Online investigation Before an official investigation, many Vietnamese investigators used
open-source intelligence (OSINT) methods to gain more information about the case. It was deduced that both people were speaking regional Vietnamese accents, and from floor tiles and household items in the initial video they concluded that the place of the killing was either near the
China–Vietnam border or the
Cambodia–Vietnam border. Initial suspicions towards a
Buddhist who was claimed to have interacted with the victim were dropped after they had denied involvement. According to his neighbors, Đạt was raised in
Hanoi by his relatives due to his mother's mental illness, and worked as a laborer and
fishmonger in
Hà Đông, Hanoi. On November 23, an 88-page summary, often referred to as "the 88-page document" (), which had documented information about the case, was published on OCIV. The document contained theories and information about Đạt and analysis of the crime scene. It held Sáng to be responsible, because of the correlations between the assailant and Sáng's bodily characteristics, and their shared activities as well as both of their contact with each other. A longer, updated version which had 110 pages, appeared on OCIV on November 27, and posited stronger correlations between the assailant and Sáng.
Official investigation On October 3, 2025, an official notice from the
Ministry of Public Security informed that an official investigation of the case began after their "observations of the online space". According to
Sin Chew Daily, although the video had spread from the
dark web to mainstream domestic platforms, the police only announced an investigation had begun after the release of the 88-page investigation. The same day, the Investigation Police Agency of Lạng Sơn Provincial Police issued a decision to convict a criminal case of murder. According to Sáng's confessions, he and Đạt had met through
social media in 2020, and on January 25, 2025, after contact via mobile phone, Đạt had entered Sáng's workplace at the office of Market Surveillance Unit No. 4 (which had been vacant due to
Tết celebrations) prior to the incident. The investigation is ongoing. == Media coverage ==