Betrayal

In the case files, we can see that a Facebook ID is of interest: 100090541127618. So to navigate to the user behind the ID, we just need to visit https://www.facebook.com/100090541127618. That gives us the profile of Rhett Blackwood, Victor's weird brother who likes cars.

Reviewing his profile description, we can see that there's the potential for motive here:

All a man need is a good car, a shotgun, something good to drink and a loyal woman.

If his brother's wife was cheating, he would be the one who would take offense and see fit to rectify the situation. We have an alibi for the son and brother, but so far we don't have any information about Rhett. Something else strange on his profile is the only life event he has listed, which is being "Reborn" on 18JAN2021.


The site for Victor's law firm, "Somerset & Blackwood LLC", is https://www.kaseportal.com/somersetblackwood. The site has bare-minimum functionality, including an unimplemented contact form and payment button, so the technology itself obviously isn't of significance in this case. That being said, a link labeled form found here points to a MEGA share with an intake form; there is nothing of interesting there, but the fact that it was included is interesting itself.

A 3D model of the house in question is available for exploration at https://my.matterport.com/show/?m=1STmN3PixNG. The police officer mentioned a security system, but I can see that if I were someone looking to gain unauthorized entry to the house, I would use the screen door on the back porch that has no security outside of a flimsy flip lock. While there are no vantage points in the model good enough to be 100% positive, I am confident that there are no security cameras monitoring that entry vector, or the backyard/dock at all for that matter.

Bringing us to the first question section:

Scene Of The Crime

Question 1

"I need to note down the brand name of the alarm system"

The case report says no alarms were triggered but doesn't state whether one exists. I need to doublecheck if there is an alarm system in this house and what the brand name is.

In my experience, alarm systems are ususlly visible in a less-trafficked area of the home, such as a closet or a high-up kitchen cabinet. I can see that there is a panel in the laundry room that would be a suitable location, but since it is closed it is certainly out of scope. Unfortunately the scan doesn't include the front yard, and the vantage point in the room to the right of the main entrance doesn't show any security company signs like ADT in the front yard. The one vantage point of the side yard by the garage also doesn't contain any clues.

I found something that could be a security system outside one of the upstairs bedrooms, but changes are it's a temperature control system because there are no physical buttons:

potential_security_system.png

I did some digging into security systems online and was unable to identify any with a logo similar to the one pictured, and I was able to reverse search the image with Google Lens and determine that the pictured device is a Trane thermostat. The two computers in the front library room made me investigate closely in case either of them was hooked up to monitor potential front-facing external cameras, but no dice.

Eventually I was able to locate it by looking a bit higher than my normal FOV, it is above the key storage and below the picture of the lion in the hallway exiting the kitchen:

real_security_system

Answer: Protection One

Question 2

How many computers are there in the house?

I heard forensics didn't remove any devices from the house for some reason. I need to check for any computers and make a note of that in my report.

There are 2 on the first floor and 1 on the second floor.

Question 3

What is the password to the flash drive?

Violence does, in truth recoil upon the violent, and the schemer falls into the pit where he digs for another

password_hint.jpg

Searching up the text shows that it is a quote by Arthur Conan Doyle, in his famous work "The Adventures of Sherlock Holmes". The specific story is The Adventure of the Speckled Band, and in the story, Dr. Roylott uses a venomous snake to murder his stepdaughter, Julia. The snake is a fictional Indian swamp adder that kills its victim within 10 seconds. Holmes uses a dog-lash to capture the snake and place it back in the doctor's iron safe. The wicked stepfather is dead, and Helen Stoner is free to marry and receive her inheritance.

We can see above one of the computers that there are two Sherlock Holmes books on display:

sherlock_books.png

Reading over the Wikipedia page for the novel, one line caught my attention pretty quickly:

Helen had heard her sister's dying words, "The speckled band!" but could not decode their meaning.

Since the subject is decoding, this made me think that the password could be related to this line of the story. I tried various combinations of story tidbits, and was eventually able to guess the right password from this section of the page:

"It is a swamp adder!" cried Holmes; "the deadliest snake in India. He has died within ten seconds of being bitten."

Answer: swampadder

Question 4

Using the ruler, I need to measure the stairs from top to the bottom. Round to the nearest whole number in US imperial system (feet).

Using the measurement tool, I was able to determine that each stair is approximately 7 inches in height:

stair_measurement.png

There are 16 stairs in total, but as we can see from the picture of where the corpse was found, she only fell down to the second to last step. The final answer there of 10-11 feet was incorrect, so I decided to take a different interpretation and measure the diagonal distance to factor in the x dimension:

stair_diagonal.png

Answer: 17

Late Night Escape Challenges

Question 1

[Type the make and model below to search DA records]

thecar.jpg

On the left we can clearly see what is Rhett's vehicle, which a simple reverse search on the image from his Facebook profile tells us is a 1970 Chevrolet Chevelle.

Answer: Chevrolet Chevelle

Question 2

What sort of social media account(s) does Rhett Blackwood have?

Since we paid attention to all the case documents at the beginning of the investigation, we already had the answer to this one!

Answer: Facebook

Question 3

I wonder if I can find a photo of the car the witness saw on social media... If so, I should make a note of the post ID number for my records.

Again, we already saw the post here, so we just need to copy the URL argument to link back to the post.

Answer: 173176402377063

Question 4

[hh:mm]

There is always one person in every family who shares too much on social media... Rhett just confirmed he owns this car and Ms. Barrera, a credible witness, puts him at tht escene of the crime. Now we just need to know the exact time Ms. Barrera's photo was taken.

I was able to run exiftool on the image to get the date and time the photo was taken:

$ exiftool Pictures/thecar.jpg
ExifTool Version Number         : 12.57
File Name                       : thecar.jpg
Directory                       : Pictures
File Size                       : 208 kB
File Modification Date/Time     : 2023:06:26 12:21:07-04:00
File Access Date/Time           : 2023:06:26 12:35:54-04:00
File Inode Change Date/Time     : 2023:06:26 12:35:54-04:00
File Permissions                : -rw-r--r--
File Type                       : JPEG
File Type Extension             : jpg
MIME Type                       : image/jpeg
DCT Encode Version              : 100
APP14 Flags 0                   : (none)
APP14 Flags 1                   : (none)
Color Transform                 : YCbCr
Exif Byte Order                 : Big-endian (Motorola, MM)
Modify Date                     : 2023:05:07 23:12:00
Date/Time Original              : 2023:05:07 23:12:00
Create Date                     : 2023:05:07 23:12:00
Padding                         : (Binary data 2060 bytes, use -b option to extract)
Profile CMM Type                : Linotronic
Profile Version                 : 2.1.0
Profile Class                   : Display Device Profile
Color Space Data                : RGB
Profile Connection Space        : XYZ
Profile Date Time               : 1998:02:09 06:49:00
Profile File Signature          : acsp
Primary Platform                : Microsoft Corporation
CMM Flags                       : Not Embedded, Independent
Device Manufacturer             : Hewlett-Packard
Device Model                    : sRGB
Device Attributes               : Reflective, Glossy, Positive, Color
Rendering Intent                : Perceptual
Connection Space Illuminant     : 0.9642 1 0.82491
Profile Creator                 : Hewlett-Packard
Profile ID                      : 0
Profile Copyright               : Copyright (c) 1998 Hewlett-Packard Company
Profile Description             : sRGB IEC61966-2.1
Media White Point               : 0.95045 1 1.08905
Media Black Point               : 0 0 0
Red Matrix Column               : 0.43607 0.22249 0.01392
Green Matrix Column             : 0.38515 0.71687 0.09708
Blue Matrix Column              : 0.14307 0.06061 0.7141
Device Mfg Desc                 : IEC http://www.iec.ch
Device Model Desc               : IEC 61966-2.1 Default RGB colour space - sRGB
Viewing Cond Desc               : Reference Viewing Condition in IEC61966-2.1
Viewing Cond Illuminant         : 19.6445 20.3718 16.8089
Viewing Cond Surround           : 3.92889 4.07439 3.36179
Viewing Cond Illuminant Type    : D50
Luminance                       : 76.03647 80 87.12462
Measurement Observer            : CIE 1931
Measurement Backing             : 0 0 0
Measurement Geometry            : Unknown
Measurement Flare               : 0.999%
Measurement Illuminant          : D65
Technology                      : Cathode Ray Tube Display
Red Tone Reproduction Curve     : (Binary data 2060 bytes, use -b option to extract)
Green Tone Reproduction Curve   : (Binary data 2060 bytes, use -b option to extract)
Blue Tone Reproduction Curve    : (Binary data 2060 bytes, use -b option to extract)
About                           : uuid:faf5bdd5-ba3d-11da-ad31-d33d75182f1b
Image Width                     : 1456
Image Height                    : 832
Encoding Process                : Progressive DCT, Huffman coding
Bits Per Sample                 : 8
Color Components                : 3
Y Cb Cr Sub Sampling            : YCbCr4:4:4 (1 1)
Image Size                      : 1456x832
Megapixels                      : 1.2

Answer: 23:12

Content On The Drive Challenges

Question 1

Enter the password.

We can see that the password is swampadder from the previous question.

Answer: swampadder

Question 2

Interesting... there is a life insurance policy document here. Could Victor have taken out a life insurance policy for Connie before she died? If so, I need to note down the amount.

Opening KaseLife_BeneficiaryChangeForm_2023.pdf shows us the change of beneficiary form for Connie's life insurance policy. We can see that the amount is $3,000,000.00.

Answer: 3,000,000.00

Question 3

All that is left on this drive are some photos that look to be taken by another private investigator. Based on the descriptions in the ADAA's case notes I am positive I can identify the people in them.

Who do we see in this picture?

RobertsPrivateInv_Case257_img0012.jpg

The man in the photograph is clearly Rhett Blackwood, but that answer was not accepted; turns out they were looking for the names of both people, and the woman pictured is Connie.

Answer: Rhett and Connie

Online Troll

Question 1

Who's behind this username? - youtube.com/@MuscleMan69

Visiting the YouTube profile has a link in the bio to a Facebook group. Visiting the group shows that the administrator is Rhett Blackwood.

Answer: Rhett Blackwood

Question 2

Connie's social media: Enter the username of any social media account found belonging to Connie.

Now that I have Rhett Blackwood's social media accounts, I need to find any of Connie Blackwood's social media accounts.

I was drawing a blank here, so I looked at the hint and it had the following:

Did you see the URL on Victor's business card? My Spider-senses went off as I saw it... you're the website wizard though, so I'll leave it to you.

That's the website from earlier, https://www.kaseportal.com/somersetblackwood. That leads me to believe that the MEGA folder we discovered is finally going to come into play. Looking deeper into it, I can see that the client form is just one of the nested folders in a shared directory, and there are 4 others we can look through for additional information.

The first one I checked is "Security", which had a file named Con_Tiktok_05082023.mp4 that likely contains the username of Connie's TikTok profile. Opening the file proves us right.

Answer: conniebwood

Question 3

I was always curious to see what sort of content Connie may have posted around the time of her death. What is the TikTok video ID of the last post she made?

The profile is available at https://www.tiktok.com/@conniebwood, and the most recent post can give us some information with this DFIR blog post's technique. The date of the post was 2023-05-06 22:56:21.

Answer: 7230207135584603438

Lone Wolf

Write a short note to Ginny reporting on the likelihood that Victor Blackwood could have killed Connie.

According to the M.E., Connie died at 10:45 p.m. and a video from the Lone Wolf Lounge confirms Victor Blackwood was there at 10:53 p.m. Assuming she truly died at 10:45, could Victor have murdered Connie at 10:45 and returned to the lounge by 10:53? I need write a short note for Ginny explaining why or why not.

I submitted the following report to Ginny in PDF format (converted via md-to-pdf):

Lone Wolf Report

According to Google Maps, the Blackwood residence is approximately a 20 minute drive from the Lone Wolf Lounge. Therefore, it is improbable that Victor Blackwood could have killed Connie at 10:45 and returned to the lounge by 10:53.

The fact that Rhett Blackwood's vehicle was seen at the scene around the time of the crime indicates a much higher probability that he was the killer, since the alarm system was not triggered and he would have been willingly invited inside by Connie. The most probable motive is Rhett Blackwood killing Connie because she was unwilling to get a divorce with Victor, and as evidenced by Rhett's Facebook profile biography, he places a high emphasis on a "loyal woman".

There may have been collaboration between the brothers, since the increased life insurance policy was taken out by Victor within the last few weeks; however, that could also have been filled out by Rhett with his brother's information if he was planning this in advance.

In conclusion, weighing all the facts points to Victor not being directly involved in the death of Connie.

The PDF I submitted is available here.


The Oh Brother: Rhett Blackwood Interview section confirmed that we had a pretty good hunch with our guess, we were just missing a segment about Victor being involved with drugs. I ended up receiving an "Excellent" response from Ginny via email as well!

excellent_report.jpeg