Test Scenario — Human Trafficking
human trafficking · intermediate · 3 devices · 6h
Scenario overview
A mid-tier labor trafficking operation is exploiting undocumented workers along the Seattle-Portland corridor, forcing victims into commercial cleaning contracts and restaurant kitchen work under debt bondage. The network is coordinated by a recruiter in Portland who funnels workers to a logistics manager in Seattle, with a corrupt labor broker serving as the financial layer. Evidence spans encrypted messaging, falsified employment records, and financial transactions that students must trace across three devices to expose the full operation.
Investigation trigger
A social worker at a Portland community health clinic files a tip with the Oregon Human Trafficking Hotline after a patient presents with signs of malnourishment and labor exploitation, mentioning a contact name 'Marco' and a cleaning company called Cascadia Fresh Services. The tip is forwarded to a joint DHS-Seattle PD task force, which obtains warrants for three devices recovered during a welfare check at a Tacoma labor housing site.
Characters
Raymond Chu
"RC / Ray"
Owner of Pacific Rim Bookkeeping Solutions LLC, providing accounting services to small businesses in the Seattle area
Raymond is a 52-year-old Seattle resident with a clean public record and a professional reputation in the local small-business community. He launders trafficking proceeds through his bookkeeping LLC by logging victim debt payments as legitimate service invoices. He communicates almost exclusively through the Ledgr app on his device and keeps his SMS traffic deliberately mundane.
Marco Delgado-Ruiz
"Marco / M"
Independent contractor and part-time driver for a Portland logistics company
Marco is a 34-year-old Portland resident with a prior misdemeanor record. He recruits workers through Spanish-language Facebook groups and community bulletin boards, advertising legitimate cleaning and kitchen work. He serves as the day-to-day handler, controlling victim movement and collecting debt payments.
Diane Voss
"Di / DVoss"
Operations manager for Cascadia Fresh Services, a licensed commercial cleaning company based in Seattle
Diane is a 41-year-old Seattle resident who manages the legitimate-facing side of the enterprise, scheduling cleaning contracts with commercial clients and coordinating worker placement. She believes her careful language and business framing insulates her from legal exposure. She manages the interface between Chu's finances and Marco's ground operations.
Device assignments
Marco Delgado-Ruiz "Marco / M"
Recruiter and victim controller — Portland-based ground operator
Diane Voss "Di / DVoss"
Logistics and placement coordinator — Seattle-based mid-level manager
Raymond Chu "RC / Ray"
Financial controller and enterprise administrator — top of the network
Evidence chain
SMS thread between Marco (+15035550182) and Diane (+12065550347) from 11 days prior to device seizure. Marco texts: 'got 3 fresh starts coming up from pdx thursday. two kitchen one cleaning. owe on the ticket is 2400 each. gonna put em at the house til the first manager shift'. Diane replies: 'Confirmed. I'll update the cleaning schedule. Make sure they understand the contract work terms before they arrive.'
Discovery: Student exports SMS database from Device 1 using Cellebrite or Axiom, searches for contact labeled 'Di' and reviews the thread. Keyword search on 'fresh start' or 'house' surfaces the message.
→ Establishes the recruitment-to-placement pipeline, introduces the concept of debt bondage ('owe on the ticket'), and links Device 1 to Device 2 via phone number +12065550347.
Call log on Device 1 shows 14 outgoing calls to +12065550347 over 21 days, averaging 3-6 minutes each. Additionally, 6 calls to an unidentified number +15035550901 (saved as 'W2') lasting under 60 seconds — consistent with check-in calls to a controlled victim. No calls to +12065550819 (Chu) whatsoever.
Discovery: Student reviews call logs in Cellebrite Physical Analyzer or Axiom, notes frequency and duration patterns with Di's number and the anomalous short-call pattern to W2. The complete absence of contact with Device 3's number is noted.
→ Demonstrates the operational relationship with Diane and the victim control pattern. The W2 contact label corroborates the coded naming of victims and introduces the question of who is above Diane.
A PDF file stored in Device 1's Downloads folder named 'cascadia_onboard_template.pdf'. The document is a fake employment agreement for Cascadia Fresh Services with blanks for worker names, filled in for one individual with initials 'E.R.'. The document lists a fabricated $2,400 'relocation and placement fee' as a deduction from future wages, with no minimum wage guarantee. The form is dated and carries a Seattle business address.
Discovery: Student browses the file system or uses Axiom's document artifact view to locate the PDF in Downloads. Hashing the document and comparing to Device 2's file store reveals the same template was generated from Diane's device.
→ Provides the physical debt bondage instrument. The Cascadia Fresh Services name and Seattle address connects to Diane's cover story. The template origin points to Device 2 as the document's source.
SMS thread on Device 2 between Diane (+12065550347) and Raymond Chu (+12065550819), saved as contact 'RC — Pacific Rim'. Message from Diane 9 days prior to seizure: 'Week 3 summary ready. Total handling fees collected: 3 workers, $1,800. Two still slow on rent — W1 and W3. One settled up early. Sending invoice summary to the agency account tonight.' Chu responds 22 minutes later: 'Invoice logged. Ref INV-2024-1047. Remind M the schedule needs to stay tight or we lose the Tacoma client.'
Discovery: Student examines Device 2's SMS database, searches for contact 'RC' or filters by +12065550819. The thread appears sparse (only 11 messages over 30 days) but each message carries high evidential value. The invoice reference number INV-2024-1047 becomes a pivot point.
→ Establishes Diane's reporting relationship to Chu, surfaces Raymond Chu's identity and phone number (+12065550819), and introduces the financial laundering mechanism via invoice references. The Tacoma client reference corroborates the stash house location.
Device 2 has a custom app called 'ShiftBoard' installed (com.cascadiafresh.shiftboard). The app's local SQLite database (shiftboard.db) contains a worker_assignments table with columns: worker_code, site_name, start_date, debt_balance, payments_received, and assigned_by. Three active entries show worker codes W1, W2, W3 assigned to 'Tacoma Res. Site' and two Seattle commercial addresses. Debt balances of $2,400 each, with partial payment entries. The assigned_by field contains 'MDR' — Marco Delgado-Ruiz's initials.
Discovery: Student uses Axiom or manual file system browsing to locate ShiftBoard's app data directory under /data/data/com.cascadiafresh.shiftboard/databases/. Parsing the SQLite database with DB Browser or Axiom's database viewer reveals the worker tracking table. The debt balance figures match amounts in Marco's SMS.
→ Provides the operational record linking worker codes to real debt balances and locations, corroborating SMS evidence from Device 1. The 'MDR' assigned_by value ties Marco to the assignments. Site addresses can be submitted as locations for victim welfare checks.
A spreadsheet file named 'staffing_costs_oct.xlsx' in Device 2's internal storage Documents folder. The file contains rows labeled by worker code (W1–W5), columns for 'placement fee', 'weekly deduction', 'balance remaining', and 'invoice ref'. Invoice references match the format seen in Diane-Chu SMS (INV-2024-XXXX series). A separate tab labeled 'RC Submissions' lists dates on which summaries were sent to an email address: rchu@pacificriminvoicing.com.
Discovery: Student locates the XLSX file via file system browser or Axiom document artifacts. The email address in the 'RC Submissions' tab is a critical link. Cross-referencing the invoice reference numbers from Diane's SMS thread confirms this spreadsheet is the source document for financial reports to Chu.
→ Provides the financial record bridging Device 2 and Device 3. The email address rchu@pacificriminvoicing.com corroborates Chu's identity and business entity. Students should flag this for subpoena of email records.
Device 3 has a custom app called 'Ledgr' installed (com.pacificrim.ledgr). The app's encrypted SQLite database (ledgr_main.db) is protected by a 4-digit PIN, but the PIN hash is stored in SharedPreferences as a SHA-1 value recoverable by a rainbow table attack (PIN: 7291). The decrypted database contains a client_accounts table with a client named 'Cascadia Ops', total revenue logged as $31,400 over 8 months, line items referencing INV-2024-1001 through INV-2024-1047, and a notes field on several entries reading 'handling fees — per DV'. A second table, contact_notes, contains a single entry for 'M in PDX — ground ops, reports to DV, do not contact directly'.
Discovery: Student locates the Ledgr app data directory at /data/data/com.pacificrim.ledgr/databases/. Initial attempt to open ledgr_main.db fails due to encryption. Examining SharedPreferences XML file reveals a key 'pin_hash' with a SHA-1 value. Student runs the hash against a provided rainbow table (or uses hashcat with rockyou) to recover PIN 7291. Decrypted database is opened in DB Browser, revealing the full financial record.
→ This is the crown jewel evidence. The Ledgr database establishes Chu as the financial controller, links him to Diane ('per DV'), acknowledges Marco's role and the deliberate firewall ('do not contact directly'), and provides 8 months of laundered proceeds totaling $31,400. Combined with prior evidence, this supports charges across all three defendants.
SMS thread on Device 3 between Chu and an unknown number +12065550512 (saved as 'Atty — NR'), 6 days before seizure. Chu texts: 'Need to talk about the Cascadia account. Some of the invoice documentation may need to be cleaned up. Can we meet Thursday.' The contact replies: 'Call me, don't text about this.' No further messages. A deleted SMS (recoverable via unallocated space carving) from 3 days prior shows Chu texting Diane: 'Heard there was a welfare check near the Tacoma property. Pause all manager shifts for 72 hours.'
Discovery: Student reviews Device 3 active SMS database to find the attorney contact thread. To find the deleted message to Diane, student must perform deleted data recovery — in Axiom using the 'Recover Deleted Data' module or in Autopsy using the SQLite Deleted Records Carver plugin. The recovered deleted SMS is the critical link showing Chu had awareness of law enforcement activity and directed a pause in operations.
→ The active SMS shows consciousness of guilt and potential attorney contact regarding document destruction. The deleted and recovered SMS demonstrates Chu's operational awareness and his ability to direct Diane — closing the loop on the command hierarchy and providing evidence of obstruction. This also introduces the deleted data recovery skill for students.
Custom apps
ShiftBoard
com.cascadiafresh.shiftboardPresented as a legitimate employee scheduling and shift management app for commercial cleaning staff. In practice, it functions as a worker tracking and debt ledger tool, logging victim assignments, work sites, debt balances, and payment histories using coded worker identifiers instead of real names.
The app's local SQLite database at /data/data/com.cascadiafresh.shiftboard/databases/shiftboard.db contains a worker_assignments table with victim codes, site addresses, debt balances, payment records, and the assigned_by field. A secondary shifts_log table logs timestamps of worker check-ins at sites, providing movement history. SharedPreferences stores the logged-in username 'dvoss@cascadiafresh.com', corroborating Diane's identity. The app does not sync to a cloud backend — all data is stored locally, making device extraction the only recovery method.
Ledgr
com.pacificrim.ledgrPresented as a private client invoicing and bookkeeping app for Pacific Rim Bookkeeping Solutions LLC. In practice, it serves as Chu's off-books financial ledger for the trafficking enterprise, logging victim debt payments received from Diane as fake service invoices under the client name 'Cascadia Ops'. The app includes a contact notes function used to store operational memos about co-conspirators.
The primary database ledgr_main.db is PIN-protected with a SHA-1 hashed PIN stored in SharedPreferences (recoverable via rainbow table to PIN 7291). Once decrypted, the client_accounts table contains 47 invoice records totaling $31,400 under Cascadia Ops, with notes referencing 'handling fees' and 'DV'. The contact_notes table contains the operationally critical memo about Marco and the deliberate no-contact firewall. An audit_log table records every time the app was opened, providing a usage timeline. The app generates no network traffic and stores everything locally, meaning no cloud warrant is available — physical extraction is the only path.