CASE_TEST_IMAGE
grey means mock — these findings are not computed yet
What needs attention
ranked, not chronologicalThree FIRs across three stations are one network
criticalA handset IMEI in the Gate-4 tower dump and container MMLU-000-4471 both appear in all three case files. Filed separately, investigated separately.
CCTV exported by an officer five hours before the FIR existed
criticalGate-4 cam03 was exported under E-001's credential at 02:14 on 12 Mar. FIR 214/2026 was registered at 07:30 the same morning.
19 SIMs rotating across 6 handsets
highNumbers change weekly; the devices do not. Resolving on MSISDN alone splits one person into nineteen.
148 cash deposits sitting just under the reporting threshold
highDeposits cluster at 91–99% of the limit across 11 branches. A natural distribution does not do this.
Access badge used while its holder was 300 km away
highWarehouse badge swipe at 21:04; the same person's handset was on a Devkot tower at 21:02.
Tip-off calls precede every one of four inspections
highA call from the same handset lands 40–90 minutes before each surprise inspection. Four for four.
Witness retracted six days after a burst of calls from an unknown number
highW-001's statement reversed on 19 Mar. Eleven calls from a burner in the preceding week; none before, none after.
Money returns to its source through three companies
high₹4.2 crore leaves C-003, passes through an offshore counterparty and an SPV, and comes back. Nine legs.
Four losing bidders share a chartered accountant, an IP and an address
mediumThe three shells filed from one IP within 14 minutes. Four unrelated businesses at the same address did not — they are co-tenants, not conspirators.
Winning bid timestamped six hours before it was uploaded
mediumPortal record claims 15:40; the server log has the session opening at 21:47.
Land bought three weeks before the SEZ alignment was public
mediumSix parcels registered to a trust between 2 and 9 Feb. The alignment was notified on 1 Mar.
Container left heavier than it arrived
mediumGate-in 24.10 t, gate-out 26.85 t, same seal number. Nothing was declared as loaded.
DVR clock runs 7m20s fast — corrected before matching
infoOverlay 22:53:00 is really 22:45:40. Without the correction the footage and the tower dump never intersect.
Who actually matters
Ranked by position in the network rather than by how often a name appears. The rank an investigator would reach reading the file front to back is shown beside it.
The only node connecting all four operational clusters. Remove him and the network falls into disconnected pieces.
Every shell company routes through him. Removing him disconnects the entire invoice subgraph.
The single join between the legitimate customs channel and the narcotics channel.
The most connected name in the file — but every connection sits inside one cluster. Volume, not reach.
Connected to everyone who matters and to almost no one directly. Structurally central, evidentially thin.
Structural position only. No direct evidentiary link in this case file. This is not an assertion of wrongdoing.
Exported the Gate-4 footage before the FIR existed and sits between the port cluster and the investigation itself.
Closed leads
Raised and ruled out. They stay visible so the same ground is not covered twice, and so a reviewer can disagree.
Crypto on-ramp reference — no onward trail
closedOne FIC note mentions an exchange deposit. No counterparty, no follow-on movement, no second source. Raised and closed.
Speaker 'Kaptaan' could not be resolved to a person
closedNamed in four intercepts. Speaker comparison inconclusive against every known sample. Left as an unresolved node rather than guessed at.
Synthetic case data. Findings are ranked and sourced; none of them is an assertion of guilt.