The Sentinel

Clicked a suspicious link and worried? Stay calm. Clicking alone is usually low harm. This calm, step-by-step guide helps you triage by what you did next and lock things down fast.

A calm, step-by-step guide to getting back into a hacked Instagram or Facebook account using Meta's official recovery flows, including what to do if the attacker changed your email, plus how to lock the account down afterward.

A candid reference for investigators on requesting WeChat and Weixin data from Tencent: the mainland-China vs international data split, why most content is unreachable, MLAT realities, emergency channels, and the device-level alternatives that actually work.

How police, prosecutors and cybercrime investigators request data from Kraken (Payward). Covers Kraken's legal-request channel, data it can produce, preservation versus production, emergency disclosure, freezes, MLAT for non-US officers and the FATF Travel Rule.

How police, prosecutors and cybercrime investigators worldwide request data from Coinbase: its law-enforcement portal, preservation versus production, emergency disclosure, MLAT for foreign agencies, account freezes and the FATF Travel Rule.

How investigators work with Cloudflare: why it points you to the hosting provider rather than the content, its abuse versus legal-process channels, emergency disclosure, customer-notice policy, and the MLAT route for non-US agencies.

How investigators obtain account evidence from Meta, X, Google, WhatsApp, Telegram and TikTok: subscriber data versus content, preservation versus production, law-enforcement portals versus MLAT, encryption limits, and authenticating records for court.

A practical guide to mobile device forensics on a seized handset: the four extraction levels, what each yields, why modern encryption and lock states often defeat extraction, how to preserve a phone, and admissibility.

A practical guide for investigators on structuring a defensible cyber-forensic report: documenting methodology, hashes and tools, separating fact from opinion, the electronic-evidence certificate, and the report sections that survive cross-examination.

A field guide for investigators on the action that follows tracing: compelling exchanges to freeze and disclose accounts, seizing self-custodied wallets and seed phrases, and preserving custody, valuation and admissibility across borders.

How investigators obtain and read Microsoft 365 and Google Workspace audit logs to prove account takeover and business email compromise, why logging must be enabled before an incident, and when to ask the org versus serve the provider.

A practical guide for police and cybercrime investigators working AI-enabled fraud: tracing voice-clone and deepfake CEO scams, AI chatbots, pig-butchering automation and synthetic-identity KYC fraud through the money, platform and telecom trail they leave.