2 min
File to finished PDF
Send the file with the case reference as its caption. The report comes back in the same chat.
CDR / IPDR investigation support
From records to clearer leads.
Officers send a CDR or IPDR file on WhatsApp. Sanket reads every row and answers with a PDF — a plain-English brief for the investigating officer first, the evidence pages after. Usually inside two minutes.
Runs on your own machine
Report in about two minutes
Nothing goes to a third party
Developed by Apoorv Kumar for the Law Enforcement Agencies
Built for investigating officers
Chapter 01 — the problem
A CDR is thousands of rows.
An investigation needs three answers.
Where was the phone, who was it close to, and what changed. Sanket does the reading, the geography and the arithmetic, then writes the brief an IO can act on — with the full evidence standing behind every line of it.
Page 1
Written for the IO
Key findings, most important first, each with a suggested next step. Engine pages follow.
Offline
Records that never travel
Analysis and IP-ownership lookups run on your host. No record content leaves the machine.
Chapter 02 — the flow
No software to learn. It is a chat.
Nothing to install on the officer's phone, no portal to sign into, no training day. If they can forward a file, they can use Sanket.
-
01
Get access
The operator grants your number from the panel. An invitation arrives on WhatsApp — reply
ACCEPTand the welcome guide comes with it. -
02
Send the file
Share the operator's CDR or IPDR file in the chat, with the case reference as its caption —
FIR 60/2026. Commands go before the file. -
03
Read the report
The PDF returns to the same chat, marked confidential and carrying the subject and the case reference. Then ask it questions in your own words.
Sanketonline
CDR_98XXXXXXXX_MAR.xlsx14,206 rows
FIR 60/2026
Reading the file…
Sanket-CDR-FIR-60-2026.pdfBrief for the IO, then the evidence pages
Home, work and last known location · six closest associates · night stay · two handset changes
where was he on 5 March at 10 pm?
On 05-03 at 22:04 the phone was on the tower nearest the
night-stay address, about 1.2 km away.
Illustrative · sample data, not a real case
- balance credits left
- help the full guide
- /cross … /done link 2–10 files
- /incident time and place
- /dump … /done tower dumps
- cell <CGI> tower location
- map Google Earth KMZ
- towers <lat,long> dump plan
- GOOD / BAD rate the report
- /cancel stop a batch
Chapter 03 — what comes back
Nine kinds of answer, one chat.
Every report opens with findings in plain English and closes with what to do next. Send a file, or a command and then a file.
CDR analysis
The subject, their circle and their pattern of life, read out of the call records.
- Closest associates, ranked by how much contact there was
- Home, work and last known location — address or coordinates
- Night stay per night, and nights away from home
- Call chains, money trail, impossible travel (possible cloned SIM)
- Handset changes, silent periods, burners, new contacts
IPDR analysis
One page for the IO, then the internet record rebuilt into something readable.
- WhatsApp and app calls — voice, video, unanswered
- Apps in plain English; VPN use, including Cloudflare WARP
- Places, night stay, daily routine, phone-off gaps
- The subject's own IP addresses, to match against a platform's own logs
- Several monthly files of one number read as one report
Cross-linkage
/crossTwo to ten files read together, with a link diagram and one sentence per link.
- Direct calls, same tower at the same time, go-betweens
- Shared handset, SIM or connection
- Strength rated Strong, Moderate or Weak
- A CDR and an IPDR of one number read as a pair
Incident check
/incident DD-MM-YYYY HH:MMGive it a time and a place and the report opens on that moment.
- Where the phone was, and how far from the scene
- Everything it did within two hours either side
- Whether it went unusually quiet, and first-ever contacts
Tower dumps
/dump … /doneEvery operator's dump for every scene, compared in one pass.
- Numbers present at two or more scenes, with the times at each
- The same handset carrying a different SIM
- Calls among those numbers; a common contact who stayed away
Google Earth map
mapA KMZ of the report's geography — free with every report that has placeable towers.
- Key places: night-stay home, workplace, first and last located
- Every tower site, each cell's counts and the antenna direction
- The route by day, plus a track for the time slider
Tower dump plan
towers <lat,long>Which dumps are actually worth asking for, from the operators' own cell charts.
- Facing cells of the three nearest sites — request these first
- The next ring of sites — also worth asking for
- An Excel of every CGI, with distance and bearing
Platform IP log
Login and activity IP logs returned by a service provider, read into something usable.
- Where the logins came from — operator, VPN, Tor, abroad
- A ready-made request list per operator, in IST and UTC
- Missing-port warnings on shared mobile IPv4; two-places-at-once
Contact summary
For "max callers" sheets that carry one row per contact.
- Top contacts, ranked by calls and talk time
- A note on requesting the full CDR for times, towers and night activity
Chapter 04 — the deliverable
Page one is for the officer, not the engine.
Findings in the order they matter, each with what to do about it. The detailed tables — contacts, towers, timelines — follow behind.
CONFIDENTIAL
CDR — 98XXXXXXXX
Night stay — one address, 23 of 31 nights
Six associates account for 61% of all calls
Two handset changes · one silent period of 38 hours
- 01
The summary leads
Key findings first, most important at the top, in sentences an IO can put in a case diary.
- 02
Every finding carries its evidence
Counts, dates and towers sit behind each line, on the detailed pages — nothing is asserted without the rows that produced it.
- 03
Suggested next steps
What to request, where to look and which number to pull next — written as actions, not as observations.
- 04
Then ask it questions
"Where was he on 5 March at 10 pm?", "calls after 11 pm on 7 March", "last location" — answered from your own latest report, free, and in Hinglish too.
Chapter 05 — the responsibility
Case data stays with the case.
Sanket is for official investigative use, by authorised officers, on data lawfully obtained for a specific case. The handling is written down, not implied.
Local by design
Analysis and IP-ownership lookups run on the host. No CDR or IPDR content is sent to any third party — only the report, to the officer who asked for it.
The panel is localhost-only
It answers on 127.0.0.1 and nowhere else. The password is hashed with scrypt, and five wrong attempts lock sign-in for fifteen minutes.
Access is per number
Only whitelisted officers can submit a file. The operator grants, revokes and blocks access from the panel, officer by officer.
Automatic purge
Uploaded files, reports and their index entries are deleted after the retention period — 30 days by default, shorter if you set it. Delete a report and the operator files behind it go with it.
A permanent audit trail
Every submission, delivery, rejection, block and payment is logged with a timestamp and exports as CSV. In the long-term archive the case data itself is redacted — who received what, and when, is kept.
Every report is marked
Reports carry CONFIDENTIAL, the subject and the case reference, so a printed or forwarded copy is still identifiable case material.
Operator duties — full-disk encryption on the host, off-machine backups, a current access list — are set out in the compliance note shipped with the tool. That note is an operational record, not legal advice: obtain sign-off from your competent authority before deployment.
For the operator
One panel for officers, billing and the log.
A local web panel on the machine that runs Sanket: run a report by hand, watch the WhatsApp line, manage agencies and plans, and search any part of a number across every case the unit has run.
- Agency tiles, officers by plan, and a drawer per officer — plan, payments, reports, district
- Billing: revenue, payments with void, usage, prices, UPI
- Activity: reports, number search, numbers linked across the unit's own cases, the audit log
- Alerts: broadcast a message, keep a watchlist
Reports128
Officers24
Uptime31d
Illustration · sample figures
Chapter 06 — what it costs
₹20 a report, bought as credits.
That is the standard rate — a standard report uses 10 credits. The first month is free, once per number.
1-month free
₹0
30 days · once per number
100 credits — up to 10 standard reports, so a unit can try it on real files.
No card, no commitment
Pro
₹400
per 30 days
200 credits — up to 20 standard reports: CDR, IPDR, incident check, tower dumps, map.
Refill 100 credits for ₹200
Pro Plus
₹600
per 30 days
300 credits — up to 30 standard reports, plus cross-linkage and priority analysis.
For units running several cases at once
Special Access
By arrangement
operator-granted
Unlimited reports for a unit that needs them, with priority analysis. Granted and withdrawn by the operator, number by number.
Ask about agency rates
Credit guide. At the standard rate a credit is ₹2, so a report at 10 credits is ₹20.
A cross-linkage batch is 10 per file plus 10 for the combined report; a tower dump is 5 per file plus
10. A cell lookup and a tower dump plan are 5 credits each. The map is free, and so are
questions about a report. Agency rates: units with a sanctioned rate pay less per
report — it is set per officer in the panel.
Request access
Bring Sanket to your unit.
Access is granted per officer by the operator. Write from your official email with the agency, the district and roughly how many officers would use it, and we will set your unit up.
mrapoorv14@gmail.com
No mail app on this device? Copy the address and write from your official account.
For law enforcement agencies only. Sanket is not a public service and is not sold to individuals.