CDR · IPDR · tower dumps — for cyber cells & forensics teams
Raw disclosures in.
Court-ready intelligence out.
Upload the call records, internet records and tower dumps an operator has disclosed to you, exactly as they arrived. TraceLens reads them without changing a single digit and answers 107 fixed questions about them — the same answer every time, for any officer. Every answer exports with the Section 63(4) certificate a court asks for.
- 107
- reports, filed by the question you are asking
- 6 formats
- one result hash across all of them
- 63(4)
- certificate on every export
- A–D
- evidence class printed on every figure
One row out, or an honest empty result — never a guess. Same answer, same hash, every re-run.
Doctrine
Built to survive cross-examination
Evidence software is judged on what it refuses to do. These four constraints are enforced in the code and asserted in CI.
Nothing is guessed
Operator formats are data, not code. An unrecognised layout is reported as unrecognised — never silently mis-mapped into the wrong columns — and an analyst can map it once for the whole workspace.
Identifiers stay text
IMEI, IMSI and MSISDN survive as strings end to end. Float coercion is structurally impossible, and property tests hold it to the IEEE-754 ceiling.
Every row is accounted for
Rows scanned = structural + loaded + rejected, enforced per file and shown in the UI. A case that does not reconcile cannot look healthy.
AI never touches evidence
Assistive analytics are labelled INVESTIGATIVE LEAD with a method note on every line, and are excluded from evidentiary exports by construction.
The catalog
107 reports, all driven the same way
Organised by the question you are asking — where they were, who they contact, who was at the scene — rather than by which disclosure holds the answer. One behaviour throughout: every report paginates, sorts, searches, drills to its underlying records and exports the same way, on a desk or on a phone.
22 reports
Sessions, destinations, protocols and exposure. CGNAT IP+Port → Subscriber Resolution, Application / Protocol Classification, Destination ASN / Org Attribution, and more.
16 reports
Routine, night activity, silences and shifts. Data Routine: Hour × Weekday Heatmap, Temporal Heatmap & Daily Routine, Unified Timeline — Voice, Data and Tower Sightings, and more.
13 reports
Associates, direction, channels and operators. Top Associates / Contact Frequency, Call Directionality & Initiation Balance, Call-Duration & Relationship Strength, and more.
13 reports
Tower-dump triage: presence, co-presence, recurrence. Co-Presence / Possible Associates, Cross-Tower Recurring Numbers, Dump Numbers Known to the Case, and more.
12 reports
Towers, movement, anchors and alibi checks. Alibi Check: Claimed Time and Place, Tower (CGI) Geo-Mapping & Footprint, Home / Work / Night-Anchor Inference, and more.
Court-format exports
Six formats. One hash.
The result hash is computed over the report's rows, not the rendered file. File the PDF, disclose the CSV, and both provably represent exactly the same figures.
Every format carries the Bharatiya Sakshya Adhiniyam 2023 Section 63(4) certificate, pre-filled with the source SHA-256 and MD5 hashes, the parameters used, the row count and the result hash. The officer signs; the mathematics is already done.
See the full report catalog →result_sha256 = sha256(canonical(rows))Order-independent, format-independent, reproducible on every re-run — the same report carries the same hash in all six exports.
From workbook to witness stand
A pipeline that never guesses
Upload the disclosure
Workbooks, CSVs or whole ZIP bundles, exactly as the operator sent them. Originals are stored immutably with SHA-256 and MD5 computed on arrival.
The registry recognises it
Operator formats are data, not code. Built-in templates match by header signature; an unknown layout is reported as unrecognised and mapped once in the UI — tenant-wide from then on.
QC must reconcile
Rows scanned = structural + loaded + rejected, with reasons, enforced per file. A case that does not reconcile cannot look healthy.
Report, drill, export
107 reports that all work the same way, every figure traceable to the operator's own rows, and an export whose fingerprint proves it has not been altered.
Watch rules
Alerts in the same request that ingested the record
Stream records over the feed API as your upstream system lawfully receives them. Declarative rules on MSISDN, IMEI, cell or destination — never free-form queries — raise an alert the moment a matching record lands, and a retroactive sweep applies new rules to everything already loaded.
- Each ingested batch stored and hashed as its own evidence file — chain of custody holds for streamed records too
- Streamed rows normalise through the same builders as parsed workbooks, asserted in CI
- Feed credentials stored hashed and shown exactly once
- No interception: TraceLens analyses what it is lawfully sent
watch rule: b_party = 98XXXXXX41 → alert, in-request
Assistive intelligence
AI that helps the investigator and never testifies
Ranked leads with a method note on every line, and an evidence class that keeps them out of evidentiary exports. Ask-the-case maps a plain-language question onto one of the registered reports — never free-form SQL. Case briefs come from a deterministic template, or a local model running inside your deployment.
- Every lead labelled INVESTIGATIVE LEAD, with the method that produced it
- Quarantined from evidentiary exports by construction — the test suite enforces it
- Attribution honesty: candidate vs attributed vs port-only, on every intelligence row
- Ollama runs locally when enabled; no case data leaves the deployment
Every lead carries its method note. Nothing from this layer can enter an evidentiary export — by construction, and the test suite enforces it.
Accuracy is the product
Numbers we can defend, because CI defends them first
- 0
- reports, all driven the same way
- 0 formats
- court exports sharing a single result hash
- 0
- golden IPDR sessions — parser agrees with the operator's own total
- 0+
- backend tests, golden numbers asserted in CI
The two source disclosures are permanent fixtures: 1,358 CDR records (830 voice, 527 SMS), 9,189 IPDR sessions, 149 subscribers, 1,524 destination IPs. Any refactor that changes one of these numbers fails the build.
Who it serves
Built for the people who sign the certificate
Police cyber cells
Case-scoped workspaces with roles, object-level access and an append-only audit trail. Invisible cases answer 404 — their existence is not disclosed.
Digital-forensics firms
Chain of custody from upload hash to export hash, drill-through from any aggregate to the underlying records, and dossiers a court can re-derive.
State units, air-gapped
The on-prem bundle validates its signed license offline. No telemetry, no tile servers, no phone-home — case geography never leaves the building.
Deployment
Cloud, on-premise, or fully air-gapped
The on-premise build is the same stack with a single tenant, installed from a Compose bundle validated by an offline signed licence key. Nothing phones home — not even the map: the geo view plots the case's own coordinates and requests no tiles.
- Schema-per-tenant isolation, not a shared WHERE clause
- Offline geo plotting with no basemap tile requests
- Enrichment reference data loads from files on disk
- Hash-stamped destruction certificate on tenant purge
same reports · same hashes · no phone-home
Pricing
From ₹399 a month
Every plan runs the same evidence pipeline, the same court-format exports and the same Section 63(4) certificate. The tiers differ in scale — seats, devices, cases — and in which analysis modules are switched on. Pay yearly and the same plan costs less.
Starter
60% off₹1,000₹399/mo
Individual investigators · 1 seat · 2 devices
GrowthMost popular
63% off₹1,600₹599/mo
Cyber cells & small teams · 3 seats · 6 devices
Business
60% off₹2,500₹999/mo
Units, agencies & forensic firms · 10 seats · 20 devices
Questions
The things procurement actually asks
Does TraceLens intercept calls or data?
No, and it never will. TraceLens analyses records lawfully obtained from operators. Interception happens inside carrier lawful-interception infrastructure under a warrant; no analysis application substitutes for that. The feed endpoint ingests records an authorised upstream system sends to it — that is the whole of what 'live' means here.
Which operator formats are supported?
Operator layouts are data, not code: a template registry maps header signatures onto canonical fields, with built-ins for common CDR, IPDR and consolidated tower-dump layouts. A format we haven't seen is reported as 'unrecognised' rather than guessed at — an analyst maps its columns once in the UI and it parses tenant-wide from then on.
Do you handle tower dumps?
Yes — tower dumps are a first-class record kind alongside CDR and IPDR, with their own evidence grid and eight dedicated reports: presence, cross-tower recurring numbers, co-presence, device/SIM anomalies and more. ZIP bundles expand automatically, with bomb guards.
How do you keep identifiers accurate?
Every identifier survives as text from parse to export. Float coercion of an IMEI, IMSI or MSISDN is structurally impossible, and property tests hold that to the IEEE-754 exact-integer ceiling. Per-file QC also asserts rows scanned = structural + loaded + rejected, so nothing is silently dropped.
Will the reports hold up in court?
Evidentiary output is deterministic — the same inputs always produce the same figures. Every export carries a Bharatiya Sakshya Adhiniyam 2023 Section 63(4) certificate with the source SHA-256 hashes, the parameters used, the row count and a result hash computed over the rows themselves — so the PDF you file and the CSV you disclose provably carry the same figures. Assistive analytics are labelled as leads and are excluded from those exports.
What does the AI actually do?
Three things, all quarantined from evidence: ranked investigative leads with a method note on every line; ask-the-case, which maps a plain-language question onto one of the registered reports (never free-form queries); and case briefs from a deterministic template or a local Ollama model running inside your deployment — no case data leaves it.
Can we run it inside our own network?
Yes. The on-premise build is the same stack with a single tenant, installed from a Compose bundle with an offline signed licence key. It runs air-gapped: no case data, no telemetry, and no map tile request leaves the host.
How is our data isolated and controlled?
Each tenant lives in its own PostgreSQL schema, not behind a shared WHERE clause. Inside a workspace: roles, per-case access (a case you cannot see answers 404), optional TOTP two-factor enforced tenant-wide, an IP allowlist, export watermarks and export approval — all workspace-admin switches.
What about retention and destruction?
A workspace can set a retention window; a nightly sweep purges closed cases past it and writes a tamper-evident destruction certificate first, in the same transaction. Deleting a whole workspace issues a hash-stamped destruction certificate that survives the tenant it certifies.
What happens when the trial ends?
Nothing is charged and nothing converts automatically — there is no card on file. Your workspace becomes read-only until you choose a plan, and you can export everything you produced during the trial.
Get in touch
Book a demo on your own data
Tell us which operators' disclosures you receive and roughly what volume, and we will show you the exact reports your unit would get — not a canned deck.
Response time
One working day for demo and tender requests
Deployment
Cloud, on-premise, or air-gapped
Trial
7 days, no card, no automatic conversion
Start with your own disclosure
Upload a real CDR, IPDR or tower-dump file and see the QC reconciliation, the reports and a certified export within minutes. 7 days, no card.