Investigation and Cases

In This Chapter

This chapter covers how investigation works at the table in The Hollow: how characters find and follow evidence, how the supernatural hides behind a mundane explanation, how Wound Sites escalate, and what happens when the trail goes cold. It also covers how cases find the characters, what the mundane world looks like from inside a case, and how faction resources change the shape of an investigation.

This chapter does not prescribe a case structure. It gives you tools instead.

The Nature of a Case

Every case begins in the same place: something happened that should not have happened, and the mundane world has already started explaining it wrong.

That wrong explanation is the first layer of the investigation, not an obstacle in its own right; characters accumulate contrary evidence until it no longer holds, a process that can take twenty minutes or three sessions depending on what they find.

Every case has four elements, regardless of the story:

A Wound Site or active supernatural threat. Something is wrong in a specific place or with a specific person or object, with a physical location and an escalation state. It may be a Wound Site, a possessing entity, an active relic, a cult, a devil's operation, or some combination.

A mundane surface. The ordinary world has already generated an explanation for what happened: accident, crime, mental illness, gas leak, electrical fire, estrangement. The explanation is wrong, but it is coherent, and the institutions responsible for managing these situations are operating within it.

A pattern the antagonists are running. Whatever is driving the case has a logic: a cult has a schedule and a goal, a demon has an agenda, a devil has a contract to fulfill. The pattern is not always visible at first, but finding it is usually what turns the case from investigation to confrontation.

Stakes that escalate if the characters do nothing. The situation does not wait: the cult has a next ritual, the possession is deepening, the Wound Site is approaching its next threshold. Investigation runs against that timeline, not after it.

Merciful Dissonance in Investigation

The First Layer

By the time investigators reach a scene, Merciful Dissonance (Chapter Two) has already reshaped what witnesses remember, how physical evidence reads, and what any official record says. Most witnesses and most institutional records are honest: they reflect what people genuinely perceived and believed, not a story anyone invented on purpose.

Piercing the False Explanation

Piercing Merciful Dissonance takes accumulated evidence: investigators gather findings until the mundane explanation can no longer hold their weight, and cumulative contradiction is what breaks it.

As investigators work a scene, they gather evidence that does not fit the official record. Each finding that contradicts the mundane explanation is a crack in it. When enough cracks accumulate, the false explanation is untenable; the characters know what they are actually dealing with, even if they do not yet know all the details.

There is no specific threshold number; the GM tracks when the contradictions are sufficient. A good rule of thumb: when the characters can articulate a complete alternative explanation for the known facts, one that requires a supernatural cause, the false explanation has collapsed and the investigation has shifted to confronting the actual situation.

The Lyncean Office passive, Impossible Evidence (Chapter Four), surfaces one specific piercing question after a successful investigative check: what does the mundane explanation fail to explain? In practice it works as a directed crack, aimed precisely at the weakest point in the official record.

What MD Looks Like

Witnesses describe what they processed. A witness who saw a possession describes a person behaving erratically. A witness who saw a ritual circle describes a room that "someone had rearranged." A witness who saw a demon describes something they cannot name and will often refuse to revisit because remembering is distressing.

Physical evidence sits in plain sight but is read incorrectly. The burn pattern is attributed to accelerant. The wounds are listed as self-inflicted. The absence of a body is called a missing person.

Institutional records reflect the professional interpretation of people working without Awakened Blood: medical examiners, police investigators, fire inspectors, and social workers wrote down what they believed they saw. What they believed is wrong, not falsified.

Media amplifies the mundane explanation and provides public-facing cover: tragedy, accident, crime. The supernatural version never appears unless someone with very bad judgment, a grudge against the involved parties, or their own Awakened Blood pushes it.

Finding Evidence

How Investigation Checks Work

Evidence requires effort to find: the characters roll, and if they succeed, they find the clue; if they fail, they do not. There is no safety net guaranteeing that the core information reaches them regardless of the roll.

What Each Skill Finds

Different skills access different categories of evidence. A character using Forensics and a character using Inquiry are not doing the same thing with different dice. They are finding fundamentally different kinds of information.

Perception: what is physically present in the immediate environment that an alert observer would notice. Things out of place. Conditions that contradict the official explanation. Details that are easy to overlook without specific attention. Perception finds evidence that is sitting there waiting to be seen.

Inquiry: what people know. Witnesses, neighbors, institutional contacts, reluctant sources. Inquiry extracts testimony, not just cooperation. A successful Inquiry check against a hostile witness does not necessarily mean the witness is now friendly; it means the character found the right question, the right pressure point, the right framing to get the information out.

Forensics: physical analysis. Time of death, cause of death, manner of injury, material composition, evidence of tampering. The difference between what evidence says at first glance and what it actually says under proper analysis. Forensics is the skill that separates supernatural cause of harm from natural cause of harm most reliably.

Research: documentary evidence, historical records, public and private databases, institutional archives. Prior incidents at this location. Who owns the property. What cases are connected. What the historical pattern is. Research takes time but provides context that no amount of scene investigation can replicate.

Tracking: physical movement traces. Where people went, in what order, with what weight and urgency. Environmental evidence of passage. Tracking is most useful for establishing sequences of events and finding locations that are not yet known.

Discernment: spiritual evidence. The presence of an entity, the intensity of a Wound Site, the difference between genuine spiritual distress and psychological distress in a witness. Discernment does not identify entity type with precision (that requires Monster Lore or Theology), but it confirms supernatural presence and reads spiritual conditions.

Occult Lore: ritual identification. What the symbols mean. What tradition the pattern belongs to. What this configuration of objects, conditions, and marks indicates about the practice that produced it. Occult Lore tells you what someone was trying to do and how.

Theology: the spiritual significance of what was found. Whether this is standard or aberrant practice within a religious tradition. What the theological weight of the conditions means. Whether the apparent intent and the actual spiritual effect are the same. Theology reads meaning where Occult Lore reads method.

Monster Lore: entity identification from evidence. What kind of entity produces this pattern of harm, this signature, this behavior. Monster Lore does not require the entity to be present; it reads the evidence it leaves.

Relic Lore: object identification. Whether an object found at a scene is supernaturally charged, what class it might be, whether it is significant to the case or incidental.

Dead Languages: inscriptions, documents, historical texts relevant to the case. What the written material says and what it means in context.

Difficulty

The GM sets difficulty based on how well the evidence has been concealed, how much time has passed, and how actively it has been obscured:

Boon Spends on Investigation Checks

When a character succeeds on an investigative check with Boon dice remaining, they may spend them for additional value:

• One Boon: The clue points directly to the next clue: the character knows what to look for and roughly where
• One Boon: The character identifies which aspect of the mundane explanation this finding directly contradicts
• One Boon: Additional detail beyond the basic finding (the ritual circle is fresh: within 48 hours; the entity presence is localized to one room, not the building; the witness is lying about one specific thing)
• Two Boon: The character understands the pattern: how this piece of evidence connects to the others already found
• Breakthrough: The character finds everything this source could provide; no follow-up investigation of this evidence type in this location is necessary

Bane Complications on Investigation Checks

When a check produces Bane dice alongside success, the GM may introduce:

• The character finds the evidence but is now observed: someone or something knows they are looking
• The evidence is found but its context is misleading in a specific way the GM tracks
• The check draws institutional attention: law enforcement, hospital administration, building management, someone who will complicate access later
• A character present at the scene experiences a Wound Site effect (Composure check, Easy–Average) as a consequence of the investigation

On Calamity: the character has missed the evidence and disturbed it: future attempts to find this evidence in this location are at +1 Difficulty, or the evidence is now gone.

Wound Site Escalation

What Causes Escalation

Wound Sites escalate on no fixed schedule; something has to feed them.

The primary driver is blood. Blood shed in a Wound Site, or in proximity to an active Shard through deliberate spiritual intent (ritual, sacrifice, a binding rite), accelerates escalation. The site recognizes what the blood means. It responds only to deliberate offering, not to accidents or medical procedures.

The escalation events, in approximate order of severity:

Blood letting in ritual context. The most common trigger in active cult operations. A ritual that involves deliberate bloodshed, even minor, at or near a Wound Site escalates it. The more blood, the more elevated the intent, the stronger the effect. A minor ritual letting may advance the site a fraction. A full ritual letting with multiple participants advances it a full step.

Human sacrifice. The most severe single event. A completed human sacrifice at a Wound Site advances it immediately, potentially multiple steps. The Wound Site registers this as a fundamental spiritual event: the deliberate taking of life as spiritual offering is among the most severe possible escalation triggers.

Ritual completion. A completed dark rite (not necessarily involving blood) produces escalation proportional to its scope and the intent behind it. A minor binding ritual at a site contributes. A full summoning ritual contributes dramatically. The completion matters: a disrupted ritual does not fully escalate.

Significant moral failure at the site. The Wound Site responds to the spiritual condition of what happens within it. Certain acts of sufficient moral weight can feed the site without blood: a person in a position of profound spiritual authority committing a serious, deliberate act that violates the core of that authority at the site. This is less common but more unpredictable. A priest actively violating a fundamental vow at a Wound Site is providing the site with something real. A person of established spiritual standing choosing open corruption at that location registers as an offering of a different kind.

What Escalation Looks Like

Each stage of the escalation scale, from Cold Shard to Breach, and what it looks and feels like to characters and bystanders, is defined in Chapter Two. What investigation needs from that scale is a reading: how far a site has already climbed by the time the characters arrive, and how much of the antagonist's pattern that climb represents.

Escalation and Investigation

Escalation events are things the antagonists do, not responses to what the characters do; the cult's ritual runs on the cult's schedule, not the investigation's. Investigators rarely know exactly when the next trigger will occur, but the pattern usually signals that one is coming.

Once investigators find the pattern and identify what the antagonists need and when, they shift from reactive investigation to potential intervention: the goal becomes stopping what is about to happen, not just understanding what already has.

The Site That Escalated Before You Arrived

Sometimes characters come to a case where escalation is already well advanced. An Open Wound or Weeping Wound site means the event that drove the escalation has already occurred, possibly multiple events. Reading the escalation level tells investigators how serious the problem has become and how much time has already passed within the antagonist's pattern. A Weeping Wound that was a Cold Shard eighteen months ago has had multiple escalation events. The question is not just what happened but how many times it happened and how close to completion the pattern is.

Getting Unstuck

Evidence doesn't always surface on the first attempt. Rolls fail, sources dry up, the trail goes cold, and each of those is a signal to approach the problem differently, not a dead end. The options below carry different costs, and not every option is open to every group.

Try a different skill. The same information is sometimes accessible from multiple angles: a Forensics failure means the character's approach didn't surface the physical evidence, not that the evidence is gone. A Research approach to the same question (who has handled this type of substance, where is it sourced) may find the connection through a different path.

Try a different source. A hostile source who stonewalled one character may respond differently to a different approach, a different faction credential, or a different method of contact.

Use faction resources. Every faction has assets characters can call on: the Order's diocesan archives, the Lyncean Office's forensic contacts, the Lantern Index's research network, the Black Road's information channels, and more (see Faction Resources in Investigation, below, for what each one costs).

Use the Latchkey passive. Do Not Touch That (Chapter Four) can be the way into a case that is otherwise stalled: there is an object in the scene, and the object is the path.

Pay the Candleless cost. Methods other factions would not sanction can reach information those factions cannot. The Candleless passive, Ugly Solution (Chapter Four), drops difficulty by one step for unsanctioned methods, at the cost of a narrative complication the GM introduces after the roll.

Accept partial information and move. Sometimes the characters know enough to act without knowing everything. Moving on incomplete information is a legitimate investigative choice. It introduces risk (the incomplete picture may lead them into the wrong confrontation or let them miss the escalation event), but waiting for perfect information against a ticking escalation clock is also a choice with consequences.

Go to the source. If the physical evidence is exhausted and the witnesses are tapped, there is the possibility of direct contact with whatever is driving the case: an entity, a person with knowledge, a faction with information. This is rarely safe and often advances the antagonist's awareness of the investigation. But it is sometimes the only remaining option.

The Mundane World Interface

Cases exist inside the ordinary world, and the ordinary world has its own ongoing business that does not stop for supernatural investigation.

Law Enforcement

The police, federal investigators, and related agencies are present in most cases because something happened that falls within their jurisdiction, a death, a disappearance, a crime. Their investigation is real and their authority is real. Characters interfering with their investigation risk official obstruction, arrest, and loss of access to evidence.

Characters who can navigate this interface (Tradecraft, Inquiry, faction credentials, Law Enforcement background) can work alongside official investigation without triggering conflict. Characters who cannot will eventually collide with it.

Some officers, if they have Awakened Blood, are quietly aware that something does not add up, and one of them may be looking for someone who can explain what they are seeing. These contacts are useful, and they are also in danger.

Institutions

Hospitals, churches, universities, corporations, government agencies: cases happen inside institutions because institutions are where people are, and entities operate where people are. Institutions protect themselves. When a case creates institutional embarrassment, the institution responds with the tools available to it: lawyers, HR, communications staff, administrative obstruction, and occasionally people who know something is wrong and are actively working to bury it.

Understanding who inside an institution knows what, and who is covering for what, is often a key investigative question. The cover-up is not always supernatural; sometimes it is just ordinary institutional self-protection coincidentally obscuring a supernatural situation.

Media

Most supernatural cases generate some media attention at some point: the original incident, the official investigation, sometimes follow-up coverage if the story has good elements for public consumption. The media sees what Merciful Dissonance permits them to see and reports what their editors will publish. They are not generally useful to investigators, but they are sometimes a source of witness testimony (quoted in coverage), timeline information (first reports establish sequences), or pressure on institutions that are obstructing.

The media becomes dangerous when it pays attention to something it shouldn't: a journalist pursuing the real story, close enough that Merciful Dissonance is straining under their questions, is at risk, and their persistence is itself a sign that the mundane explanation is under stress.

Faction Resources in Investigation

Every faction gives characters access to assets that change what investigation can do; each entry below lists what it costs to use them.

Order of Mercy: Diocesan archives, hospital chaplaincy access, pastoral relationships with witnesses, access to Church records spanning centuries. In emergencies: formal backing that opens institutional doors. Cost: obligation to report findings; some information may be directed toward Order priorities.

Watchfires: Community network: the congregation sees things, hears things, and reports to trusted members. This network is wide and informal, reaching into neighborhoods and workplaces that official channels do not. Cost: the network talks back; community members who provide information may become involved in ways that require protection.

Directorate Vesper: Operational infrastructure: surveillance capability, communications intercept, identity cover, institutional access through official channels. Vesper can get characters into places and get information out of systems. Cost: the operation is now documented. Vesper information has clearance restrictions.

Lyncean Office: Forensic contacts, official investigation access, crime scene documentation, medical examiner relationships. The Lyncean Office can legitimize the investigation's presence at a scene in ways no other faction can. Cost: the case is now on Lyncean record; their priorities shape what they share.

Latchkey Archive: Research resources, the Registry, technical identification of objects and their histories. The Archive's knowledge depth is unmatched for anything with a documented supernatural history. Cost: the Archive wants documentation in return; significant finds become Archive property or Archive-registered.

Black Road: Field intelligence: what hunts have turned up in the relevant area, what other hunters know, what the practical experience of people who have faced this type of entity is. Cost: Road culture is reciprocal; information comes with implied expectation of reciprocal assistance.

Lantern Index: Historical research, translation, academic contacts, access to private collections and rare documents. Anything with a historical signature, old rituals, ancient entities, documented precedents, the Index can research. Cost: scholarly documentation required; significant findings may be published (which creates its own complications).

Candleless: Information that other factions do not have access to because the Candleless are connected to the parts of the supernatural world the other factions avoid. What devil networks know. What forbidden texts say. What the underground market in occult objects has moved recently. Cost: visible in ways that other factions will notice; Corruption risk from certain information sources.

Reading a Case Scene

When characters arrive at an investigation scene, the following elements are generally present and addressable:

The immediate physical environment. The state of the space, what has been disturbed, what physical evidence remains.

The spiritual environment. The Wound Site's current state, any entity presence, the spiritual temperature of the location.

The human element. Who is there, who was there, what they know or are willing to say.

The documentary layer. What records exist for this location, what prior history surfaces, what is in the official record.

The contextual layer. What this means in the context of the wider supernatural world.

Characters are not required to work every layer on every scene. But each layer left unworked is information the characters do not have, and in cases with escalation pressure, that gap may matter.

Multiple Endings

A case can resolve several ways: full success, partial success, failure with something learned, or catastrophic failure. All four are legitimate outcomes.

Full success: The entity is expelled, the cult is disrupted, the Wound Site begins to de-escalate, the victims are protected. Treat this as the outcome a group earns through good procedure and hard trade-offs, not as the expected result of a case.

Partial success: The immediate threat is addressed but something remains unresolved. The entity is expelled but the Wound Site is not fully addressed. The ritual is disrupted but the principal actors escape. The cursed object is contained but not identified. Partial success is the most common outcome and creates the connective tissue between cases.

Failure with learning: The characters could not stop the escalation event. The ritual completed, the Wound Site advanced, someone was hurt. But the characters now know the pattern: what the antagonists needed, what they did, and what is coming next.

Catastrophic failure: The entity is not expelled. The sacrifice was completed. The Breach is happening. This is the rare outcome that changes the shape of the story permanently. It does not end the campaign; it changes what the campaign is about.

The quality of the investigation determines which outcomes are possible. Good investigative work opens the door to full success. Poor investigative work or missed evidence narrows the options. The dice and the choices both matter.