ARGUS
Investigation intelligence
Investigation intelligence platform

They encrypted the messages. Not the trail.

Argus reads call records, internet records, device exports, bank statements and the first information report itself onto one timeline, one map and one network — so the correlation that solves the case is produced automatically instead of by hand. From the first information report to the court report.

CDR & IPDR forensics FIR read automatically Device correlation Money trail & freeze list Section 63 report Runs offline
Scroll
CDR & IPDR forensicsAzimuth sectors, not circlesMovement replayTower dumpCo-locationFIR read automaticallyAI FindingsAI DirectionDevice-to-tower correlationMoney trailFreeze listSection 63 certificateAudit logRuns offlineCDR & IPDR forensicsAzimuth sectors, not circlesMovement replayTower dumpCo-locationFIR read automaticallyAI FindingsAI DirectionDevice-to-tower correlationMoney trailFreeze listSection 63 certificateAudit logRuns offline
The problem

Four sources, four formats,
one officer

The records exist. Reading them together is the bottleneck — and three clocks are running the whole time.

Four operators, four layouts

Every provider exports a different column arrangement. The analyst’s first days go on reshaping spreadsheets rather than investigating.

The requisition that returns nothing

A CDR-only notice on an app-based fraud comes back empty, because the accused never placed a GSM call. A fortnight is lost.

The correlation nobody performs

The device sits in one tool, the calls in another, the bank reply in a folder. Joining them is nobody’s assigned task.

0 years

of retention on CDR, EDR and IPDR under Indian telecom licence conditions. After that the record is gone — and two years is the outer limit, not a promise.

Hours

before defrauded money leaves a layer-one mule account and passes beyond practical recovery.

Days

typically spent turning four operators’ exports into one usable format before analysis can begin at all.

How it works

Everything into one case file

Nine kinds of evidence, parsed and hashed on arrival, placed on one timeline and one map — then read by whichever product the unit runs.

WHAT GOES INFirst information reportCall detail recordsInternet detail recordsPhone extractionBank and UPI statementsVehicle, ANPR, documentsONE CASE FILEparsed · hashed · correlated · placed on one timeline and one mapArgus SignalsArgus CaseArgus FinXArgus ExploreArgus suiteWHAT COMES OUTCase brief and directionMovement map and networkDevice-to-tower correlationFreeze listCourt report · Section 63
The workspace

One uploaded number, fully read

The screen that replaces a fortnight of spreadsheet work: the insight written out in sentences, the anomalies picked out and made clickable, and the movement played back along the timeline.

argus / signals — analysis✦ ARGUSAnalysisAI FindingsTimelineEventsDevicesNetworkNight hours9840 71 •••••4,182 events · 12 Jan – 28 Feb 2026 · Airtel, Tamil NaduARGUS INSIGHTSBusiest hour 21:00 · 38% of activity after dark · probable home tower Anna Nagar · 3 handsets on this SIMMOVEMENT MAP · REPLAY▶ play · by day · by week · whole periodACTIVITY · DAY × HOURSilence gap · 3 daysNew frequent contactHandset changeNight tower cluster4,182events219contacts38%after dark3handsets41towers
Argus Signals, the CDR and IPDR workspace. Every figure on this screen is computed from the uploaded record.

Movement replay

Every tower touched and the route between them, played back by day, week or whole period at three speeds.

Anomaly flags

Silence gaps, a contact that becomes frequent, night-tower concentration, handset and SIM changes.

The insight card

Busiest hour and day, night proportion, probable home and work towers — written out in sentences.

Suspect filter

Narrow or highlight by number, place or date once, and it follows the officer across every screen.

Argus AI

What Argus works out for itself

Every conclusion is produced from your own records, on your own server. Nothing leaves the building, and the same case gives the same answer every time — which is what a case diary and a court require.

argus / case — insights✦ ARGUSCase detailsAI FindingsCase flowDocumentsEvidencesData sourcesReportFIR 88 / 2026 · Madurai Cyber CrimeBNS 318(4), 319(2), 61(2) · NCRP 21902260012345 · ₹53,00,000CASE BRIEFAn 80-year-old complainant was held in a five-day “digital arrest” bycallers posing as officers. ₹53,00,000 moved in five transfers to twobeneficiary accounts, then through three accounts opened in students’ names.PARTIESComplainant1 number, 1 accountAccused4 WhatsApp numbersSuspect accounts5 · 3 rentedAI FINDINGSRented mule layerThree beneficiary accounts were opened within eleven days of each Complaint names one, pattern implicates severalThe complaint names a single student; the transaction pattern spanNo GSM contact at allThe accused numbers made no calls to the complainant. Contact was AI DIRECTION01Preserve records — accused numbers only02Requisition CDR and IPDR separately03Serve the bank, get the opening file04Resolve the operator after portability05Freeze the terminal beneficiary
The panel that opens the moment a case is created: the brief, the findings, and what to do next.

AI Findings

Fourteen to seventeen observations per case, each a specific claim with the evidence behind it and a link through to the record it came from.

AI Direction

Eight prioritised steps in the order they should be taken, each naming the record it needs and what it is expected to prove.

AI Case Brief

The report in plain language — what happened, who is named, which sections, how much moved and where it went, with numbers attributed to a role.

Plain-language search

Ask it the way an officer would say it. Argus prints how it understood the question before it answers, so a misreading is caught in one second.

Money flags

Pass-through accounts, fan-out and aggregation, same-day layering, the terminal beneficiary, and the two exits — ATM out of state and crypto.

Correlation scoring

Number matches scored by recurrence, location matches by true distance — so the strongest corroboration is read first.

How it runs. Deterministic and repeatable, entirely offline, with no case material transmitted anywhere. A language model can be configured if policy allows, and lengthens the written summaries — the extraction, the findings and the direction do not change.
Internet records

Making an IPDR readable

An operator’s internet record arrives as thousands of destination hosts. Argus resolves them to the applications behind them — which is what makes an IPDR usable in a case where the accused never placed a call.

argus / signals — IPDR by application✦ ARGUSData sourcesIPDRBank / UPIVehicle / ANPRDocumentsInternet detail record · one subscriber, one month4,912 sessions resolved to 23 applicationsWhatsApp297Instagram129Google services106Facebook101Telegram97PhonePe47HOST → APPLICATIONmedia-bom1-1.cdn→ WhatsAppgraph.instagram.com→ Instagramapi.telegram.org→ Telegramapi.phonepe.com→ PhonePeMessaging dominates the count of contacts; video dominates the volume of data. They answer different questions.
Capability

Every module

Forty working screens across the suite, grouped by the part of the investigation they serve.

The case file

Cases board
Kanban across In Progress, Under Trial and Closed; drag to move, one search across FIR, crime, station and officer, assigned officers shown by photograph.
Access control
A case appears only to its creator, its assignees and supervisors — filtered at the database, not hidden on screen.
FIR reader
PDF, Word or scan, in any Indian script. Text lifted in the browser, so the scan itself never crosses the network.
Case flow canvas
The case drawn as a network: complainant, accused, officer, numbers, accounts, vehicles, handsets and documents.
Shared notes
A floating panel on every case screen, visible to everyone on the case and pinnable to a node.

Evidence

Evidence explorer
A three-column workspace over a phone extraction: chats as conversations, calls, messages, contacts, media, web history, wireless networks, application logs, accounts, locations.
Chain of custody
A forensic hash required on every exhibit — computed or verified — and cited in the report.
Documents
The case library by category, hashed on arrival, viewable and downloadable.
Data sources
IPDR, bank and UPI statements, vehicle and ANPR, and any structured export with recognisable columns.

Telecom forensics

Analysis dashboard
Insight card, anomaly flags, movement map with replay, day-by-hour heat grid, weekly and monthly activity, calls against messages.
Flow timeline
Calendar first — pick a day, or stack several side by side to show two accused active on exactly the same four days.
Devices and SIMs
Every handset by IMEI resolved to brand and model with a change timeline; SIMs by IMSI resolved to operator and circle.
Network graphs
Contact and tower graphs sized by volume, clickable through to the events behind them.
Azimuth mapping
Coverage drawn as a directional sector from the operator’s own radio plan, set by hand or imported.
Tower dump
Every number in the case present at a chosen site in a chosen window, with the full event log.
Co-location
Two numbers, a tolerance from five minutes to four hours, every occasion they shared a tower — plus their common contacts.
Night and odd hours
22:00 to 06:00 isolated. In a great many cases this single screen is the case.

Synthesis and output

Cross-correlation
Device coordinates against towers by true distance; device parties against call records on the last ten digits. Scored, mapped, pinned.
Findings review
Everything starred, categorised as suspect, associate, victim, witness, residence, scene, hideout, travel, unusual or key.
Court report
Fourteen sections from particulars to opinion, editable in place, with the Section 63 electronic-evidence certificate.
Audit log
Every sign-in, upload, export and deletion logged with the officer, object, time and address — filterable and exportable.
Output

It ends in a document a court accepts

Findings marked once, anywhere in the case, become numbered paragraphs of a court-ready report — carrying the certificate that Section 63 of the Bharatiya Sakshya Adhiniyam now requires.

argus / report✦ ARGUSFindings reviewCase narrativeCourt reportAudit logREPORT UNDER SECTION 173 BNSSAnalysis of Call Detail and Internet Detail RecordsFIR 88/2026 · Madurai Cyber Crime Police StationACase particularsBConnection and subscriber particularsCData source and integrityDExecutive summaryECommunication statisticsFMost-contacted numbersGLocation findingsHDevice and SIM analysisIKey findings and anomaliesJFeatured eventsKObservations and opinionLSeized devices, chain of custodyMDevice–CDR cross-correlationNCase narrativeCERTIFICATE — SECTION 63(4), BHARATIYA SAKSHYA ADHINIYAM 2023Part A signed by the person in charge of the system. Part B signed by the expert.Every paragraph traces back to a starred finding, and every finding to its source row.
The products

Five products, one system

A single installation becomes any of them. A district cyber cell takes call-record analysis; a crime branch takes the whole case file. An upgrade is a setting, not a migration.

The market

How Argus compares

The tools a force may already own each see one kind of evidence. Cellebrite, Magnet and MSAB pull data off the handset better than anything else — Argus reads their export into the same case as the calls and the money.

CapabilityArgus Cellebrite
Inseyets
Magnet
Axiom
CellHawk
Penlink PLX
C-DAC
Advik
Extraction from a seized handset
CDR import and tower mapping
Azimuth sector plotting~
IPDR resolved to applications~~
Reads the FIR and builds the case
Device correlated against call records~~~
Money trail and freeze list
Court report with Section 63~~~~
Runs offline on a departmental server

present  ·  ~ partial, or present but not the tool’s strength  ·  not in this category. Competitor entries reflect published vendor positioning.

What happens next

The trail is readable.
The only question is how fast.

That is the whole of a modern investigation — and the only thing Argus was built to do.

STEP 01

Install

Copy the application to a departmental server and open it once. The database builds itself and the unit’s officers are added. No appliance, nothing on any desk.

STEP 02

Run one live case

Take a case already in hand. Drop the FIR in, upload the operator’s records, add the bank reply. The brief, the direction and the correlation follow the same afternoon.

STEP 03

Judge it on the report

Print the court report and compare it against what the same case produced by hand — in content, in time taken, and in traceability to source.