The catalog

107 reports, grouped by the question you are asking.

Every report below is registered in the engine — this page is the catalog, not a summary of it. They are organised by investigative question, not by which file the answer happens to live in: “where was he” spans CDR, IPDR and tower dumps, and asking an officer to know that first is asking them to know the answer. Each one paginates, sorts, searches, drills to its records and exports with a Section 63(4) certificate in six formats sharing one result hash.

Who they contact

Associates, direction, channels and operators

Top Associates / Contact Frequency
Call Directionality & Initiation Balance
Call-Duration & Relationship Strength
SMS Sender-ID Classification / Digital Footprint
B-Party Operator Attribution
Flash / Unanswered Call Patterns
International (ISD) Calls & SMS
Relationship Channel: Voice-only, SMS-only or Mixed
Response Latency & Reciprocity
Call Bearer & Interconnect Profile
Per-Contact Call-Duration Outliers
SMS Origin: Header Decode & SMSC Route
Call-Forwarding Register

Where they were

Towers, movement, anchors and alibi checks

Alibi Check: Claimed Time and Place
Tower (CGI) Geo-Mapping & Footprint
Home / Work / Night-Anchor Inference
Movement / Travel-Path Reconstruction
Location Cross-Validation & Gap-Filling
Movement During Calls (Handover)
Roaming Network & Circle Summary
Serving Cell & Session Location
Co-Location / Meeting Inference
Roaming, Circle & CGI Location
Serving-Cell Path (Data Sessions)
Billing Address vs Night Anchor

Patterns & timing

Routine, night activity, silences and shifts

Data Routine: Hour × Weekday Heatmap
Temporal Heatmap & Daily Routine
Unified Timeline — Voice, Data and Tower Sightings
Odd-Hour / Night-Activity Profiling
Session Timeline / Online Presence
Silent / Phone-Off Periods
Bursts, Silent Periods & Contact Lifecycle
Cross-Channel Silence Corroboration
Data Silent / Idle Periods
Fan-Out / Broadcast Bursts
Weekday vs Weekend Shift
Channel-Migration / Encrypted-Comms Inference
Contact Churn & New-Contact Velocity
Cross-Domain Anomaly & Risk Scoring
Service-Mix & VoWiFi-IP Analysis
Temporal Patterns, Bursts & NAT Allocation

Devices & SIMs

Handsets, IMEI/IMSI bindings and swaps

IMEI Change & Device-History Timeline
Device Intelligence (TAC)
Device-Centric Identity Correlation
IMEI–IMSI Binding / SIM-Swap Detection
Device & SIM Fingerprinting Integrity
IMEI Format, TAC & Cross-Subject Audit
One SIM, Two Handsets at Once
Radio Access & APN Profile
Device Handoff / Identity Migration (lead)

What they did online

Sessions, destinations, protocols and exposure

CGNAT IP+Port → Subscriber Resolution
Application / Protocol Classification
Destination ASN / Org Attribution
Per-Subscriber Activity / Top Talkers
Reverse Destination Lookup
Bulk IP Lookup
Data Volume by Destination
Destination Geolocation / Foreign Comms
Public IP & Port Ledger per Subscriber
Suspicious-Protocol / Anomalous-Port Detection
Threat-Intelligence Cross-Check
VPN / Tor / Anonymiser Detection
VoIP & Real-Time Communication Analysis
"Call-then-Connect" Correlation
Common-Destination Co-occurrence Clusters
DNS & NTP Behaviour Profiling
Dark-Web / Tor Infrastructure Exposure
High-Duration / Bulk-Transfer Outliers
IPv6 Sessions (Port-free Identity)
Upload / Download Ratio Profile
VoWiFi → Broadband Bridge
OSINT Entity Graph (subscriber ↔ infrastructure)

Who was at the scene

Tower-dump triage: presence, co-presence, recurrence

Co-Presence / Possible Associates
Cross-Tower Recurring Numbers
Dump Numbers Known to the Case
Who Was in This Area?
Numbers Across Crime References
Subscriber Activity Profile
Tower Presence / Cell Occupancy
Continuous Presence (Dwell) at a Cell
Device / SIM Anomalies (IMEI ↔ number)
Sector (Azimuth) Presence
Activity Over Time (hourly)
Contact Frequency (B-party)
Dump Completeness by Operator

Money & transactions

Bank and wallet alerts, transaction-time contact

Banking & Financial Activity Footprint
Contact Around Bank & Payment Alerts
Victim ↔ Suspect Correlation
Group Financial Timeline
Where the Phone Was When the Money Moved
Virtual-Asset (Crypto) Destination Exposure

The wider network

Multi-suspect: matrices, chains, shared assets

Inter-Suspect Contact Matrix
Shared Associates / Bridge Contacts
Network / Link-Chart Export
Relay / Instruction Chains
Rendezvous / Meeting Detector
Shared Anchor Towers
Shared Device / SIM Ring
Contact Communities (Graph Clustering)

Evidence & court

Completeness, legal authority, dossier, cross-case

360° Subject Dossier
Disclosure Completeness & Integrity Statement
Legal-Authority Register
Chain of Custody — Evidence Files
Cross-Case Entity Overlap

Raw records

The disclosed rows themselves, filterable

CDR Events (evidence grid)
IPDR Sessions (evidence grid)
Tower Dump (evidence grid)

107 registered reports across 10 sections, including the three evidence grids. Adding a report — or swapping its engine — touches nothing else.

The case workspace

7 views per case

Dashboard

Headline volumes, QC health and the period covered. The QC tile turns red and says so when a file does not reconcile.

Evidence files

Uploads with SHA-256/MD5 on arrival, parse progress, QC report, ZIP expansion, and the column-mapping UI for unrecognised formats.

Reports

All 107 of them, driven the same way: search, sort, filter, save a view you use often, and tap any value to follow it into the other reports about it. On a phone each row becomes a card, so nothing needs sideways scrolling.

Map & graph

Offline geo plot with point/heat modes and a deterministic force-directed entity graph you can click to isolate a neighbourhood.

Insights

AI leads, labelled and method-noted; ask-the-case; case briefs from a template or a local model.

Live feed

Parsing progress, files becoming ready and watch-rule alerts pushed over an open stream as they happen — no refresh, no polling, and a clear banner rather than a stale figure when the connection drops. Rules match records you already hold or that an operator system sends you: nothing is intercepted.

Activity

In-flight parses and exports plus this case's append-only audit trail. Live means you are told the moment a record reaches TraceLens — the analysis itself is still post-hoc, and there is no interception capability.

Platform

Everything an investigator needs, and nothing an exhibit can't survive

Template registry & mapping UI

Built-in operator templates match by header signature; an analyst maps an unknown format once and it parses tenant-wide from then on. No code deploys for new layouts.

ZIP bundles & CSV intake

Bundles expand into individual hashed evidence files, with zip-bomb guards. CSVs parse through the same string-safe pipeline as workbooks.

Cross-case entity search

One number, IMEI, IP or CGI searched across every case you can see — with phone-format variants generated automatically.

One-click court dossier

A curated exhibit set rendered as certified PDFs, a cover index of every exhibit hash, and a bundle hash a re-run reproduces.

Graph export for your tools

GraphML, GEXF and CSV edge lists — the entity graph opens in i2 or Gephi, not just in TraceLens.

Saved views & drill-through

Any grid state can be named and kept; any aggregate row drills to the exact underlying records that produced it.

MFA & workspace policy

TOTP two-factor with per-tenant enforcement, IP allowlists, export watermarks, export approval and retention windows — all admin switches.

Object-level case access

Creator, team and workspace-admin visibility on every endpoint. A case you cannot see answers 404 — its existence is not disclosed.

Append-only audit

Every authenticated view, upload and export lands in the audit log. The activity tab shows a case's trail to the people cleared to see it.

Retention & destruction

A nightly sweep purges closed cases past the retention window, writing a tamper-evident destruction certificate first, in the same transaction.

Device & operator enrichment

TAC tables name the handset, LRN data attributes ported numbers, anonymiser feeds flag Tor and VPN ranges — loaded from files, air-gap friendly, honestly “not loaded” when absent.

Offline geo, opt-in tiles

The default map requests nothing — it draws the case's own coordinates with a graticule and scale bar. A basemap is a deliberate, deployment-level opt-in.

Evidence classes on every report

A — disclosed fact. B — derived with declared constants, printed as parameters. C — reference-enriched, naming its snapshot and date. D — investigative lead, exportable only under a lead banner. The class is printed on every Section 63(4) certificate, so a reader knows which kind of claim they are holding.

Legal-authority register

Each disclosure records the instrument it was produced under — Section 94 BNSS, a Section 20 interception order, an SP-rank administrative request — with its reference, date, issuing authority, the operator's request id and nodal officer, and whether the operator's own 63(4) certificate arrived. Recited on every export beside the file hash.

Disclosure completeness audit

What was ordered against what actually arrived: the requested window from the file's own preamble versus the records in it, days with no records, rows the operator's file left blank, rejects with reasons and duplicates. The first question defence counsel asks.

Live case events

One push stream per open case. Alerts, parse progress, exports and dossiers arrive as they happen instead of being polled for; the browser re-reads through the same authenticated endpoints, so the stream adds no second data path. TraceLens still intercepts nothing — the events describe state changes inside TraceLens.

Field-ready on a phone

Installable as an app, full-screen, with thumb-reach navigation, report rows rendered as cards instead of a spreadsheet, and sheets that rise from the bottom edge. Case data is never written to the device: offline it says so rather than showing a stale figure.

Try it on a real disclosure

The trial is the full platform — every report, every export format, the same certificates.

Start your free trial