The background
The City of Johannesburg’s Group Forensic Investigation Services (GFIS) supports the municipality by investigating fraud, corruption, cyber-enabled crime, and other serious offences that impact city operations and public services. Within GFIS, the Forensic Information Management Centre’s Cyber Crime Unit examines digital evidence across investigations involving municipal systems, employees, contractors, and external actors.
As the city’s operations have become increasingly digital, investigators have faced a growing number of cases involving computers, mobile devices, encrypted data, and complex digital evidence. This surge in digital evidence placed significant pressure on the team to process devices quickly while maintaining strict forensic standards and evidential integrity.
To keep pace with rapidly evolving investigative demands, the unit required a digital forensics solution capable of delivering fast data acquisition, mobile device extraction, advanced analysis, and court-ready reporting, while also supporting field-based triage so investigators could identify critical evidence without transporting every device back to the lab.
The SOLUTION
After evaluating several digital forensic technologies, the City of Johannesburg selected the Detego Unified Digital Forensics Platform (Detego Ultimate) as the solution best suited to its operational requirements. Its combination of speed, cost-effectiveness, scalability, and ease of use made it well suited for a team managing increasing volumes of digital evidence.
The platform includes Field Triage, Ballistic Imager, Detego MD, Media Acquisition, and Analyse AI+, enabling investigators to conduct on-scene triage, ultra-fast data acquisition, mobile device extraction, and advanced analysis from a single integrated platform.
Detego’s automation capabilities, intuitive interface, and guided workflows simplify investigative processes and support investigators with varying levels of technical experience in conducting forensically sound examinations. This approach strengthens the team’s ability to scale investigations and reduces reliance on a small number of specialist analysts.
The RESULT
The Detego Ultimate Platform quickly transformed digital investigations for the City of Johannesburg’s forensic team.
Within days of deployment, investigators finalised several cases directly in the field using Detego Field Triage, removing the need to transport devices back to the lab for analysis. The tool also enabled the recovery of five passwords for senior management accounts, the retrieval of three BitLocker encryption keys, and the identification of a compromised machine where unauthorised credentials had been used.
During deployment alongside four other digital forensic tools, Ballistic Imager delivered the fastest acquisition results, more than halving the time required for acquisitions while eliminating the need to physically remove hard drives.
The team also used Detego MD to extract and analyse data from a wide range of mobile devices including high-end smartphones, burner phones, and off-brand mobile devices with complex security configurations. Investigators successfully unlocked three Android devices and conducted advanced extraction across Android, iOS, Windows, and Tizen OS devices, which many forensic tools struggle to support.
Using Detego Analyse AI+, investigators conducted data decryption, automated analysis, and court-ready reporting, enabling rapid interpretation of evidence and the generation of actionable intelligence.
The result was a significant reduction in investigation times and operational costs. Processes that previously required lengthy manual work were completed in a fraction of the time, enabling the team to process more cases and deliver critical digital evidence faster.
“Detego technology has been a game changer for our investigations. It has significantly improved the speed at which we acquire and analyse digital evidence, helping us deliver results faster both in the field and in the lab. The platform has strengthened our investigative capabilities and helped us resolve cases much quicker. I would recommend this solution to investigative teams facing similar challenges.”
– Songezo Mbambisa Deputy Director: Cyber Crime – Forensic Information Management Center, Group Forensic Investigation Services, City of Johannesburg –