Cyber sleuths uncover major crimes through deleted data

As criminals devise new ways of erasing all traces of their offence, forensic team digs deep into their digital history and deleted content to nail them

A woman claiming her husband was murdered and a heavily damaged mobile phone were the only leads Delhi Police’s cyber sleuths had when a case of an alleged killing during a robbery bid came up last year in west Delhi’s Patel Nagar. 

A 20-member team of National Cyber Forensics Lab (NCFL) immediately got down to cracking the WhatsApp chats on the damaged phone recovered from the water tank of the victim’s house. On finding that its user, the victim’s wife, had deleted several conversations, the team sat down and recovered all the deleted chats, which eventually helped the police crack the case. 

“The door is open, just push it,” read a deleted chat sent by the wife. This text revealed the woman’s role in staging a robbery bid and getting her husband killed with the help of her boyfriend. The woman was eventually arrested and based on the information provided by her, the boyfriend traced and nabbed. 

“It was a blind case and the police had no clues. Everyone thought the woman was the victim but tables turned after the forensic team recovered the chats from the damaged device,” an officer said. 

The NCFL, which is attached with the Delhi Police’s Intelligence Fusion and Strategic Operations Unit (IFSO), has so far retrieved both deleted and hidden data from over 4,600 devices, including laptops and mobiles, according to the police.  

The team operates 24 hours a day and assists the district police, in addition to working with investigative agencies like the Central Bureau of Investigation (CBI) and the Enforcement Directorate (ED), in cracking the majority of cybercrime cases. 

While the district police teams have their own forensics setup to deal with cybercrimes, their data-retrieving capacity is limited, so they coordinate with the NCFL for high-profile and complex cases.