Illustrative scenarios developed by analysts to show how Sigilite technology integrates into investigative work. The cases below are demonstrations, not actual investigations. They show the analytical workflows the technology supports — and where investigators take it from there.
These scenarios are demonstration cases built by Sigilite analysts to show how investigative technology integrates into real-world workflows. They are not actual investigations, and they do not represent specific Sigilite customers, deployments, or outcomes. They are intended to illustrate the kinds of analytical leads Sigilite technology can surface — and the role investigators play in turning those leads into closed cases.
A female runner is attacked from behind on a wooded park trail. The suspect — male, black shirt, black face cover — flees east into low-density woods. No cameras. No LPR. No vehicle. The only thing the suspect leaves behind is a phone in his pocket.
Traditional surveillance has nothing to work with. The attacker's face is covered. He's on foot, so there's no plate to read. He fled into a non-populous wooded area where there's no camera coverage. The victim's description is broad enough to match thousands of men. Detectives have no selector to start with.
What they do have: a high-confidence time window (5:15–6:15 PM), a small geographic footprint (the western trail segment and the eastern flee corridor), and a behavioral pattern (regular runners every day, an outlier the victim noticed minutes before the attack).
An analyst pulls mobile advertising identifiers and other RF signals present in the park during the attack window across multiple days, then narrows down to the device most likely belonging to the suspect.
Pull mobile advertising IDs present in the park during the 5:15–6:15 PM window across multiple days. Devices appearing consistently are the regular running community — the known baseline.
Flag devices present on the day of the attack that are not in the baseline. A device appearing once, on the day of the assault, is a significant outlier — and a primary signal of interest.
Find an outlier device showing movement consistent with the suspect's flee route — eastward, into the non-populous wooded section. Normal park visitors don't move that way.
Run a pattern-of-life analysis on the outlier device. Where does it go regularly? Where does it bed down overnight? The bed-down location feeds a public-records check to identify the resident.
Signal analysis surfaced a name and an address detectives had no other way to find. But a device moving east on a trail is not evidence of a crime — it's a direction to look.
Probable cause comes from traditional police work: physical surveillance of the address the device leads to, witness identification, forensic evidence from the scene, or corroboration from other investigative avenues. The role of the technology is to compress what would otherwise be an unworkable search into a focused lead. The detective's role is what closes the case.
A drug-related homicide on Lincoln Street. The suspect's alias is known. His suspected residence is known. The likely trigger event — an argument at a poker game two weeks earlier — is known. But there are no cameras at the residence, no LPR in the area, and witness intimidation has shut down community tips. The traditional methods have stalled.
Detectives surveyed the suspect's apartment complex — no security cameras anywhere on the buildings, no privately installed cameras by residents, no LPR coverage in the surrounding area. A 24-hour covert surveillance operation observed the suspect's girlfriend but never the suspect himself.
Witness intimidation has been reported. The Police Chief, Mayor, and community leaders publicly asked for tips. No one came forward. Multiple informants confirmed that witnesses had been threatened not to speak to police.
A doorbell camera across the street from the poker-game location could potentially identify everyone who attended — but the renter can't access the footage, the landlord is out of state and unresponsive.
With traditional methods stalled, an analyst proposes a different approach: search for device identifiers — AdTech, Bluetooth, TPMS — present across all three locations during the relevant time windows.
Crime scene (Lincoln Street, night of homicide). Suspect residence (The Warrens, known dates). Trigger event (27 Harding Street, night of poker game). Three windows. Three locations.
AdTech mobile advertising IDs from devices running apps. Bluetooth signatures from wearables and personal devices. TPMS identifiers from vehicles in the area. Every persistent identifier the location passively broadcasts.
A device at one location may be coincidence. A device at two — already meaningful. A device at all three relevant locations during the relevant windows is not coincidence. The analyst surfaces three unique identifiers appearing across multiple locations.
One AdTech signal stands out — it appears at all three locations during the relevant windows. A pattern-of-life run on this device surfaces a detailed picture of someone's daily movement, leading toward a bed-down location and a records-based identity check.
Where no camera saw the suspect, where no LPR captured his vehicle, where no witness would speak — device identifiers placed the same person at all three locations during the relevant windows. That's a name and an address that investigators would not otherwise have developed.
It's not probable cause. It's not a confession. It's a direction to look — a starting point for traditional investigative work to build the case from corroborating evidence, surveillance, and the methods that close investigations.
Sigilite scopes the technology around the operational gap. Tell us the kind of case you're working — vehicle, persons, multi-location, multi-jurisdictional — and we'll talk through how the analytical workflow would surface leads in your environment.
Investigative technology for law enforcement. Federal, state, local, and tribal. Founded 2025. US-based.