lets really get started.

Connies Story

The scene is set with with audio from medical examiner Deborah Johnson performing an autopsy on the now deceased Connie Renee Blackwood. This audio includes details describing the the deceased, the types of injuries sustained and a determination of the cause of death. All extremely useful in setting the scene and giving us some context to work with.. either now or later in the investigation.

 

The 411

Our story starts as we get called in by assistant district attorney, Ginny Brooks. In this scenario we play the role of Private Investigator Lucien Grey. Ginny wants our help to investigate Connies death and provides us with a number of documents, interrogation audio and potential witnesses,

I wont include all the files here, only captures of information found useful in solving the case.

 

Detective Marsh Interview: Victor Blackwood

We have received an audio recording of a interview with Victor Blackwood (Connies husband) by Detective Marsh at the Chatham County Police Department. This interview covers Victors relationship with Connie, timings and alibi’s from the night in question. All very useful information in our investigation. Victor also provides a copy of his business card as shown below.

 

Working The House

In this section Ginny suggests we take a visit to the Blackwoods residence and examine the crime scene. There’s a few questions that need answering to tidy up a few loose ends.

The case report says that no alarms were triggered but it didn’t state if there is an alarm at the Blackwood residence. We’re provided a virtual link where we can explore the crime scene in 3D and as part of this we now know that the property is located at 12 Eagle Point Drive, Savannah, GA

Scene Of The Crime

[Question] I need to note down the brand name of the alarm system

So this is where we just need to take a look around inside the house, like we would in a real world investigation. Explore the house, inside and out and pay attention to your surroundings.

Click here for the answer
After exploring the main areas where I would expect to find an alarm, I came across the following

We can now zoom in on this image to make out the details on the alarm panel.

Here we can confirm that this is indeed a burglar alarm and the brand name is Protection One

 

[Question] How many computers are there in the house?

For some reason forensics didn’t remove any devices from the house so we need to check for any any and add to our investigation report. This again is an observational test and relies on our feet (virtual) and eyes to explore the scene. have a look around and pay attention to some of the obvious spaces, such as studies, libraries, desks etc.

Click here for the answer

After some exploring of the property we found two rooms that look to be studies or libraries. These rooms contained desks and on closer inspection we can identify computers on the premises as shown below.

So the answer to this question and the number of computers in the house is 3 or three

 

While searching the property, our colleague Simone Russo discovers a USB flash drive hidden under a table. Unfortunately when we try to access it, it’s encrypted with a password. We do find a weird sticky note on an office desk with the following quote that could provide us with some clues.

 

[Question] What is the password to the flash drive?

So i’ll be totally honest. This is one of the two times in this scenario my momentum slowed.

My initial process was to start by identifying where this quote came from and immediately we identify this as a quote from “The Adventure of the Speckled Band”. This was written by Sir Arthur Conan Doyle and is the eighth story of twelve in the collection The Adventures of Sherlock Holmes. This is great.. but I still have no idea what the password is.

Just like in real life brute forcing, there’s no shame in trying variations and combinations until we get it right.

I tried variations based on the titles of the book, the collection, main characters and also the author with no luck. Arghhh.

So taking a step back, we take another look at what we have. We have the quote and a drawing of a snake.

So focusing on the Speckled Band and searching google again, I get the following result.

Click here for the answer

So the password to the USB flash drive is swampadder

 

One more thing we need to check and add to our investigation notes is how many feet the victim fell from the top of the staircase to the bottom. Ginny will need this for her court arguments.

 

[Question] Using the ruler, measure the stairs from top to the bottom.

Going back to our useful 3D virtual tour, we can utilise the Measurement Mode to measure distance, just like we would in real life.

 

Using the ruler, I need to measure the stairs from top to the bottom and in my case convert from metres to feet.

Click here for the answer

The distance from top to bottom is approximately  17 feet

 

First Witness Account – Ms Barrera

We have a new witness who needs to be interviewed in Garden City by the name of Antonia Barrera. Ms Barrera cleans houses in the area and on the night in question Ms Barrera had pulled to the side of the road to eat a snack before her next job.

 

Late Night Escape Challenges

It was about 11:15pm when Ms Barrera saw someone leaving the Blackwood house in a hurry in a vehicle. Thinking something wasn’t quite right she took a photo which she provided below.

The photo is a bit dark, but we need to figure out the make and model and see if that leads us to who was potentially driving it.

 

[Question] What is the make and model?

If we can find the make and model of the car, we can potentially use that to search DA record.

While some people will recognise this car by sight, I’m not one of them. There are a number of online tools which facilitate searching car by photo or partial photo, In this case I have used https://carnet.ai/

Here you can upload an image and hopefully obtain  the make, model and generation of most cars. To focus on the specific vehicle I did crop it before uploading.

 

Click here for the answer

So the make and model of this car will be Chevrolet Chevelle

 

[Question] What sort of social media accounts(s) does Rhett Blackwood have?

Now that we know the make and model of the vehicle, lets see if we can find any connections to any persons of interest such as Rhett Blackwood, Victors brother.

I didn’t mention this earlier but we have a number of case notes which could be helpful identifying social media accounts. There’s a specific note (GA_PD_CaseNotes.jpg) from earlier inquiries that notes Rhett Blackwood being really into cars. There’s also a note at the bottom starting with FBID. It’s very possible this is a Facebook ID and worth a closer look.

The easiest way to check a Facebook profile with an ID is just to append it to a profile URL like this: https://facebook.com/profile.php?id=100090541127618

Click here for the answer

Reviewing the profile we can confirm that it does indeed belong to Rhett and we confirm photos of a car similar to what Ms Barrera had observed.

 

So a social media account belonging to Rhett Blackwood is Facebook

 

[Question] What is the post number of the car in question?

We actually want to see if there are any photos on Rhetts facebook page containing the car that Ms Barrera saw, and as we already observed in the previous answer, we just need to provide the post ID for our records.

If we open the post below, we can extract the post ID from the URL

The URL shows https://www.facebook.com/photo?fbid=173176402377063&set=a.173176835710353

Click here for the answer

For this post the ID number is 173176402377063

 

[Question] What time [hh:mm] doe Ms Barrera take a photo of the car?

Now we know that Rhett owns this car and we have a credible witness who saw the car at the scene of the crime. Now we just need to know the exact time Ms Barrera took her photo.

This should be easily found if the image still contains meta data from when it was taken. Metadata is the story behind a photograph. It tells us how the image files were created, where, and when. It also describes the content of the photo, identifies the photographer, and shows you how the image was edited in post-processing.

There are many tools that can do this for you. From command line to web based. In this case I use a chrome extension called EXIFY which shows all metadata for images directly in my browser.

Click here for the answer

[su_spoiler title=”Click here for the answer” style=”fancy” icon=”caret-square”]The time this photo was take was at  23:12

This is strange. This photo was taken within 30 minutes of the suspected death for Connie Blackwood

 

Content On The Drive

Lets take a look at the content on the USB drive. We now have approval to download and view the encrypted zip file. We just need the password now.
[Question] What was the password?

Click here for the answer

Enter the password swampadder

 

Interesting. It looks like Victor could have taken out a life insurance policy on Connie before she died

 

[Question] How much is Connies life insurance?

If we look through the file contents, we can see the following policy adjustment.

Click here for the answer

Connies life insurance is for  $3,000,000

 

Further review of the documents contained on the USB drive show some photos that look to be taken by another Private Investigator.

 

[Question] Who do we see in this photograph?

We can compare this image of the female to the scene photos, and for the male, we can refer to images on Rhetts facebook page.

Click here for the answer

The people in this photo are Connie and Rhett

 

So why was a PI following Connie and Rhett?

 

Longshot

Ginny has been in touch with us in regards to a tip from a kid who got into an argument online and thinks the person may have something to do with Connies death.

 

Second Witness Account – Jared Foster

Calling our second witness, Jared Foster, he tells us that he likes to watch car videos online. He ended up getting into an argument with another guy who subsequently threatened Jared and said he can get away with murder and no one would know. He then sent Jared a DM to a story about Connies murder saying it was no accident.

 

Online Troll

The Youtube user who made these threats was @MuscleMan69. Are they a troll, or is there something more to it?

 

[Question]Who is behind this username?

Lets check out the users profile at https://www.youtube.com/@MuscleMan69 and see what we can identify.

The user doesn’t seem to have much activity, but they do have a link to a facebook group which could be of interest.

 

If we take a look at this group at https://www.facebook.com/groups/237143225575567 we can see that the page admin is a person of interest to us.

 

 

Click here for the answer

The person behind the @MuscleMan69 Youtube profile is Rhett Blackwood

 

Now that we have Rhett Blackwoods social media accounts, we can try to find any for Connie and link the two.

So this was the second time in this scenario that I slowed and scratched my head for a bit.

 
[Question] What is Connies social media ?

The usual avenues would be to look though known accounts and document friends and family, friends of friends and so on. Id also review posts for visual indicators and look for likes or shares to identify any connections. In this case I came up with zilch. Nada. I tried searching directly for Connie, knowing her name, location and what she looked like. No luck.

 

So what should we do when we lose traction? Stop and reset. Take a break, especially if you start going down a rabbit hole and then review what we have and what we know.

 

Okay.. we’re back on track. Review all the documents we have.. or what we potentially have access to.

 

Remember when we interviewed Victor and he gave us his business card? If we review his business website at https://www.kaseportal.com/somersetblackwood there is very little to go on. However at the start of this scenario I did review a link on his site which provided forms for working with his law firm and these were hosted on Mega.nz. To be honest, at the time I thought little of it.. until now.

 

Take a look yourself and you’ll find what you are looking for.

Click here for the answer
If we open the share for the forms, we are taken to https://mega.nz/folder/0vM11YIA#XYDI1YfTF-4Ei5rxt4F84Q/folder/d39wAKIIFrom here we see a fairly standard form and a logo. Not exactly helpful.. but wait.Just like in a normal file browser, we have rights to go up a level by clicking on the “blackwood” parent folder.In here we see a number of folders, and if we open “Security” we see a file called Con_Tiktok_05082023.mp4This is a TikTok video created by Connie Blackwood and her username (and location) is overlaid on the video.

Connies username for TikTok is conniebwood

 
Out of curiosity, I wonder what the last video was that Connie posted to TikTok?

 
[Question] What is the TikTok video ID of the last post made ?

Knowing Connies TikTok username, we can go to her profile at https://www.tiktok.com/@conniebwood

 

To identify when a video was shared, open the video in question and inspect the page source. Then search for ‘createdate’ and you should see something similar to: createTime”:”1683413794″ which is in a epoch format. We can then convert that using an online converter such as https://www.epochconverter.com/
 

As far as I know, there is no easy way to view TikTok video creation dates/times, but i’ll be keen to learn if there is.

Click here for the answer

So if we convert the epoch time we found in the source code, we should see something like this.

If we compare videos we can identify the last video and it’s ID posted by Connie.

The video ID of Connies last post is  7230207135584603438

 

The Other Man

uh oh.. Looks like Connie may have been having a relationship with Rhett Blackwood and all three were at the Blackwood home on the night of her murder. Not only that, we have the increase in her life insurance policy. There certainly seems like motive worth investigating.

 

On The Trail

Now that we have obtained new evidence it’s time to interview Victors brother Rhett and see what he has to say about all of this.

 

Report Lesson

This was one of my favourite sections. Take the information we have obtained and wrote a note to Ginny (this will be reviewed in the real world) on the likelihood that Victor Blackwood could have killed Connie.

 

Lone Wolf

You’ll have to create your own report in PDF format and submit it for review on whether Victor could physically be with Connie at the time of death given he was sighted on cctv later that night.  What we do know is the following: Connie died at 10:45pm and a video from the Lone Wolf Lounge confirms Victor Blackwood was there at 10:53pm. Based on the facts we have gathered throughout this scenario, we have to submit a report to Ginny validating if this is or isn’t possible.

No you can’t have mine 🙂

If you’ve made substantiated observations, you should get confirmation back from Ginny that they will be presented in court. Well done!

 

 

There’s more.. but not from me

So what really happened and why? Well I’d love to tell you. You’d love to hear it, but wheres the fun in that. If you want to know, you’ll have to go and check it out yourself.

https://courses.kasescenarios.com/courses/betrayal

And did I mention it’s FREE!!

 

Until next time.

pizza party time

 

 

In Loving Memory of

Connie Blackwood

 

 

Tagged as:  /  /  /  / 

Play Cover Track Title
Track Authors